Gain a comprehensive understanding of WebAuthn, including its concept, workflow, reasons for its popularity, and associated challenges.
WebAuthn ranks among the most secure authenticators in NIST AAL standards. Introduced in 2013, it's the favored choice of businesses for authentication now. However, its adoption isn't widespread yet, leading to many inquiries about WebAuthn and Passkeys. Let's dive into what you should know.
| FIDO Alliance | FIDO Alliance is an organization for providing open-source and secure passwordless authentication standards, including UAF, U2F, and FIDO2. |
| FIDO2 | FIDO2 is a set of standards for secure online authentication developed by FIDO Alliance. FIDO2 comprises two main components: WebAuthn for passwordless logins and CTAP for secure device communication. |
| Passkey | A passkey is a FIDO-based, phishing-resistant credential to replace passwords.
|
| WebAuthn | WebAuthn, a JavaScript API developed by the W3C and FIDO Alliance, empowers web applications authentication with FIDO2 standards. Passkey is one of the authentication methods WebAuthn supports. |
Basically, you may know the 4 main entities involved in WebAuthn flow.
User: The person that enrolls or authenticates to the web application using WebAuthn.
User Agent: The web browser that handles the WebAuthn API calls, and manages the authentication process between all different relying parties and authenticators.
Relying Party: Your web service or application that the user is trying to access. The user interacts with the Rely party through the User Agent.
Authenticator: The hardware component the user possessed for verifying the user’s identity. It can take various forms based on the platform or browser capability, such as security keys (like Yubikeys), phones or tablets (connected by Bluetooth, NFC, or USB), device-based biometrics or PINs, etc.
Asymmetric public-key cryptography is the core process.
To elaborate, divide it into the enrollment and authentication phases.
The WebAuthn enrollment flow:
The WebAuthn authentication flow:
You have the option to choose from multiple authenticators for added flexibility. These authenticators come in two types, for both local and cloud use, and you can enable one or both for your service.
The platform authenticator is tied to a single and specific device OS, such as a computer, laptop, phone, or tablet, which the user signs in with. It works exclusively on the device for authorization using methods like biometrics or a device passcode. It's a quick way to authenticate, especially with biometrics, and can replace the need for manual password entry. However, if the user loses the device, it can become a barrier to access. For example:
The roaming authenticator is a separate, portable device or software application, such as a hardware security key or a smartphone. It should link the device using USB or keeping NFC or Bluetooth on. The roaming authenticator is not limited to a single device or browser, providing greater flexibility. For example:
High assurance security is essential for safeguarding business resources. This is achieved through the following measures:
WebAuthn enhances security while elevating the user's passwordless verification experience:
Some browsers or platforms either do not support WebAuthn at all or lack support for roaming authenticators. While current statistics of Caniuse show decent support, with 97.37% desktop and 96.3% mobile platform coverage, variations still exist across different browser versions and operating systems. For instance, Desktop Linux lacks support for platform authenticators, Android only fully supports WebAuthn on Chrome, and Internet Explorer on MacOS does not support WebAuthn. This necessitates admins to ask members to enforce specific browser or OS choices, or configure other alternative MFA methods.
Particularly for users relying on "This device" platform authenticators, losing the device can result in a loss of access to their accounts. Account recovery can be a cumbersome process. To mitigate this risk, it's advisable for users to simultaneously bind other backup authentication methods when setting up WebAuthn.
Many services and applications do not yet offer support for passkeys. Users often lack familiarity with various authentication methods and may not fully understand the distinctions and limitations between Platform authenticators and Roaming authenticators. However, major systems, browsers, and SaaS services are increasingly adopting WebAuthn, making it a growing trend that both businesses and users are beginning to embrace.
Logto is gearing up to launch the MFA (Multi-Factor Authentication) in November. The initial phase will support three verification methods: Authenticator app TOTP, WebAuthn(Passkey), and Backup codes, offering a comprehensive sign-in and sign-up solution. We'll continue to develop advanced features related to WebAuthn. We look forward to your experience and invite you to stay tuned on Product Hunt for the upcoming MFA release.