WebAuthn (Web Authentication) is a web standard and browser-based API developed by the World Wide Web Consortium (W3C) and the FIDO Alliance to provide passwordless, phishing-resistant authentication for web applications. Its primary goal is to replace traditional password-based logins with stronger, more secure methods using public key cryptography.
Key features and how it works:
- Passwordless Authentication: Instead of passwords, users authenticate with something they have (like a device or security key) and something they are (such as biometrics or a PIN).
- Public Key Cryptography: When a user registers with a website, a unique public-private key pair is generated. The private key stays securely on the user’s device, while the public key is stored on the server.
- Authentication Process: To log in, the server sends a challenge to the browser, which is signed using the private key on the user’s device after the user proves their identity (e.g., fingerprint, facial recognition, PIN). The signed challenge is returned to the server, which verifies it using the stored public key.
- Phishing Resistance: Credentials are scoped to a specific website and cannot be used elsewhere, making it highly resistant to phishing and credential theft.
- Device Flexibility: WebAuthn supports both platform authenticators (built-in, like a laptop’s fingerprint reader) and roaming authenticators (external, like USB security keys or smartphones).
- Widespread Support: Supported by all major browsers (Chrome, Firefox, Edge, Safari) and operating systems, and adopted by leading services such as Google, Microsoft, and Facebook.