WebAuthn: Difference between revisions
Moving #passkey #branding section to the higher section and adding an example of authentication with #Android Credential Manager (Conditional UI) #Cybersecurity #WebAuthn #VulcanSphere |
Rescuing 38 sources and tagging 0 as dead.) #IABot (v2.0.9.5 |
||
| Line 41: | Line 41: | ||
}} | }} | ||
'''Web Authentication''' ('''WebAuthn''') is a [[web standard]] published by the [[World Wide Web Consortium]] (W3C).<ref name="W3C-WebAuthn-Level-1"/><ref>{{cite web |url=https://www.w3.org/blog/webauthn/ |title=Web Authentication Working Group |publisher=[[World Wide Web Consortium]] |access-date=2018-05-11}}</ref><ref>{{cite episode |title=What is WebAuthn |series=TechStuff |publisher=[[iHeartMedia]] |series-link=HowStuffWorks#TechStuff |first=Jonathan |last=Strickland |date=18 March 2019 |url=https://www.iheart.com/podcast/105-techstuff-26941194/episode/what-is-webauthn-30705004/ |minutes=20:35 |access-date=20 March 2019}}</ref> | '''Web Authentication''' ('''WebAuthn''') is a [[web standard]] published by the [[World Wide Web Consortium]] (W3C).<ref name="W3C-WebAuthn-Level-1"/><ref>{{cite web |url=https://www.w3.org/blog/webauthn/ |title=Web Authentication Working Group |publisher=[[World Wide Web Consortium]] |access-date=2018-05-11 |archive-date=15 May 2016 |archive-url=https://web.archive.org/web/20160515104033/https://www.w3.org/blog/webauthn/ |url-status=live }}</ref><ref>{{cite episode |title=What is WebAuthn |series=TechStuff |publisher=[[iHeartMedia]] |series-link=HowStuffWorks#TechStuff |first=Jonathan |last=Strickland |date=18 March 2019 |url=https://www.iheart.com/podcast/105-techstuff-26941194/episode/what-is-webauthn-30705004/ |minutes=20:35 |access-date=20 March 2019 |archive-date=25 June 2021 |archive-url=https://web.archive.org/web/20210625115545/https://www.iheart.com/podcast/105-techstuff-26941194/episode/what-is-webauthn-30705004/ |url-status=live }}</ref> | ||
It defines an [[API]] that websites use to [[Authentication#In computer science|authenticate]] with WebAuthn credentials ('''passkeys'''<ref>{{cite web |title=White Paper: Multi-Device FIDO Credentials |url=https://fidoalliance.org/wp-content/uploads/2022/03/How-FIDO-Addresses-a-Full-Range-of-Use-Cases-March24.pdf |publisher=[[FIDO Alliance]] |access-date=20 May 2024 |page=6 |date=March 2022}}</ref><ref name="docsrs-webauthnrs">{{cite web |last1=Brown |first1=William |title=webauthn-rs docs |url=https://docs.rs/webauthn-rs/latest/webauthn_rs/#what-is-a-passkey |website=Docs.rs |publisher=Kanidm Identity Management Project |access-date=3 July 2025 |date=April 2024 |archive-url=https://web.archive.org/web/20250612151121/https://docs.rs/webauthn-rs/latest/webauthn_rs/#what-is-a-passkey |archive-date=12 June 2025}}</ref>) and outlines what WebAuthn authenticators should do. | It defines an [[API]] that websites use to [[Authentication#In computer science|authenticate]] with WebAuthn credentials ('''passkeys'''<ref>{{cite web |title=White Paper: Multi-Device FIDO Credentials |url=https://fidoalliance.org/wp-content/uploads/2022/03/How-FIDO-Addresses-a-Full-Range-of-Use-Cases-March24.pdf |publisher=[[FIDO Alliance]] |access-date=20 May 2024 |page=6 |date=March 2022 |archive-date=16 June 2024 |archive-url=https://web.archive.org/web/20240616202812/https://fidoalliance.org/wp-content/uploads/2022/03/How-FIDO-Addresses-a-Full-Range-of-Use-Cases-March24.pdf |url-status=live }}</ref><ref name="docsrs-webauthnrs">{{cite web |last1=Brown |first1=William |title=webauthn-rs docs |url=https://docs.rs/webauthn-rs/latest/webauthn_rs/#what-is-a-passkey |website=Docs.rs |publisher=Kanidm Identity Management Project |access-date=3 July 2025 |date=April 2024 |archive-url=https://web.archive.org/web/20250612151121/https://docs.rs/webauthn-rs/latest/webauthn_rs/#what-is-a-passkey |archive-date=12 June 2025}}</ref>) and outlines what WebAuthn authenticators should do. | ||
It solves many of the issues of traditional [[password]]-based authentication by verifying the user's identity with [[digital signatures]].<ref name="imperialviolet-webauthn">{{cite web |last=Langley |first=Adam |date=2024-12-23 |title=A Tour of WebAuthn |url=https://www.imperialviolet.org/tourofwebauthn/tourofwebauthn.html |access-date=2025-08-13 |website=Imperial Violet}}</ref> | It solves many of the issues of traditional [[password]]-based authentication by verifying the user's identity with [[digital signatures]].<ref name="imperialviolet-webauthn">{{cite web |last=Langley |first=Adam |date=2024-12-23 |title=A Tour of WebAuthn |url=https://www.imperialviolet.org/tourofwebauthn/tourofwebauthn.html |access-date=2025-08-13 |website=Imperial Violet}}</ref> | ||
Although WebAuthn is often touted as a complete replacement for passwords, most websites that implement it continue to use passwords in some capacity.<ref name="arstechnica-not-usable">{{cite web |last1=Goodin |first1=Dan |title=Passkey technology is elegant, but it’s most definitely not usable security |url=https://arstechnica.com/security/2024/12/passkey-technology-is-elegant-but-its-most-definitely-not-usable-security/ |publisher=Ars Technica |access-date=3 July 2025}}</ref> | Although WebAuthn is often touted as a complete replacement for passwords, most websites that implement it continue to use passwords in some capacity.<ref name="arstechnica-not-usable">{{cite web |last1=Goodin |first1=Dan |title=Passkey technology is elegant, but it’s most definitely not usable security |url=https://arstechnica.com/security/2024/12/passkey-technology-is-elegant-but-its-most-definitely-not-usable-security/ |publisher=Ars Technica |access-date=3 July 2025 |archive-date=3 July 2025 |archive-url=https://web.archive.org/web/20250703130434/https://arstechnica.com/security/2024/12/passkey-technology-is-elegant-but-its-most-definitely-not-usable-security/ |url-status=live }}</ref> | ||
To use WebAuthn, users require a compatible authenticator. The standard does not specify how to store the [[private key|keys]] required for signing, so a variety of authenticator types can be used. The most common authenticator type is a platform authenticator, which is built into the [[operating system]] of the device. Common platform authenticators include [[Android (operating system)|Android]], [[Apple Keychain]] and [[Windows Hello]]. These make use of hardware security features (such as [[trusted execution environment|TEE]] and [[Trusted Platform Module|TPM]]), and often sync credentials between devices for ease-of-use. Another common authenticator type is a roaming authenticator, where a separate hardware device authenticates the user by connecting over [[USB]], [[Bluetooth Low Energy]], or [[near-field communications]] (NFC). Most [[smartphones]] and some [[Password manager|password managers]] can be used as roaming authenticators, and dedicated physical [[security token|security keys]] are also used. WebAuthn is effectively backward compatible with FIDO [[Universal 2nd Factor]] (U2F) as they both use the [[CTAP]] protocol.