WebAuthn: Difference between revisions
No edit summary |
m Sp |
||
| Line 56: | Line 56: | ||
As a result, in 2012, [[Google]] alongside [[Yubico]] started working on a standard called [[Universal 2nd Factor|Universal 2 Factor]] (U2F)<ref>{{Cite web |title=Yubico Company Timeline|url=https://www.yubico.com/why-yubico/yubico-innovation-history/|access-date=2026-06-04|website=Yubico|language=en-US}}</ref> that would allow websites to programatically verify a second-factor about the user by verifying the presence of hardware-based tokens (like [[Smart card|smart cards]]) on the user. This standard was considered a improvement over existing solutions like time-based [[one-time password]] ([[TOTP - Time-based One-time Password Algorithm|TOTP]]) or SMS-based authentication that still left the user vulnerable to sophisticated [[phishing]] campaigns. The standard was later adopted into a larger industry wide collaboration called the [[FIDO Alliance|FIDO (Fast IDentity Online) Alliance]]. The first draft for this proposed standard was published in 2014.<ref>{{Cite web |date=2014-12-09|title=FIDO Alliance Publishes Final FIDO 1.0 Specifications, First Industry Standards for Universal Strong Authentication|url=https://www.yubico.com/press-releases/fido-alliance-publishes-final-fido-1-0-specifications-first-industry-standards-for-universal-strong-authentication/|access-date=2026-06-04|website=Yubico|language=en-US}}</ref> In 2015, the FIDO Alliance started started developing the [[FIDO2 Project|FIDO 2 Project]], releasing a proposed standard where they sought to improve upon the existing U2F standard by addressing many of it's weaknesses.<ref>{{Cite web |date=2015-09-04|title=FIDO Complete Spec 2015-09-04|url=https://fidoalliance.org/specs/fido-v2.0-ps-20150904/FIDO-COMPLETE-v2.0-ps-20150904.pdf|access-date=5 June 2026|website=Fido Alliance}}</ref> For example, the U2F standard still required to use of passwords alongside a second factor which still left websites vulnerable to password leaks and other similar attacks that were common against passwords.<ref name=":0">{{Cite journal |last=Ghorbani Lyastani|first=Sanam|last2=Schilling|first2=Michael|last3=Neumayr|first3=Michaela|last4=Backes|first4=Michael|last5=Bugiel|first5=Sven|date=May 2020|title=Is FIDO2 the Kingslayer of User Authentication? A Comparative Usability Study of FIDO2 Passwordless Authentication|url=https://ieeexplore.ieee.org/document/9152694/|journal=2020 IEEE S&P|publisher=IEEE|pages=268–285|doi=10.1109/SP40000.2020.00047|isbn=978-1-7281-3497-0}}</ref> Additionally, the U2F specification only verified the second factor device and did not perform any user authentication.<ref name=":0" /> This meant that if the second factor device had been stolen or lost anyone with access to the U2F device would be able to bypass the second factor of authentication for accounts linked to the device.<ref name=":0" /> | As a result, in 2012, [[Google]] alongside [[Yubico]] started working on a standard called [[Universal 2nd Factor|Universal 2 Factor]] (U2F)<ref>{{Cite web |title=Yubico Company Timeline|url=https://www.yubico.com/why-yubico/yubico-innovation-history/|access-date=2026-06-04|website=Yubico|language=en-US}}</ref> that would allow websites to programatically verify a second-factor about the user by verifying the presence of hardware-based tokens (like [[Smart card|smart cards]]) on the user. This standard was considered a improvement over existing solutions like time-based [[one-time password]] ([[TOTP - Time-based One-time Password Algorithm|TOTP]]) or SMS-based authentication that still left the user vulnerable to sophisticated [[phishing]] campaigns. The standard was later adopted into a larger industry wide collaboration called the [[FIDO Alliance|FIDO (Fast IDentity Online) Alliance]]. The first draft for this proposed standard was published in 2014.