WebAuthn: Difference between revisions
Rewrite first paragraph to limit jargon |
Caveat the "password replacement" wording |
||
| Line 43: | Line 43: | ||
'''Web Authentication''' ('''WebAuthn''') is a [[web standard]] published by the [[World Wide Web Consortium]] (W3C).<ref name="W3C-WebAuthn-Level-1"/><ref>{{cite web |url=https://www.w3.org/blog/webauthn/ |title=Web Authentication Working Group |publisher=[[World Wide Web Consortium]] |access-date=2018-05-11}}</ref><ref>{{cite episode |title=What is WebAuthn |series=TechStuff |publisher=[[iHeartMedia]] |series-link=HowStuffWorks#TechStuff |first=Jonathan |last=Strickland |date=18 March 2019 |url=https://www.iheart.com/podcast/105-techstuff-26941194/episode/what-is-webauthn-30705004/ |minutes=20:35 |access-date=20 March 2019}}</ref> | '''Web Authentication''' ('''WebAuthn''') is a [[web standard]] published by the [[World Wide Web Consortium]] (W3C).<ref name="W3C-WebAuthn-Level-1"/><ref>{{cite web |url=https://www.w3.org/blog/webauthn/ |title=Web Authentication Working Group |publisher=[[World Wide Web Consortium]] |access-date=2018-05-11}}</ref><ref>{{cite episode |title=What is WebAuthn |series=TechStuff |publisher=[[iHeartMedia]] |series-link=HowStuffWorks#TechStuff |first=Jonathan |last=Strickland |date=18 March 2019 |url=https://www.iheart.com/podcast/105-techstuff-26941194/episode/what-is-webauthn-30705004/ |minutes=20:35 |access-date=20 March 2019}}</ref> | ||
It defines an [[API]] for websites to [[Authentication#In computer science|authenticate]] users using WebAuthn credentials ('''passkeys'''<ref>{{cite web |title=White Paper: Multi-Device FIDO Credentials |url=https://fidoalliance.org/wp-content/uploads/2022/03/How-FIDO-Addresses-a-Full-Range-of-Use-Cases-March24.pdf |publisher=[[FIDO Alliance]] |access-date=20 May 2024 |page=6 |date=March 2022}}</ref><ref>{{cite web |last1=Brown |first1=William |title=webauthn-rs docs |url=https://docs.rs/webauthn-rs/latest/webauthn_rs/#what-is-a-passkey |website=Docs.rs |publisher=Kanidm Identity Management Project |access-date=3 July 2025 |date=April 2024 |archive-url=https://web.archive.org/web/20250612151121/https://docs.rs/webauthn-rs/latest/webauthn_rs/#what-is-a-passkey |archive-date=12 June 2025}}</ref>) and outlines what WebAuthn authenticators should do. | It defines an [[API]] for websites to [[Authentication#In computer science|authenticate]] users using WebAuthn credentials ('''passkeys'''<ref>{{cite web |title=White Paper: Multi-Device FIDO Credentials |url=https://fidoalliance.org/wp-content/uploads/2022/03/How-FIDO-Addresses-a-Full-Range-of-Use-Cases-March24.pdf |publisher=[[FIDO Alliance]] |access-date=20 May 2024 |page=6 |date=March 2022}}</ref><ref>{{cite web |last1=Brown |first1=William |title=webauthn-rs docs |url=https://docs.rs/webauthn-rs/latest/webauthn_rs/#what-is-a-passkey |website=Docs.rs |publisher=Kanidm Identity Management Project |access-date=3 July 2025 |date=April 2024 |archive-url=https://web.archive.org/web/20250612151121/https://docs.rs/webauthn-rs/latest/webauthn_rs/#what-is-a-passkey |archive-date=12 June 2025}}</ref>) and outlines what WebAuthn authenticators should do. | ||
It solves many of the issues of traditional [[password]]-based authentication by verifying the user's identity with [[digital signatures]], eliminating the need to send passwords over the internet | It solves many of the issues of traditional [[password]]-based authentication by verifying the user's identity with [[digital signatures]].<ref name="imperialviolet-webauthn">{{cite web |url=https://www.imperialviolet.org/tourofwebauthn/tourofwebauthn.html |title=A Tour of WebAuthn}}</ref> | ||
WebAuthn is often touted as a complete replacement for passwords, eliminating the need to send passwords over the internet or store them on servers. However, most websites that support WebAuthn still utilize passwords in some way.<ref name="arstechnica-not-usable">{{cite web |last1=Goodin |first1=Dan |title=Passkey technology is elegant, but it’s most definitely not usable security |url=https://arstechnica.com/security/2024/12/passkey-technology-is-elegant-but-its-most-definitely-not-usable-security/?utm_source=chatgpt.com |publisher=Ars Technica |access-date=3 July 2025}}</ref> | |||
Users can store and use their WebAuthn credentials from a variety of authenticator types, such as physical [[Security token|security keys]] or smartphones. Credentials are often synced between devices for ease-of-use, and in some circumstances they can remove the need for usernames. | Users can store and use their WebAuthn credentials from a variety of authenticator types, such as physical [[Security token|security keys]] or smartphones. Credentials are often synced between devices for ease-of-use, and in some circumstances they can remove the need for usernames. | ||
| Line 158: | Line 159: | ||
<blockquote>That's a one-click sign-in, and clicking the purple button immediately grants me access to my account.<ref name="troyhunt"></ref></blockquote> | <blockquote>That's a one-click sign-in, and clicking the purple button immediately grants me access to my account.<ref name="troyhunt"></ref></blockquote> | ||
*"Passkey technology is elegant, but it’s most definitely not usable security"<ref | *"Passkey technology is elegant, but it’s most definitely not usable security"<ref name="arstechnica-not-usable" /> - Dan Goodin – December 30, 2024 [[Ars Technica]] | ||
*"...the implementation seems to have failed the "make it easy for users" test, which in my view is the whole point of passkeys. I have been using [[public key cryptography]] for 30-plus years...If I find passkeys confusing to use, it doesn’t bode well for more typical users."<ref>https://www.theregister.com/2024/11/17/passkeys_passwords/</ref> - Bruce Davie, 17 Nov 2024 [[The Register]] | *"...the implementation seems to have failed the "make it easy for users" test, which in my view is the whole point of passkeys. I have been using [[public key cryptography]] for 30-plus years...If I find passkeys confusing to use, it doesn’t bode well for more typical users."<ref>https://www.theregister.com/2024/11/17/passkeys_passwords/</ref> - Bruce Davie, 17 Nov 2024 [[The Register]] | ||