WebAuthn: Difference between revisions
→In the media: Adjusting date formatting #VulcanSphere |
Rescuing 2 sources and tagging 0 as dead.) #IABot (v2.0.9.5 |
||
| Line 97: | Line 97: | ||
For the purposes of illustration, we assume the authenticator is a roaming hardware authenticator (see below for other options). In any case, the authenticator is a multi-factor [[Cryptography|cryptographic]] authenticator that uses [[Cryptography#Public-key cryptography|public-key cryptography]] to sign an authentication assertion targeted at the WebAuthn Relying Party. Assuming the authenticator uses a [[Personal identification number|PIN]] for user verification, the authenticator itself is ''something you have'' while the PIN is ''something you know''. | For the purposes of illustration, we assume the authenticator is a roaming hardware authenticator (see below for other options). In any case, the authenticator is a multi-factor [[Cryptography|cryptographic]] authenticator that uses [[Cryptography#Public-key cryptography|public-key cryptography]] to sign an authentication assertion targeted at the WebAuthn Relying Party. Assuming the authenticator uses a [[Personal identification number|PIN]] for user verification, the authenticator itself is ''something you have'' while the PIN is ''something you know''. | ||
To initiate the WebAuthn authentication flow,<ref>{{cite web |url=https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API |title=Web Authentication API |at=Section [https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API#Authentication Authentication] |publisher=[[Mozilla]] |access-date=18 March 2019}}</ref> the WebAuthn Relying Party indicates its intentions to the WebAuthn Client (i.e., the browser) via [[JavaScript]]. The WebAuthn Client communicates with the authenticator using a JavaScript [[API]] implemented in the browser. A roaming authenticator conforms to the FIDO [[Client to Authenticator Protocol]] (CTAP).<ref name="FIDO-CTAP">{{cite web |editor1-last=Brand |editor1-first=Christiaan |editor2-last=Czeskis |editor2-first=Alexei |editor3-last=Ehrensvärd |editor3-first=Jakob |editor4-last=Jones |editor4-first=Michael B. |editor5-last=Kumar |editor5-first=Akshay |editor6-last=Lindemann |editor6-first=Rolf |editor7-last=Powers |editor7-first=Adam |editor8-last=Verrept |editor8-first=Johan |title=Client to Authenticator Protocol (CTAP) |url=https://fidoalliance.org/specs/fido-v2.0-ps-20190130-pub/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html |publisher=FIDO Alliance |access-date=7 March 2019 |date=30 January 2019}}</ref> | To initiate the WebAuthn authentication flow,<ref>{{cite web |url=https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API |title=Web Authentication API |at=Section [https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API#Authentication Authentication] |publisher=[[Mozilla]] |access-date=18 March 2019}}</ref> the WebAuthn Relying Party indicates its intentions to the WebAuthn Client (i.e., the browser) via [[JavaScript]]. The WebAuthn Client communicates with the authenticator using a JavaScript [[API]] implemented in the browser. A roaming authenticator conforms to the FIDO [[Client to Authenticator Protocol]] (CTAP).<ref name="FIDO-CTAP">{{cite web |editor1-last=Brand |editor1-first=Christiaan |editor2-last=Czeskis |editor2-first=Alexei |editor3-last=Ehrensvärd |editor3-first=Jakob |editor4-last=Jones |editor4-first=Michael B. |editor5-last=Kumar |editor5-first=Akshay |editor6-last=Lindemann |editor6-first=Rolf |editor7-last=Powers |editor7-first=Adam |editor8-last=Verrept |editor8-first=Johan |title=Client to Authenticator Protocol (CTAP) |url=https://fidoalliance.org/specs/fido-v2.0-ps-20190130-pub/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html |publisher=FIDO Alliance |access-date=7 March 2019 |date=30 January 2019 |archive-date=8 March 2019 |archive-url=https://web.archive.org/web/20190308081859/https://fidoalliance.org/specs/fido-v2.0-ps-20190130-pub/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html |url-status=dead }}</ref> | ||
WebAuthn does not strictly require a roaming hardware authenticator. Alternatively, a software authenticator (e.g., implemented on a smartphone) or a platform authenticator (i.e., an authenticator implemented directly on the WebAuthn Client Device) may be used. Relevant examples of platform authenticators include [[Windows Hello]]<ref>{{cite web |last1=Simons |first1=Alex |title=Secure password-less sign-in for your Microsoft account using a security key or Windows Hello |url=https://www.microsoft.com/en-us/microsoft-365/blog/2018/11/20/sign-in-to-your-microsoft-account-without-a-password-using-windows-hello-or-a-security-key/ |publisher=[[Microsoft]] |access-date=6 March 2019 |date=20 November 2018}}</ref> and the [[Android (operating system)|Android operating system]].