<ref>{{cite web |title=WebAuthn / CTAP: Modern Authentication |url=https://www.w3.org/Security/201812-Auth-ID/05_-_Day_1_-_Understanding_WebAuthn,_CTAP,_EAT,_FIDO_and_Authenticators.pdf |publisher=[[World Wide Web Consortium]] |access-date=11 March 2019 |date=10 December 2018}}</ref> | To use WebAuthn, users require a compatible authenticator. The standard does not specify how to store the [[private key|keys]] required for signing, so a variety of authenticator types can be used. The most common authenticator type is a platform authenticator, which is built into the [[operating system]] of the device. Common platform authenticators include [[Android (operating system)|Android]], [[Apple Keychain]] and [[Windows Hello]]. These make use of hardware security features (such as [[trusted execution environment|TEE]] and [[Trusted Platform Module|TPM]]), and often sync credentials between devices for ease-of-use. Another common authenticator type is a roaming authenticator, where a separate hardware device authenticates the user by connecting over [[USB]], [[Bluetooth Low Energy]], or [[near-field communications]] (NFC). Most [[smartphones]] and some [[Password manager|password managers]] can be used as roaming authenticators, and dedicated physical [[security token|security keys]] are also used. WebAuthn is effectively backward compatible with FIDO [[Universal 2nd Factor]] (U2F) as they both use the [[CTAP]] protocol.<ref>{{cite web |title=WebAuthn / CTAP: Modern Authentication |url=https://www.w3.org/Security/201812-Auth-ID/05_-_Day_1_-_Understanding_WebAuthn,_CTAP,_EAT,_FIDO_and_Authenticators.pdf |publisher=[[World Wide Web Consortium]] |access-date=11 March 2019 |date=10 December 2018 |archive-date=4 December 2020 |archive-url=https://web.archive.org/web/20201204162731/https://www.w3.org/Security/201812-Auth-ID/05_-_Day_1_-_Understanding_WebAuthn,_CTAP,_EAT,_FIDO_and_Authenticators.pdf |url-status=live }}</ref> | ||
Like legacy U2F, WebAuthn is resistant to [[phishing|phishing attacks]]<ref>{{cite web |last1=Kan |first1=Michael |title=Google: Phishing Attacks That Can Beat Two-Factor Are on the Rise |url=https://www.pcmag.com/news/367026/google-phishing-attacks-that-can-beat-two-factor-are-on-the |publisher=PC Magazine |access-date=8 March 2019 |date=7 March 2019}}</ref> as the authenticator only offers credentials that were registered on the [[same-origin policy|same website]]. However, unlike U2F, WebAuthn can be implemented in a [[passwordless authentication|passwordless]] manner.<ref>{{Cite web |date=2018-04-10 |title=Practical passwordless authentication comes a step closer with WebAuthn |url=https://arstechnica.com/gadgets/2018/04/practical-passwordless-authentication-comes-a-step-closer-with-webauthn/ |access-date=2024-10-16 |website=[[Ars Technica]] |language=en-US}}</ref> Moreover, a roaming hardware authenticator resists malware, since the keys are stored on a separate device, which prevents the malware from accessing them directly. | Like legacy U2F, WebAuthn is resistant to [[phishing|phishing attacks]]<ref>{{cite web |last1=Kan |first1=Michael |title=Google: Phishing Attacks That Can Beat Two-Factor Are on the Rise |url=https://www.pcmag.com/news/367026/google-phishing-attacks-that-can-beat-two-factor-are-on-the |publisher=PC Magazine |access-date=8 March 2019 |date=7 March 2019 |archive-date=8 March 2019 |archive-url=https://web.archive.org/web/20190308035745/https://www.pcmag.com/news/367026/google-phishing-attacks-that-can-beat-two-factor-are-on-the |url-status=live }}</ref> as the authenticator only offers credentials that were registered on the [[same-origin policy|same website]]. However, unlike U2F, WebAuthn can be implemented in a [[passwordless authentication|passwordless]] manner.<ref>{{Cite web |date=2018-04-10 |title=Practical passwordless authentication comes a step closer with WebAuthn |url=https://arstechnica.com/gadgets/2018/04/practical-passwordless-authentication-comes-a-step-closer-with-webauthn/ |access-date=2024-10-16 |website=[[Ars Technica]] |language=en-US |archive-date=1 January 2025 |archive-url=https://web.archive.org/web/20250101102456/https://arstechnica.com/gadgets/2018/04/practical-passwordless-authentication-comes-a-step-closer-with-webauthn/ |url-status=live }}</ref> Moreover, a roaming hardware authenticator resists malware, since the keys are stored on a separate device, which prevents the malware from accessing them directly. | ||
The WebAuthn Level 1 and 2 standards were published as [[W3C recommendation|W3C Recommendations]] on 4 March 2019 and 8 April 2021 respectively.<ref name="W3C-WebAuthn-Level-1">{{cite web |editor1-last=Balfanz |editor1-first=Dirk |editor2-last=Czeskis |editor2-first=Alexei |editor3-last=Hodges |editor3-first=Jeff |editor4-last=Jones |editor4-first=J.C. |editor5-last=Jones |editor5-first=Michael B. |editor6-last=Kumar |editor6-first=Akshay |editor7-last=Liao |editor7-first=Angelo |editor8-last=Lindemann |editor8-first=Rolf |editor9-last=Lundberg |editor9-first=Emil |title=Web Authentication: An API for accessing Public Key Credentials Level 1 (latest) |url=https://www.w3.org/TR/webauthn-1/ |publisher=[[World Wide Web Consortium]] |access-date=4 March 2019}}</ref><ref name="W3C-WebAuthn-announce">{{cite web |title=W3C and FIDO Alliance Finalize Web Standard for Secure, Passwordless Logins |url=https://www.w3.org/2019/03/pressrelease-webauthn-rec.html.en |publisher=[[World Wide Web Consortium]] |access-date=4 March 2019 |date=4 March 2019}}</ref><ref name="W3C-WebAuthn-Level-2">{{cite web |editor1-last=Balfanz |editor1-first=Dirk |editor2-last=Czeskis |editor2-first=Alexei |editor3-last=Hodges |editor3-first=Jeff |editor4-last=Jones |editor4-first=J.C. |editor5-last=Jones |editor5-first=Michael B. |editor6-last=Kumar |editor6-first=Akshay |editor7-last=Lindemann |editor7-first=Rolf |editor8-last=Lundberg |editor8-first=Emil |title=Web Authentication: An API for accessing Public Key Credentials Level 2 |url=https://www.w3.org/TR/webauthn-2/ |access-date=27 November 2022 |publisher=[[World Wide Web Consortium]] |publication-date=8 April 2021 |edition=Latest}}</ref> A Level 3 specification is currently a ''First Public Working Draft'' (FPWD).<ref name="W3C-WebAuthn-Level-3">{{Cite web|editor1-last=Balfanz |editor1-first=Dirk |editor2-last=Czeskis |editor2-first=Alexei |editor3-last=Hodges |editor3-first=Jeff |editor4-last=Jones |editor4-first=J.C. |editor5-last=Jones |editor5-first=Michael B. |editor6-last=Kumar |editor6-first=Akshay |editor7-last=Lindemann |editor7-first=Rolf |editor8-last=Lundberg |editor8-first=Emil |title=Web Authentication: An API for accessing Public Key Credentials Level 3 |url=https://www.w3.org/TR/webauthn-3/ |publisher=[[World Wide Web Consortium]] |access-date=24 December 2021 |publication-date=4 April 2021|edition=First Public Working Draft}}</ref> | The WebAuthn Level 1 and 2 standards were published as [[W3C recommendation|W3C Recommendations]] on 4 March 2019 and 8 April 2021 respectively.