WebAuthn: Difference between revisions
fix |
No edit summary |
||
| Line 64: | Line 64: | ||
[[File:Bitwarden Passkey window screenshot.png|thumb|upright=1.2|Here shown the usage of passkey as a term to refer to WebAuthn credential ([[Bitwarden]] for [[Pixiv]])]] | [[File:Bitwarden Passkey window screenshot.png|thumb|upright=1.2|Here shown the usage of passkey as a term to refer to WebAuthn credential ([[Bitwarden]] for [[Pixiv]])]] | ||
''Passkey'' is the [[de facto]] [[ | ''Passkey'' is the [[de facto]] [[Technical language|non-technical]] term for a saved sign-in credential, a piece of [[cryptographic]] information that is capable of being used to authenticate a user using the WebAuthn standard.<ref name="docsrs-webauthnrs2">{{cite web |last1=Brown|first1=William|title=webauthn-rs docs|url=https://docs.rs/webauthn-rs/latest/webauthn_rs/#what-is-a-passkey|website=Docs.rs|publisher=Kanidm Identity Management Project|access-date=3 July 2025|date=April 2024|archive-url=https://web.archive.org/web/20250612151121/https://docs.rs/webauthn-rs/latest/webauthn_rs/#what-is-a-passkey|archive-date=12 June 2025}}</ref><ref name="imperialviolet-webauthn2">{{cite web |last=Langley|first=Adam|date=2024-12-23|title=A Tour of WebAuthn|url=https://www.imperialviolet.org/tourofwebauthn/tourofwebauthn.html|access-date=2025-08-13|website=Imperial Violet}}</ref> Most user interfaces that support using WebAuthn refer to it as supporting ''passkeys''.<ref name="arstechnica-not-usable2">{{cite web |last1=Goodin|first1=Dan|title=Passkey technology is elegant, but it’s most definitely not usable security|url=https://arstechnica.com/security/2024/12/passkey-technology-is-elegant-but-its-most-definitely-not-usable-security/|publisher=Ars Technica|access-date=3 July 2025|archive-date=3 July 2025|archive-url=https://web.archive.org/web/20250703130434/https://arstechnica.com/security/2024/12/passkey-technology-is-elegant-but-its-most-definitely-not-usable-security/|url-status=live}}</ref> | ||
When Apple first introduced passkeys to the public in 2022,<ref>{{cite news |last1=Clemons |first1=Taylor |title=WWDC 2022: Apple announces Passkey feature to eliminate passwords across platforms |url=https://www.zdnet.com/article/wwdc-2022-apple-announces-passkey-feature/ |access-date=4 July 2025 |publisher=ZD Net |date=6 June 2022 |archive-date=6 June 2023 |archive-url=https://web.archive.org/web/20230606212207/https://www.zdnet.com/article/wwdc-2022-apple-announces-passkey-feature/ |url-status=live }}</ref> they emphasized their | Due to the open-ended nature of the WebAuthn specification, a passkey can be stored on software or hardware that is capable of authenticating a user. This includes technology like [[Windows Hello]] which works by using facial recognition to authenticate users<ref>{{Cite web |last=|title=Support for Passkeys in Windows|url=https://learn.microsoft.com/en-us/windows/security/identity-protection/passkeys/|access-date=2026-06-06|website=learn.microsoft.com|language=en-us}}</ref><ref>{{Cite web |title=Configure Windows Hello - Microsoft Support|url=https://support.microsoft.com/en-us/windows/configure-windows-hello-dae28983-8242-bb2a-d3d1-87c9d265a5f0|access-date=2026-06-06|website=support.microsoft.com}}</ref>, [[Bitwarden]] which authenticates users through a browser extension<ref>{{Cite web |title=Log In With Passkeys|url=https://bitwarden.com/help/login-with-passkeys/|access-date=2026-06-06|website=Bitwarden|language=en}}</ref> or [[YubiKey|YubiKeys]] that allow a user to authenticate using a physical hardware token.<ref>{{Cite web |last=|first=|last2=|title=Stop changing weak passwords. Start replacing them with passkeys|url=https://www.pcworld.com/article/2591499/stop-changing-weak-passwords-start-replacing-them-with-passkeys.html|access-date=2026-06-06|website=PCWorld|language=en}}</ref> The cryptographic keys stored by the software are only available to use for the browser once the software or hardware is authenticated the user.<ref name="arstechnica-not-usable2" /> | ||
When Apple first prominently introduced passkeys to the public in 2022,<ref>{{cite news |last1=Clemons|first1=Taylor|title=WWDC 2022: Apple announces Passkey feature to eliminate passwords across platforms|url=https://www.zdnet.com/article/wwdc-2022-apple-announces-passkey-feature/|access-date=4 July 2025|publisher=ZD Net|date=6 June 2022|archive-date=6 June 2023|archive-url=https://web.archive.org/web/20230606212207/https://www.zdnet.com/article/wwdc-2022-apple-announces-passkey-feature/|url-status=live}}</ref> they emphasized integrations with their own products. This, combined with the lack of clear communication from other companies, led to speculation that passkeys were proprietary to Apple.<ref>{{cite news |last1=Shakir|first1=Umar|title=Reminder: passkeys are not just from Apple|url=https://www.theverge.com/2022/8/5/23293643/apple-passkeys-fido-alliance-passwordless-google-microsoft|access-date=4 July 2025|publisher=The Verge|date=6 August 2022|archive-date=24 September 2023|archive-url=https://web.archive.org/web/20230924231545/https://www.theverge.com/2022/8/5/23293643/apple-passkeys-fido-alliance-passwordless-google-microsoft|url-status=live}}</ref> As browsers and websites began to implement WebAuthn, the inconsistent feature-sets have often resulted in a variety of understandings of what exactly counted as a passkey.<ref name="arstechnica-not-usable2" /> | |||
== Overview == | == Overview == | ||