<ref>{{Cite web |date=2014-12-09|title=FIDO Alliance Publishes Final FIDO 1.0 Specifications, First Industry Standards for Universal Strong Authentication|url=https://www.yubico.com/press-releases/fido-alliance-publishes-final-fido-1-0-specifications-first-industry-standards-for-universal-strong-authentication/|access-date=2026-06-04|website=Yubico|language=en-US}}</ref> In 2015, the FIDO Alliance started started developing the [[FIDO2 Project|FIDO 2 Project]], releasing a proposed standard where they sought to improve upon the existing U2F standard by addressing many of it's weaknesses.<ref>{{Cite web |date=2015-09-04|title=FIDO Complete Spec 2015-09-04|url=https://fidoalliance.org/specs/fido-v2.0-ps-20150904/FIDO-COMPLETE-v2.0-ps-20150904.pdf|access-date=5 June 2026|website=Fido Alliance}}</ref> For example, the U2F standard still required to use of passwords alongside a second factor which still left websites vulnerable to password leaks and other similar attacks that were common against passwords.<ref name=":0">{{Cite journal |last=Ghorbani Lyastani|first=Sanam|last2=Schilling|first2=Michael|last3=Neumayr|first3=Michaela|last4=Backes|first4=Michael|last5=Bugiel|first5=Sven|date=May 2020|title=Is FIDO2 the Kingslayer of User Authentication? A Comparative Usability Study of FIDO2 Passwordless Authentication|url=https://ieeexplore.ieee.org/document/9152694/|journal=2020 IEEE S&P|publisher=IEEE|pages=268–285|doi=10.1109/SP40000.2020.00047|isbn=978-1-7281-3497-0}}</ref> Additionally, the U2F specification only verified the second factor device and did not perform any user authentication.<ref name=":0" /> This meant that if the second factor device had been stolen or lost anyone with access to the U2F device would be able to bypass the second factor of authentication for accounts linked to the device.<ref name=":0" /> | ||
In November 2015, the FIDO Alliance submitted the first version of FIDO 2 to the World Wide Web Consortium as a proposed web standard.<ref>{{Cite web |date=2015-11-20|title=W3C Welcomes the FIDO 2.0 Member Submission|url=https://www.w3.org/blog/2015/w3c-fido/|access-date=2026-06-05|website=W3C|language=en}}</ref> In 2016, the W3C established a | In November 2015, the FIDO Alliance submitted the first version of FIDO 2 to the World Wide Web Consortium as a proposed web standard.<ref>{{Cite web |date=2015-11-20|title=W3C Welcomes the FIDO 2.0 Member Submission|url=https://www.w3.org/blog/2015/w3c-fido/|access-date=2026-06-05|website=W3C|language=en}}</ref> In 2016, the W3C established a separate [[Web Authentication Working Group|W3C Web Authentication Working Group]] to help write a standard for the new FIDO 2 project's authentication framework such that it could be integrated into browsers by default.<ref>{{Cite web |title=Web Authentication Working Group Charter|url=https://www.w3.org/2015/12/web-authentication-charter.html|access-date=2026-06-04|website=www.w3.org}}</ref> The standard was adopted by major browser vendors in late 2018 and early 2019, with Chrome supporting the standard in version 67, Firefox in version 60 and Safari in version 13.<ref>{{Cite web |date=2026-02-19|title=Web Authentication API - Web APIs {{!}} MDN|url=https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API|access-date=2026-06-04|website=MDN Web Docs|language=en-US}}</ref> In 2019, the FIDO 2 project alonside the W3C Web Authentication Working Group released the first version of the WebAuthn specification based on the FIDO 2 project as a W3C recommendation. Subsequently the standard has gone through two revisions, being called Level 1, Level 2 with a Level 3 revision still being considered a Candidate Recommendation {{As of|2026|June|lc=y}}<ref>{{Cite web |title=Web Authentication: An API for accessing Public Key Credentials - Level 3|url=https://www.w3.org/TR/webauthn-3/Overview.html|access-date=2026-06-04|website=www.w3.org}}</ref>, meaning that it is considered mature and feature complete and is ready for implementation and testing by interested parties.<ref>{{Cite web |title=W3C Process Document|url=https://www.w3.org/policies/process/20250818/Overview.html|access-date=2026-06-04|website=www.w3.org}}</ref> | ||
== Passkey branding == | == Passkey branding == | ||