<ref name="W3C-WebAuthn-Level-1">{{cite web |editor1-last=Balfanz |editor1-first=Dirk |editor2-last=Czeskis |editor2-first=Alexei |editor3-last=Hodges |editor3-first=Jeff |editor4-last=Jones |editor4-first=J.C. |editor5-last=Jones |editor5-first=Michael B. |editor6-last=Kumar |editor6-first=Akshay |editor7-last=Liao |editor7-first=Angelo |editor8-last=Lindemann |editor8-first=Rolf |editor9-last=Lundberg |editor9-first=Emil |title=Web Authentication: An API for accessing Public Key Credentials Level 1 (latest) |url=https://www.w3.org/TR/webauthn-1/ |publisher=[[World Wide Web Consortium]] |access-date=4 March 2019 |archive-date=14 March 2019 |archive-url=https://web.archive.org/web/20190314015005/https://www.w3.org/TR/webauthn-1/ |url-status=live }}</ref><ref name="W3C-WebAuthn-announce">{{cite web |title=W3C and FIDO Alliance Finalize Web Standard for Secure, Passwordless Logins |url=https://www.w3.org/2019/03/pressrelease-webauthn-rec.html.en |publisher=[[World Wide Web Consortium]] |access-date=4 March 2019 |date=4 March 2019 |archive-date=4 March 2019 |archive-url=https://web.archive.org/web/20190304132257/https://www.w3.org/2019/03/pressrelease-webauthn-rec.html.en |url-status=live }}</ref><ref name="W3C-WebAuthn-Level-2">{{cite web |editor1-last=Balfanz |editor1-first=Dirk |editor2-last=Czeskis |editor2-first=Alexei |editor3-last=Hodges |editor3-first=Jeff |editor4-last=Jones |editor4-first=J.C. |editor5-last=Jones |editor5-first=Michael B. |editor6-last=Kumar |editor6-first=Akshay |editor7-last=Lindemann |editor7-first=Rolf |editor8-last=Lundberg |editor8-first=Emil |title=Web Authentication: An API for accessing Public Key Credentials Level 2 |url=https://www.w3.org/TR/webauthn-2/ |access-date=27 November 2022 |publisher=[[World Wide Web Consortium]] |publication-date=8 April 2021 |edition=Latest |archive-date=4 June 2019 |archive-url=https://web.archive.org/web/20190604093843/https://www.w3.org/TR/webauthn-2/ |url-status=live }}</ref> A Level 3 specification is currently a ''First Public Working Draft'' (FPWD).<ref name="W3C-WebAuthn-Level-3">{{Cite web |editor1-last=Balfanz |editor1-first=Dirk |editor2-last=Czeskis |editor2-first=Alexei |editor3-last=Hodges |editor3-first=Jeff |editor4-last=Jones |editor4-first=J.C. |editor5-last=Jones |editor5-first=Michael B. |editor6-last=Kumar |editor6-first=Akshay |editor7-last=Lindemann |editor7-first=Rolf |editor8-last=Lundberg |editor8-first=Emil |title=Web Authentication: An API for accessing Public Key Credentials Level 3 |url=https://www.w3.org/TR/webauthn-3/ |publisher=[[World Wide Web Consortium]] |access-date=24 December 2021 |publication-date=4 April 2021 |edition=First Public Working Draft |archive-date=25 February 2022 |archive-url=https://web.archive.org/web/20220225104428/https://www.w3.org/TR/webauthn-3/ |url-status=live }}</ref> | ||
WebAuthn is a core component of the [[FIDO Alliance#FIDO2|FIDO2 Project]] under the guidance of the [[FIDO Alliance]].<ref name="fido2">{{cite web|url=https://fidoalliance.org/fido2/|title=FIDO2 Project|publisher=FIDO Alliance|access-date=2018-05-11}}</ref> | WebAuthn is a core component of the [[FIDO Alliance#FIDO2|FIDO2 Project]] under the guidance of the [[FIDO Alliance]].<ref name="fido2">{{cite web|url=https://fidoalliance.org/fido2/|title=FIDO2 Project|publisher=FIDO Alliance|access-date=2018-05-11|archive-date=22 April 2018|archive-url=https://web.archive.org/web/20180422033243/https://fidoalliance.org/fido2/|url-status=live}}</ref> | ||
== Background == | == Background == | ||
FIDO2 is the successor to FIDO Universal 2nd Factor (U2F). Whereas U2F only supports multi-factor mode, having been designed to strengthen existing username/password-based login flows, FIDO2 adds support for single-factor mode. In multi-factor mode, the authenticator is activated by a test of ''user presence'', which usually consists of a simple button push; no password is required. In single-factor mode, the authenticator (''something you have'') performs ''user verification''.<ref>{{cite web |title=User Presence vs User Verification |url=https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Guide/User_Presence_vs_User_Verification.html |access-date=19 February 2024}}</ref> Depending on the authenticator capabilities, this can be:<ref>{{Cite web|url=https://fidoalliance.org/specs/fido-v2.0-rd-20180702/fido-registry-v2.0-rd-20180702.html#user-verification-methods|title=FIDO Registry of Predefined Values|last1=Baghdasaryan|first1=Davit|last2=Hill|first2=Brad|date=2 July 2018|website=fidoalliance.org|publisher=FIDO Alliance|access-date=2019-06-16}}</ref> | FIDO2 is the successor to FIDO Universal 2nd Factor (U2F). Whereas U2F only supports multi-factor mode, having been designed to strengthen existing username/password-based login flows, FIDO2 adds support for single-factor mode. In multi-factor mode, the authenticator is activated by a test of ''user presence'', which usually consists of a simple button push; no password is required. In single-factor mode, the authenticator (''something you have'') performs ''user verification''.<ref>{{cite web |title=User Presence vs User Verification |url=https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Guide/User_Presence_vs_User_Verification.html |access-date=19 February 2024 |archive-date=19 February 2024 |archive-url=https://web.archive.org/web/20240219035634/https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Guide/User_Presence_vs_User_Verification.html |url-status=live }}</ref> Depending on the authenticator capabilities, this can be:<ref>{{Cite web|url=https://fidoalliance.org/specs/fido-v2.0-rd-20180702/fido-registry-v2.0-rd-20180702.html#user-verification-methods|title=FIDO Registry of Predefined Values|last1=Baghdasaryan|first1=Davit|last2=Hill|first2=Brad|date=2 July 2018|website=fidoalliance.org|publisher=FIDO Alliance|access-date=2019-06-16|archive-date=4 December 2020|archive-url=https://web.archive.org/web/20201204162752/https://fidoalliance.org/specs/fido-v2.0-rd-20180702/fido-registry-v2.0-rd-20180702.html#user-verification-methods|url-status=live}}</ref> | ||
* ''something you know:'' a secret such as a [[Personal identification number|PIN]], [[Password|passcode]] or swipe pattern | * ''something you know:'' a secret such as a [[Personal identification number|PIN]], [[Password|passcode]] or swipe pattern | ||
* ''something you are:'' a [[Biometrics|biometric]] such as fingerprint, iris or voice | * ''something you are:'' a [[Biometrics|biometric]] such as fingerprint, iris or voice | ||
Regardless of mode, the authenticator never shares its secrets or biometric data with the website.<ref>{{Cite web|url=https://www.w3.org/TR/webauthn/Overview.html#user-verification|title=Web Authentication: An API for accessing Public Key Credentials Level 1 § Terminology: User Verification|date=4 March 2019|website=www.w3.org|publisher=W3C|access-date=2019-06-16}}</ref> Moreover, a single user's secret or biometric works with all websites, as the authenticator selects the correct [[Public-key cryptography|cryptographic key material]] to use for the service requesting authentication after user verification was completed successfully. | Regardless of mode, the authenticator never shares its secrets or biometric data with the website.<ref>{{Cite web|url=https://www.w3.org/TR/webauthn/Overview.html#user-verification|title=Web Authentication: An API for accessing Public Key Credentials Level 1 § Terminology: User Verification|date=4 March 2019|website=www.w3.org|publisher=W3C|access-date=2019-06-16|archive-date=7 June 2017|archive-url=https://web.archive.org/web/20170607122711/https://www.w3.org/TR/webauthn/Overview.html#user-verification|url-status=live}}</ref> Moreover, a single user's secret or biometric works with all websites, as the authenticator selects the correct [[Public-key cryptography|cryptographic key material]] to use for the service requesting authentication after user verification was completed successfully. | ||
