A web standard created by the World Wide Web Consortium (W3C) and FIDO Alliance, Web Authentication (WebAuthn) enables websites to use public key cryptography for user authentication. This replaces traditional password-based systems with more secure methods, such as hardware security keys, mobile device biometrics, or platform authenticators.
How WebAuthn Works
WebAuthn uses public key cryptography to verify a user’s identity. The process involves:
- User registration: The website generates a public-private key pair stored on the user’s device.
- Authentication: The website challenges the user’s device to prove possession of the private key, often through biometrics or a security key.
- Verification: The website confirms the user’s identity using the public key.
Common Authenticator Types
WebAuthn supports various authenticator types, including:
- Platform authenticators: Built into the operating system (e.g., Android, Apple Keychain).
- Roaming authenticators: External devices like USB security keys or mobile apps.
- Biometric authenticators: Fingerprint or facial recognition on supported devices.
Security Benefits
WebAuthn enhances security by:
- Eliminating passwords: Reducing risks associated with weak or stolen passwords.
- Preventing phishing: Credentials are scoped to specific websites, making them unusable on fraudulent sites.
- Supporting multi-factor authentication: Combining biometrics or security keys with traditional logins.
Compatibility and Adoption
WebAuthn is cross-platform, working across major web browsers and operating systems. While it is designed to replace passwords, many websites still use it alongside traditional authentication methods. The standard is maintained by the W3C and FIDO Alliance, ensuring ongoing support and development.