<ref>{{cite web |title=Android Now FIDO2 Certified, Accelerating Global Migration Beyond Passwords |url=https://fidoalliance.org/android-now-fido2-certified-accelerating-global-migration-beyond-passwords/ |publisher=[[FIDO Alliance]] |access-date=6 March 2019 |location=BARCELONA |date=25 February 2019}}</ref> | WebAuthn does not strictly require a roaming hardware authenticator. Alternatively, a software authenticator (e.g., implemented on a smartphone) or a platform authenticator (i.e., an authenticator implemented directly on the WebAuthn Client Device) may be used. Relevant examples of platform authenticators include [[Windows Hello]]<ref>{{cite web |last1=Simons |first1=Alex |title=Secure password-less sign-in for your Microsoft account using a security key or Windows Hello |url=https://www.microsoft.com/en-us/microsoft-365/blog/2018/11/20/sign-in-to-your-microsoft-account-without-a-password-using-windows-hello-or-a-security-key/ |publisher=[[Microsoft]] |access-date=6 March 2019 |date=20 November 2018}}</ref> and the [[Android (operating system)|Android operating system]].<ref>{{cite web |title=Android Now FIDO2 Certified, Accelerating Global Migration Beyond Passwords |url=https://fidoalliance.org/android-now-fido2-certified-accelerating-global-migration-beyond-passwords/ |publisher=[[FIDO Alliance]] |access-date=6 March 2019 |location=BARCELONA |date=25 February 2019}}</ref> | ||
| Line 123: | Line 123: | ||
One of the first FIDO2-compatible [[authenticator]]s was the second-generation [[YubiKey|Security Key]] by Yubico, announced on 10 April 2018.<ref>{{cite press release |url=https://www.yubico.com/press-releases/280530/ |title=Yubico Launches New Developer Program and Security Key for FIDO2 and WebAuthn W3C Specifications |date=2018-04-10 |access-date=2018-05-11}}</ref> The first FIDO2-compatible authenticators with a display was Trezor Model T by SatoshiLabs, announced on 6 November 2019.<ref>{{cite web |url=https://medium.com/trezor-security-blog/make-passwords-a-thing-of-the-past-a402745750dc |title=Make Passwords a Thing of the Past, FIDO2 Is Now Available on Trezor Model T |date=2019-11-06 |access-date=2019-11-06}}</ref> Trezor Model T was also the first authenticator that allowed users to select which FIDO2 resident credential should be used directly on a device. | One of the first FIDO2-compatible [[authenticator]]s was the second-generation [[YubiKey|Security Key]] by Yubico, announced on 10 April 2018.<ref>{{cite press release |url=https://www.yubico.com/press-releases/280530/ |title=Yubico Launches New Developer Program and Security Key for FIDO2 and WebAuthn W3C Specifications |date=2018-04-10 |access-date=2018-05-11}}</ref> The first FIDO2-compatible authenticators with a display was Trezor Model T by SatoshiLabs, announced on 6 November 2019.<ref>{{cite web |url=https://medium.com/trezor-security-blog/make-passwords-a-thing-of-the-past-a402745750dc |title=Make Passwords a Thing of the Past, FIDO2 Is Now Available on Trezor Model T |date=2019-11-06 |access-date=2019-11-06}}</ref> Trezor Model T was also the first authenticator that allowed users to select which FIDO2 resident credential should be used directly on a device. | ||
The first Security Level 2 certified FIDO2 key, called "Goldengate" was announced one year later by eWBM on 8 April 2019.<ref>{{cite press release |url=https://www.ewbm.com/press/pr2/ |title=eWBM: eWBM's Goldengate Fingerprint Reader is First to Get FIDO L2 Certification |date=2019-04-08 |access-date=2019-06-15}}</ref><ref>{{cite press release |url=https://mobileidworld.com/ewbm-goldengate-fingerprint-reader-fido-l2-certification-804084/ |title=Mobile ID World, Alex Perala: eWBM's Goldengate Fingerprint Reader is First to Get FIDO L2 Certification |date=2019-04-09 |access-date=2019-06-15}}</ref> | The first Security Level 2 certified FIDO2 key, called "Goldengate" was announced one year later by eWBM on 8 April 2019.<ref>{{cite press release |url=https://www.ewbm.com/press/pr2/ |title=eWBM: eWBM's Goldengate Fingerprint Reader is First to Get FIDO L2 Certification |date=2019-04-08 |access-date=2019-06-15 |archive-date=1 January 2020 |archive-url=https://web.archive.org/web/20200101151355/https://www.ewbm.com/press/pr2/ |url-status=dead }}</ref><ref>{{cite press release |url=https://mobileidworld.com/ewbm-goldengate-fingerprint-reader-fido-l2-certification-804084/ |title=Mobile ID World, Alex Perala: eWBM's Goldengate Fingerprint Reader is First to Get FIDO L2 Certification |date=2019-04-09 |access-date=2019-06-15}}</ref> | ||
[[Dropbox]] announced support for WebAuthn logins (as a 2nd factor) on 8 May 2018.<ref>{{cite web |url=https://blogs.dropbox.com/tech/2018/05/introducing-webauthn-support-for-secure-dropbox-sign-in/ |title=Introducing WebAuthn support for secure Dropbox sign in |first=Brad |last=Girardeau |publisher=Dropbox |work=Dropbox Tech Blog |date=2018-05-08 |access-date=2018-05-11}}</ref> | [[Dropbox]] announced support for WebAuthn logins (as a 2nd factor) on 8 May 2018.<ref>{{cite web |url=https://blogs.dropbox.com/tech/2018/05/introducing-webauthn-support-for-secure-dropbox-sign-in/ |title=Introducing WebAuthn support for secure Dropbox sign in |first=Brad |last=Girardeau |publisher=Dropbox |work=Dropbox Tech Blog |date=2018-05-08 |access-date=2018-05-11}}</ref> | ||