A secret and biometric on the authenticator can be used together, similarly to how they would be used on a [[smartphone]]. For example, a fingerprint provides convenient access to user's smartphone, but occasionally fingerprint access fails, in which case user can use a PIN. | A secret and biometric on the authenticator can be used together, similarly to how they would be used on a [[smartphone]]. For example, a fingerprint provides convenient access to user's smartphone, but occasionally fingerprint access fails, in which case user can use a PIN. | ||
| Line 90: | Line 90: | ||
''Passkey'' is the [[de facto]] [[technical language|non-technical]] term for a WebAuthn credential.<ref name="docsrs-webauthnrs" /><ref name="imperialviolet-webauthn" /> It is widely used in situations where jargon is unhelpful, such as consumer marketing, and most user interfaces that support WebAuthn use only ''passkey'' to refer to WebAuthn credentials.<ref name="arstechnica-not-usable" /> | ''Passkey'' is the [[de facto]] [[technical language|non-technical]] term for a WebAuthn credential.<ref name="docsrs-webauthnrs" /><ref name="imperialviolet-webauthn" /> It is widely used in situations where jargon is unhelpful, such as consumer marketing, and most user interfaces that support WebAuthn use only ''passkey'' to refer to WebAuthn credentials.<ref name="arstechnica-not-usable" /> | ||
When Apple first introduced passkeys to the public in 2022,<ref>{{cite news |last1=Clemons |first1=Taylor |title=WWDC 2022: Apple announces Passkey feature to eliminate passwords across platforms |url=https://www.zdnet.com/article/wwdc-2022-apple-announces-passkey-feature/ |access-date=4 July 2025 |publisher=ZD Net |date=6 June 2022}}</ref> they emphasized their first-party platform integrations. This, combined with the lack of clear communication from other industry leaders, led some to speculate that passkeys were proprietary to Apple (this was not the case).<ref>{{cite news |last1=Shakir |first1=Umar |title=Reminder: passkeys are not just from Apple |url=https://www.theverge.com/2022/8/5/23293643/apple-passkeys-fido-alliance-passwordless-google-microsoft |access-date=4 July 2025 |publisher=The Verge |date=6 August 2022}}</ref> As browsers and websites began to implement WebAuthn, the inconsistent feature-sets resulted in a variety of understandings of what exactly counted as a passkey. Some people assumed that a passkey required management by a platform authenticator, or needed synchronization using the cloud. A better definition is that a passkey is any WebAuthn credential managed by any WebAuthn authenticator.<ref name="docsrs-webauthnrs" /> This definition covers most of what different vendors refer to and accept as ''passkeys''. | When Apple first introduced passkeys to the public in 2022,<ref>{{cite news |last1=Clemons |first1=Taylor |title=WWDC 2022: Apple announces Passkey feature to eliminate passwords across platforms |url=https://www.zdnet.com/article/wwdc-2022-apple-announces-passkey-feature/ |access-date=4 July 2025 |publisher=ZD Net |date=6 June 2022 |archive-date=6 June 2023 |archive-url=https://web.archive.org/web/20230606212207/https://www.zdnet.com/article/wwdc-2022-apple-announces-passkey-feature/ |url-status=live }}</ref> they emphasized their first-party platform integrations. This, combined with the lack of clear communication from other industry leaders, led some to speculate that passkeys were proprietary to Apple (this was not the case).<ref>{{cite news |last1=Shakir |first1=Umar |title=Reminder: passkeys are not just from Apple |url=https://www.theverge.com/2022/8/5/23293643/apple-passkeys-fido-alliance-passwordless-google-microsoft |access-date=4 July 2025 |publisher=The Verge |date=6 August 2022 |archive-date=24 September 2023 |archive-url=https://web.archive.org/web/20230924231545/https://www.theverge.com/2022/8/5/23293643/apple-passkeys-fido-alliance-passwordless-google-microsoft |url-status=live }}</ref> As browsers and websites began to implement WebAuthn, the inconsistent feature-sets resulted in a variety of understandings of what exactly counted as a passkey. Some people assumed that a passkey required management by a platform authenticator, or needed synchronization using the cloud. A better definition is that a passkey is any WebAuthn credential managed by any WebAuthn authenticator.<ref name="docsrs-webauthnrs" /> This definition covers most of what different vendors refer to and accept as ''passkeys''. | ||
== Overview == | == Overview == | ||
| Line 109: | Line 109: | ||
For the purposes of illustration, we assume the authenticator is a roaming hardware authenticator (see below for other options). In any case, the authenticator is a multi-factor [[Cryptography|cryptographic]] authenticator that uses [[Cryptography#Public-key cryptography|public-key cryptography]] to sign an authentication assertion targeted at the WebAuthn Relying Party. Assuming the authenticator uses a [[Personal identification number|PIN]] for user verification, the authenticator itself is ''something you have'' while the PIN is ''something you know''. | For the purposes of illustration, we assume the authenticator is a roaming hardware authenticator (see below for other options). In any case, the authenticator is a multi-factor [[Cryptography|cryptographic]] authenticator that uses [[Cryptography#Public-key cryptography|public-key cryptography]] to sign an authentication assertion targeted at the WebAuthn Relying Party. Assuming the authenticator uses a [[Personal identification number|PIN]] for user verification, the authenticator itself is ''something you have'' while the PIN is ''something you know''. | ||
To initiate the WebAuthn authentication flow,<ref>{{cite web |url=https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API |title=Web Authentication API | To initiate the WebAuthn authentication flow,<ref>{{cite web |url=https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API |title=Web Authentication API |at=Section [https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API#Authentication Authentication] |publisher=[[Mozilla]] |access-date=18 March 2019 |archive-date=28 November 2020 |archive-url=https://web.archive.org/web/20201128172824/https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API |url-status=live }}</ref> the WebAuthn Relying Party indicates its intentions to the WebAuthn Client (i.e., the browser) via [[JavaScript]]. The WebAuthn Client communicates with the authenticator using a JavaScript [[API]] implemented in the browser. A roaming authenticator conforms to the FIDO [[Client to Authenticator Protocol]] (CTAP).<ref name="FIDO-CTAP">{{cite web |editor1-last=Brand |editor1-first=Christiaan |editor2-last=Czeskis |editor2-first=Alexei |editor3-last=Ehrensvärd |editor3-first=Jakob |editor4-last=Jones |editor4-first=Michael B. |editor5-last=Kumar |editor5-first=Akshay |editor6-last=Lindemann |editor6-first=Rolf |editor7-last=Powers |editor7-first=Adam |editor8-last=Verrept |editor8-first=Johan |title=Client to Authenticator Protocol (CTAP) |url=https://fidoalliance.org/specs/fido-v2.0-ps-20190130-pub/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html |publisher=FIDO Alliance |access-date=7 March 2019 |date=30 January 2019 |archive-date=8 March 2019 |archive-url=https://web.archive.org/web/20190308081859/https://fidoalliance.org/specs/fido-v2.0-ps-20190130-pub/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html |url-status=dead }}</ref> | ||
WebAuthn does not strictly require a roaming hardware authenticator. Alternatively, a software authenticator (e.g., implemented on a smartphone) or a platform authenticator (i.e., an authenticator implemented directly on the WebAuthn Client Device) may be used. Relevant examples of platform authenticators include [[Windows Hello]]<ref>{{cite web |last1=Simons |first1=Alex |title=Secure password-less sign-in for your Microsoft account using a security key or Windows Hello |url=https://www.microsoft.com/en-us/microsoft-365/blog/2018/11/20/sign-in-to-your-microsoft-account-without-a-password-using-windows-hello-or-a-security-key/ |publisher=[[Microsoft]] |access-date=6 March 2019 |date=20 November 2018}}</ref> and the [[Android (operating system)|Android operating system]].<ref>{{cite web |title=Android Now FIDO2 Certified, Accelerating Global Migration Beyond Passwords |url=https://fidoalliance.org/android-now-fido2-certified-accelerating-global-migration-beyond-passwords/ |publisher=[[FIDO Alliance]] |access-date=6 March 2019 |location=BARCELONA |date=25 February 2019}}</ref> | WebAuthn does not strictly require a roaming hardware authenticator. Alternatively, a software authenticator (e.g., implemented on a smartphone) or a platform authenticator (i.e., an authenticator implemented directly on the WebAuthn Client Device) may be used. Relevant examples of platform authenticators include [[Windows Hello]]<ref>{{cite web |last1=Simons |first1=Alex |title=Secure password-less sign-in for your Microsoft account using a security key or Windows Hello |url=https://www.microsoft.com/en-us/microsoft-365/blog/2018/11/20/sign-in-to-your-microsoft-account-without-a-password-using-windows-hello-or-a-security-key/ |publisher=[[Microsoft]] |access-date=6 March 2019 |date=20 November 2018}}</ref> and the [[Android (operating system)|Android operating system]].<ref>{{cite web |title=Android Now FIDO2 Certified, Accelerating Global Migration Beyond Passwords |url=https://fidoalliance.org/android-now-fido2-certified-accelerating-global-migration-beyond-passwords/ |publisher=[[FIDO Alliance]] |access-date=6 March 2019 |location=BARCELONA |date=25 February 2019 |archive-date=7 March 2019 |archive-url=https://web.archive.org/web/20190307054402/https://fidoalliance.org/android-now-fido2-certified-accelerating-global-migration-beyond-passwords/ |url-status=live }}</ref> | ||
The illustrated flow relies on PIN-based user verification, which, in terms of usability, is only a modest improvement over ordinary password authentication. In practice, the use of [[biometric]]s for user verification can improve the usability of WebAuthn.{{Citation needed|date=March 2019}} The logistics behind biometrics are still poorly understood, however. There is a lingering misunderstanding among users that biometric data is transmitted over the network in the same manner as passwords, which is not the case.<ref>{{cite web |title=Touch ID and Beyond: Duo's Plans for WebAuthn |url=https://duo.com/blog/touchid-webauthn |publisher=Duo Security |access-date=8 March 2019 |date=5 March 2019}}</ref><ref>{{cite web |last1=Steele |first1=Nick |title=How WebAuthn aims to solve the password problem |url=https://www.helpnetsecurity.com/2019/02/27/webauthn-solve-password-problem/ |publisher=Help Net Security |access-date=8 March 2019 |date=27 February 2019}}</ref> | The illustrated flow relies on PIN-based user verification, which, in terms of usability, is only a modest improvement over ordinary password authentication. In practice, the use of [[biometric]]s for user verification can improve the usability of WebAuthn.{{Citation needed|date=March 2019}} The logistics behind biometrics are still poorly understood, however. There is a lingering misunderstanding among users that biometric data is transmitted over the network in the same manner as passwords, which is not the case.<ref>{{cite web |title=Touch ID and Beyond: Duo's Plans for WebAuthn |url=https://duo.com/blog/touchid-webauthn |publisher=Duo Security |access-date=8 March 2019 |date=5 March 2019 |archive-date=21 March 2020 |archive-url=https://web.archive.org/web/20200321174132/https://duo.com/blog/touchid-webauthn |url-status=live }}</ref><ref>{{cite web |last1=Steele |first1=Nick |title=How WebAuthn aims to solve the password problem |url=https://www.helpnetsecurity.com/2019/02/27/webauthn-solve-password-problem/ |publisher=Help Net Security |access-date=8 March 2019 |date=27 February 2019 |archive-date=28 September 2020 |archive-url=https://web.archive.org/web/20200928210027/https://www.helpnetsecurity.com/2019/02/27/webauthn-solve-password-problem/ |url-status=live }}</ref> | ||
===Registration=== | ===Registration=== | ||
| Line 119: | Line 119: | ||
When the WebAuthn Relying Party receives the signed authentication assertion from the browser, the digital signature on the assertion is verified using a trusted public key for the user. | When the WebAuthn Relying Party receives the signed authentication assertion from the browser, the digital signature on the assertion is verified using a trusted public key for the user. | ||
To obtain a public key for the user, the WebAuthn Relying Party initiates a WebAuthn registration flow<ref>{{cite web |url=https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API |title=Web Authentication API | To obtain a public key for the user, the WebAuthn Relying Party initiates a WebAuthn registration flow<ref>{{cite web |url=https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API |title=Web Authentication API |at=Section [https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API#Registration Registration] |publisher=[[Mozilla]] |access-date=18 March 2019 |archive-date=28 November 2020 |archive-url=https://web.archive.org/web/20201128172824/https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API |url-status=live }}</ref> that is similar to the authentication flow illustrated above. The primary difference is that the authenticator now signs an attestation statement with its attestation private key. The signed attestation statement contains a copy of the public key that the WebAuthn Relying Party ultimately uses to verify a signed authentication assertion. The attestation statement also contains metadata describing the authenticator itself.{{Citation needed|date=March 2019}} | ||
The digital signature on the attestation statement is verified with the trusted attestation public key for that particular model of authenticator. How the WebAuthn Relying Party obtains its store of trusted attestation public keys is unspecified. One option is to use the FIDO metadata service.<ref>{{cite web |title=Metadata Service |url=https://fidoalliance.org/metadata/ |publisher=[[FIDO Alliance]] |access-date=18 March 2019}}</ref> | The digital signature on the attestation statement is verified with the trusted attestation public key for that particular model of authenticator. How the WebAuthn Relying Party obtains its store of trusted attestation public keys is unspecified. One option is to use the FIDO metadata service.<ref>{{cite web |title=Metadata Service |url=https://fidoalliance.org/metadata/ |publisher=[[FIDO Alliance]] |access-date=18 March 2019}}</ref> | ||
| Line 129: | Line 129: | ||
[[File:Bitwarden Desktop 2025.7.0 with passkey support screenshot.webp|thumb|upright=1.2|Example of WebAuthn passkey as a part of password manager [[Bitwarden]]]] | [[File:Bitwarden Desktop 2025.7.0 with passkey support screenshot.webp|thumb|upright=1.2|Example of WebAuthn passkey as a part of password manager [[Bitwarden]]]] | ||
The WebAuthn Level 1 standard was published as a W3C Recommendation by the [[Web Authentication Working Group]] on 4 March 2019.<ref name="W3C-WebAuthn-Level-1" /><ref name="W3C-WebAuthn-announce" /><ref>{{Cite web |url=https://venturebeat.com/2019/03/04/w3c-approves-webauthn-as-the-web-standard-for-password-free-logins/ |title=W3C Approves WebAuthn as the Web Standard for Password-Free Logins |last=Protalinski |first=Emil |date=4 March 2019}}</ref> WebAuthn is supported by [[Google Chrome]], [[Mozilla Firefox]], [[Microsoft Edge]], [[Safari (web browser)|Apple Safari]]<ref name="W3C-WebAuthn-announce" /> and [[Opera (web browser)|Opera]].<ref>{{cite web |title=Can I use Web Authentication API? |url=https://caniuse.com/#feat=webauthn |access-date=7 March 2019}}</ref> | The WebAuthn Level 1 standard was published as a W3C Recommendation by the [[Web Authentication Working Group]] on 4 March 2019.<ref name="W3C-WebAuthn-Level-1" /><ref name="W3C-WebAuthn-announce" /><ref>{{Cite web |url=https://venturebeat.com/2019/03/04/w3c-approves-webauthn-as-the-web-standard-for-password-free-logins/ |title=W3C Approves WebAuthn as the Web Standard for Password-Free Logins |last=Protalinski |first=Emil |date=4 March 2019 |access-date=4 March 2019 |archive-date=4 March 2019 |archive-url=https://web.archive.org/web/20190304160032/https://venturebeat.com/2019/03/04/w3c-approves-webauthn-as-the-web-standard-for-password-free-logins/ |url-status=live }}</ref> WebAuthn is supported by [[Google Chrome]], [[Mozilla Firefox]], [[Microsoft Edge]], [[Safari (web browser)|Apple Safari]]<ref name="W3C-WebAuthn-announce" /> and [[Opera (web browser)|Opera]].<ref>{{cite web |title=Can I use Web Authentication API? |url=https://caniuse.com/#feat=webauthn |access-date=7 March 2019 |archive-date=19 February 2018 |archive-url=https://web.archive.org/web/20180219074228/https://caniuse.com/#feat=webauthn |url-status=live }}</ref> | ||
The desktop version of Google Chrome has supported WebAuthn since version 67.<ref name="chrome-support">{{cite web |url=https://developers.google.com/web/updates/2018/05/webauthn |title=Enabling Strong Authentication with WebAuthn |first=Christiaan |last=Brand |website=Google Developers |date=2018-06-03 |access-date=2018-06-25}}</ref> Firefox, which had not fully supported the previous FIDO U2F standard, included and enabled WebAuthn in Firefox version 60, released on 9 May 2018.<ref>{{cite web |url=https://www.cnet.com/news/firefox-moves-browsers-into-the-post-password-future-with-webauthn/ |title=Firefox moves browsers into post-password future with WebAuthn tech |first=Stephen |last=Shankland |website=CNET |date=2018-05-09 |access-date=2018-05-11}}</ref> An early [[Windows Insider]] release of Microsoft Edge (Build 17682) implemented a version of WebAuthn that works with both [[Windows Hello]] as well as external security keys.<ref>{{cite web |url=https://blogs.windows.com/windowsexperience/2018/05/31/announcing-windows-10-insider-preview-build-17682/#oHYCS0GkF95OMzKH.97 |title=Announcing Windows 10 Insider Preview Build 17682 |author=Sarkar |display-authors=etal |publisher=Microsoft |date=2018-05-23 |access-date=2018-06-25}}</ref> | The desktop version of Google Chrome has supported WebAuthn since version 67.<ref name="chrome-support">{{cite web |url=https://developers.google.com/web/updates/2018/05/webauthn |title=Enabling Strong Authentication with WebAuthn |first=Christiaan |last=Brand |website=Google Developers |date=2018-06-03 |access-date=2018-06-25 |archive-date=4 September 2018 |archive-url=https://web.archive.org/web/20180904204546/https://developers.google.com/web/updates/2018/05/webauthn |url-status=live }}</ref> Firefox, which had not fully supported the previous FIDO U2F standard, included and enabled WebAuthn in Firefox version 60, released on 9 May 2018.<ref>{{cite web |url=https://www.cnet.com/news/firefox-moves-browsers-into-the-post-password-future-with-webauthn/ |title=Firefox moves browsers into post-password future with WebAuthn tech |first=Stephen |last=Shankland |website=CNET |date=2018-05-09 |access-date=2018-05-11 |archive-date=12 May 2018 |archive-url=https://web.archive.org/web/20180512112654/https://www.cnet.com/news/firefox-moves-browsers-into-the-post-password-future-with-webauthn/ |url-status=live }}</ref> An early [[Windows Insider]] release of Microsoft Edge (Build 17682) implemented a version of WebAuthn that works with both [[Windows Hello]] as well as external security keys.<ref>{{cite web |url=https://blogs.windows.com/windowsexperience/2018/05/31/announcing-windows-10-insider-preview-build-17682/#oHYCS0GkF95OMzKH.97 |title=Announcing Windows 10 Insider Preview Build 17682 |author=Sarkar |display-authors=etal |publisher=Microsoft |date=2018-05-23 |access-date=2018-06-25 |archive-date=7 April 2019 |archive-url=https://web.archive.org/web/20190407194514/https://blogs.windows.com/windowsexperience/2018/05/31/announcing-windows-10-insider-preview-build-17682/#oHYCS0GkF95OMzKH.97 |url-status=live }}</ref> | ||
Existing FIDO U2F security keys are largely compatible with the WebAuthn standard, though WebAuthn added the ability to reference a unique per-account "user handle" identifier, which older authenticators are unable to store.<ref name="W3C-WebAuthn-Level-1" /> | Existing FIDO U2F security keys are largely compatible with the WebAuthn standard, though WebAuthn added the ability to reference a unique per-account "user handle" identifier, which older authenticators are unable to store.<ref name="W3C-WebAuthn-Level-1" /> | ||
One of the first FIDO2-compatible [[authenticator]]s was the second-generation [[YubiKey|Security Key]] by Yubico, announced on 10 April 2018.<ref>{{cite press release |url=https://www.yubico.com/press-releases/280530/ |title=Yubico Launches New Developer Program and Security Key for FIDO2 and WebAuthn W3C Specifications |date=2018-04-10 |access-date=2018-05-11}}</ref> The first FIDO2-compatible authenticators with a display was Trezor Model T by SatoshiLabs, announced on 6 November 2019.<ref>{{cite web |url=https://medium.com/trezor-security-blog/make-passwords-a-thing-of-the-past-a402745750dc |title=Make Passwords a Thing of the Past, FIDO2 Is Now Available on Trezor Model T |date=2019-11-06 |access-date=2019-11-06}}</ref> Trezor Model T was also the first authenticator that allowed users to select which FIDO2 resident credential should be used directly on a device. | One of the first FIDO2-compatible [[authenticator]]s was the second-generation [[YubiKey|Security Key]] by Yubico, announced on 10 April 2018.<ref>{{cite press release |url=https://www.yubico.com/press-releases/280530/ |title=Yubico Launches New Developer Program and Security Key for FIDO2 and WebAuthn W3C Specifications |date=2018-04-10 |access-date=2018-05-11 |archive-date=7 May 2018 |archive-url=https://web.archive.org/web/20180507085439/https://www.yubico.com/press-releases/280530/ |url-status=live }}</ref> The first FIDO2-compatible authenticators with a display was Trezor Model T by SatoshiLabs, announced on 6 November 2019.<ref>{{cite web |url=https://medium.com/trezor-security-blog/make-passwords-a-thing-of-the-past-a402745750dc |title=Make Passwords a Thing of the Past, FIDO2 Is Now Available on Trezor Model T |date=2019-11-06 |access-date=2019-11-06}}</ref> Trezor Model T was also the first authenticator that allowed users to select which FIDO2 resident credential should be used directly on a device. | ||
The first Security Level 2 certified FIDO2 key, called "Goldengate" was announced one year later by eWBM on 8 April 2019.<ref>{{cite press release |url=https://www.ewbm.com/press/pr2/ |title=eWBM: eWBM's Goldengate Fingerprint Reader is First to Get FIDO L2 Certification |date=2019-04-08 |access-date=2019-06-15 |archive-date=1 January 2020 |archive-url=https://web.archive.org/web/20200101151355/https://www.ewbm.com/press/pr2/ |url-status=dead }}</ref><ref>{{cite press release |url=https://mobileidworld.com/ewbm-goldengate-fingerprint-reader-fido-l2-certification-804084/ |title=Mobile ID World, Alex Perala: eWBM's Goldengate Fingerprint Reader is First to Get FIDO L2 Certification |date=2019-04-09 |access-date=2019-06-15}}</ref> | The first Security Level 2 certified FIDO2 key, called "Goldengate" was announced one year later by eWBM on 8 April 2019.<ref>{{cite press release |url=https://www.ewbm.com/press/pr2/ |title=eWBM: eWBM's Goldengate Fingerprint Reader is First to Get FIDO L2 Certification |date=2019-04-08 |access-date=2019-06-15 |archive-date=1 January 2020 |archive-url=https://web.archive.org/web/20200101151355/https://www.ewbm.com/press/pr2/ |url-status=dead }}</ref><ref>{{cite press release |url=https://mobileidworld.com/ewbm-goldengate-fingerprint-reader-fido-l2-certification-804084/ |title=Mobile ID World, Alex Perala: eWBM's Goldengate Fingerprint Reader is First to Get FIDO L2 Certification |date=2019-04-09 |access-date=2019-06-15 |archive-date=12 August 2020 |archive-url=https://web.archive.org/web/20200812130916/https://mobileidworld.com/ewbm-goldengate-fingerprint-reader-fido-l2-certification-804084/ |url-status=live }}</ref> | ||
[[Dropbox]] announced support for WebAuthn logins (as a 2nd factor) on 8 May 2018.<ref>{{cite web |url=https://blogs.dropbox.com/tech/2018/05/introducing-webauthn-support-for-secure-dropbox-sign-in/ |title=Introducing WebAuthn support for secure Dropbox sign in |first=Brad |last=Girardeau |publisher=Dropbox |work=Dropbox Tech Blog |date=2018-05-08 |access-date=2018-05-11}}</ref> | [[Dropbox]] announced support for WebAuthn logins (as a 2nd factor) on 8 May 2018.<ref>{{cite web |url=https://blogs.dropbox.com/tech/2018/05/introducing-webauthn-support-for-secure-dropbox-sign-in/ |title=Introducing WebAuthn support for secure Dropbox sign in |first=Brad |last=Girardeau |publisher=Dropbox |work=Dropbox Tech Blog |date=2018-05-08 |access-date=2018-05-11 |archive-date=12 May 2018 |archive-url=https://web.archive.org/web/20180512112811/https://blogs.dropbox.com/tech/2018/05/introducing-webauthn-support-for-secure-dropbox-sign-in/ |url-status=live }}</ref> | ||
[[Apple Inc.|Apple]] announced that [[Face ID]] or [[Touch ID]] could be used as a WebAuthn platform authenticator with [[Safari (web browser)|Safari]] on 24 June 2020.<ref>{{Cite web |date=2022-12-16 |title=Safari 14 Release Notes |url=https://developer.apple.com/documentation/safari-release-notes/safari-14-release-notes |access-date=2022-12-16 |website=Apple Developer Documentation}}</ref> | [[Apple Inc.|Apple]] announced that [[Face ID]] or [[Touch ID]] could be used as a WebAuthn platform authenticator with [[Safari (web browser)|Safari]] on 24 June 2020.<ref>{{Cite web |date=2022-12-16 |title=Safari 14 Release Notes |url=https://developer.apple.com/documentation/safari-release-notes/safari-14-release-notes |access-date=2022-12-16 |website=Apple Developer Documentation |archive-date=14 May 2021 |archive-url=https://web.archive.org/web/20210514183054/https://developer.apple.com/documentation/safari-release-notes/safari-14-release-notes |url-status=live }}</ref> | ||
Several [[Password manager|password managers]] such as [[Bitwarden]] and [[Dashlane]] supported WebAuthn.<ref>{{Cite web |last=Porter |first=Jon |date=2023-11-02 |title=Bitwarden begins adding passkey support to its password manager |url=https://www.theverge.com/2023/11/2/23943173/bitwarden-passkey-support-released-browser-extension |access-date=2025-08-12 |website=[[The Verge]] |language=en-US}}</ref><ref>{{Cite web |last=Pegoraro |first=Rob |date=2024-07-30 |title=These Are the Services Seeing the Biggest Uptick in Passkey Adoption |url=https://uk.pcmag.com/password-managers/153627/these-are-the-services-seeing-the-biggest-uptick-in-passkey-adoption |access-date=2025-08-12 |website=[[PC Magazine]] UK |language=en-gb}}</ref> | Several [[Password manager|password managers]] such as [[Bitwarden]] and [[Dashlane]] supported WebAuthn.<ref>{{Cite web |last=Porter |first=Jon |date=2023-11-02 |title=Bitwarden begins adding passkey support to its password manager |url=https://www.theverge.com/2023/11/2/23943173/bitwarden-passkey-support-released-browser-extension |access-date=2025-08-12 |website=[[The Verge]] |language=en-US |archive-date=17 July 2025 |archive-url=https://web.archive.org/web/20250717030741/https://www.theverge.com/2023/11/2/23943173/bitwarden-passkey-support-released-browser-extension |url-status=live }}</ref><ref>{{Cite web |last=Pegoraro |first=Rob |date=2024-07-30 |title=These Are the Services Seeing the Biggest Uptick in Passkey Adoption |url=https://uk.pcmag.com/password-managers/153627/these-are-the-services-seeing-the-biggest-uptick-in-passkey-adoption |access-date=2025-08-12 |website=[[PC Magazine]] UK |language=en-gb |archive-date=8 November 2024 |archive-url=https://web.archive.org/web/20241108214849/https://uk.pcmag.com/password-managers/153627/these-are-the-services-seeing-the-biggest-uptick-in-passkey-adoption |url-status=live }}</ref> | ||
== API == | == API == | ||
WebAuthn implements an extension of the W3C's more general [[Credential Management]] [[application programming interface|API]], which is an attempt to formalize the interaction between [[website]]s and [[web browser]]s when exchanging user credentials. The Web Authentication API<ref>{{cite web |title=Web Authentication API |url=https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API |publisher=[[Mozilla]] |access-date=16 March 2019}}</ref><ref>{{cite web |last1=Ackermann |first1=Yuriy |title=Introduction to WebAuthn API |url=https://medium.com/@herrjemand/introduction-to-webauthn-api-5fd1fb46c285 |publisher=Medium |access-date=8 March 2019 |date=15 January 2019}}</ref> extends the Credential Management <code>navigator.credentials.create()</code> and <code>navigator.credentials.get()</code> [[JavaScript]] methods so they accept a <code>publicKey</code> parameter. The <code>create()</code> method is used for registering public key [[authenticator]]s as part of associating them with user accounts (possibly at initial account creation time but more likely when adding a new security device to an existing account) while the <code>get()</code> method is used for authenticating (such as when logging in). | WebAuthn implements an extension of the W3C's more general [[Credential Management]] [[application programming interface|API]], which is an attempt to formalize the interaction between [[website]]s and [[web browser]]s when exchanging user credentials. The Web Authentication API<ref>{{cite web |title=Web Authentication API |url=https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API |publisher=[[Mozilla]] |access-date=16 March 2019 |archive-date=28 November 2020 |archive-url=https://web.archive.org/web/20201128172824/https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API |url-status=live }}</ref><ref>{{cite web |last1=Ackermann |first1=Yuriy |title=Introduction to WebAuthn API |url=https://medium.com/@herrjemand/introduction-to-webauthn-api-5fd1fb46c285 |publisher=Medium |access-date=8 March 2019 |date=15 January 2019 |archive-date=29 March 2019 |archive-url=https://web.archive.org/web/20190329183504/https://medium.com/@herrjemand/introduction-to-webauthn-api-5fd1fb46c285 |url-status=live }}</ref> extends the Credential Management <code>navigator.credentials.create()</code> and <code>navigator.credentials.get()</code> [[JavaScript]] methods so they accept a <code>publicKey</code> parameter. The <code>create()</code> method is used for registering public key [[authenticator]]s as part of associating them with user accounts (possibly at initial account creation time but more likely when adding a new security device to an existing account) while the <code>get()</code> method is used for authenticating (such as when logging in). | ||
To check if a browser supports WebAuthn, scripts should check if the <code>window.PublicKeyCredential</code> interface is defined. In addition to <code>PublicKeyCredential</code>, the standard also defines the <code>AuthenticatorResponse</code>, <code>AuthenticatorAttestationResponse</code>, and <code>AuthenticatorAssertionResponse</code> interfaces in addition to a variety of dictionaries and other datatypes. | To check if a browser supports WebAuthn, scripts should check if the <code>window.PublicKeyCredential</code> interface is defined. In addition to <code>PublicKeyCredential</code>, the standard also defines the <code>AuthenticatorResponse</code>, <code>AuthenticatorAttestationResponse</code>, and <code>AuthenticatorAssertionResponse</code> interfaces in addition to a variety of dictionaries and other datatypes. | ||
| Line 154: | Line 154: | ||
== Reception == | == Reception == | ||
In August 2018, Paragon Initiative Enterprises conducted a security audit of the WebAuthn standard. While they could not find any specific [[Exploit (computer security)|exploits]], they revealed some serious weaknesses in the way the underlying cryptography is used and mandated by the standard.<ref name="paragon-blog">{{cite web|url=https://paragonie.com/blog/2018/08/security-concerns-surrounding-webauthn-don-t-implement-ecdaa-yet|title=Security Concerns Surrounding WebAuthn: Don't Implement ECDAA (Yet)|publisher=Paragon Initiative Enterprises Blog|date=2018-08-23|access-date=2018-10-09}}</ref> | In August 2018, Paragon Initiative Enterprises conducted a security audit of the WebAuthn standard. While they could not find any specific [[Exploit (computer security)|exploits]], they revealed some serious weaknesses in the way the underlying cryptography is used and mandated by the standard.<ref name="paragon-blog">{{cite web|url=https://paragonie.com/blog/2018/08/security-concerns-surrounding-webauthn-don-t-implement-ecdaa-yet|title=Security Concerns Surrounding WebAuthn: Don't Implement ECDAA (Yet)|publisher=Paragon Initiative Enterprises Blog|date=2018-08-23|access-date=2018-10-09|archive-date=10 October 2018|archive-url=https://web.archive.org/web/20181010011257/https://paragonie.com/blog/2018/08/security-concerns-surrounding-webauthn-don-t-implement-ecdaa-yet|url-status=live}}</ref> | ||
Main points of criticism revolve around two potential issues that were problematic in other cryptographic systems in the past, and therefore should be avoided in order to not fall victim to the same class of attacks: | Main points of criticism revolve around two potential issues that were problematic in other cryptographic systems in the past, and therefore should be avoided in order to not fall victim to the same class of attacks: | ||
| Line 170: | Line 170: | ||
WebAuthn, popularly referred to as "passkeys", has received mixed responses from the public: | WebAuthn, popularly referred to as "passkeys", has received mixed responses from the public: | ||
* "Passkeys are one of the few security constructs that make your life easier, rather than harder."<ref name="troyhunt">{{Cite web |last=Hunt |first=Troy |date=2025-05-05 |title=Passkeys for Normal People |url=https://www.troyhunt.com/passkeys-for-normal-people/ |access-date=2025-08-13 |website=Troy Hunt |language=en}}</ref>{{dash}}Troy Hunt – May 5, 2025 | * "Passkeys are one of the few security constructs that make your life easier, rather than harder."<ref name="troyhunt">{{Cite web |last=Hunt |first=Troy |date=2025-05-05 |title=Passkeys for Normal People |url=https://www.troyhunt.com/passkeys-for-normal-people/ |access-date=2025-08-13 |website=Troy Hunt |language=en |archive-date=13 May 2025 |archive-url=https://web.archive.org/web/20250513190543/https://www.troyhunt.com/passkeys-for-normal-people/ |url-status=live }}</ref>{{dash}}Troy Hunt – May 5, 2025 | ||
<blockquote>That's a one-click sign-in, and clicking the purple button immediately grants me access to my account.<ref name="troyhunt"></ref></blockquote> | <blockquote>That's a one-click sign-in, and clicking the purple button immediately grants me access to my account.<ref name="troyhunt"></ref></blockquote> | ||
| Line 176: | Line 176: | ||
*"Passkey technology is elegant, but it’s most definitely not usable security"<ref name="arstechnica-not-usable" />{{dash}}Dan Goodin – December 30, 2024 [[Ars Technica]] | *"Passkey technology is elegant, but it’s most definitely not usable security"<ref name="arstechnica-not-usable" />{{dash}}Dan Goodin – December 30, 2024 [[Ars Technica]] | ||
*"...the implementation seems to have failed the "make it easy for users" test, which in my view is the whole point of passkeys. I have been using [[public key cryptography]] for 30-plus years...If I find passkeys confusing to use, it doesn’t bode well for more typical users."<ref>{{Cite news |last=Davie |first=Bruce |date=2024-11-17 |title=Will passkeys ever replace passwords? Can they? |url=https://www.theregister.com/2024/11/17/passkeys_passwords/ |archive-url= | *"...the implementation seems to have failed the "make it easy for users" test, which in my view is the whole point of passkeys. I have been using [[public key cryptography]] for 30-plus years...If I find passkeys confusing to use, it doesn’t bode well for more typical users."<ref>{{Cite news |last=Davie |first=Bruce |date=2024-11-17 |title=Will passkeys ever replace passwords? Can they? |url=https://www.theregister.com/2024/11/17/passkeys_passwords/ |archive-url=https://web.archive.org/web/20250725180037/https://www.theregister.com/2024/11/17/passkeys_passwords/ |archive-date=25 July 2025 |access-date=2025-08-13 |work=[[The Register]] |language=en |url-status=live }}</ref>{{dash}}Bruce Davie – November 17, 2024 [[The Register]] | ||
== See also == | == See also == | ||