Introduce some basic concepts of WebAuthn, aiming to help you make better decisions when integrating WebAuthn.
WebAuthn provides a more secure and user-friendly alternative to traditional passwords. Its popularity is on the rise, with an increasing number of websites embracing this technology. If you're eager to integrate WebAuthn into your own website, you're not alone. However, as a relatively new technology, you likely have many questions about it.
When considering the integration of WebAuthn into your website or application, understanding these key concepts and considerations will help you make informed decisions about whether to implement it now.
Let's clarify the definitions:
Yes, you can use a Passkey on multiple devices in two ways:
Absolutely, WebAuthn is a highly secure authentication factor. The Passkey contains a "user ID," and during authentication, the server receives the verified "user ID" as the identifier. This "user ID" can be a universally unique identifier (UUID) or other unique identifiers like email, phone number, or username. Users can choose to enter their "user ID" first and then search for a valid Passkey or select a Passkey from a list associated with the current domain.
WebAuthn can be used in a secure context (HTTPS) and is supported in the latest versions of most browsers. For detailed compatibility information, please refer to the MDN documentation.
In WebAuthn actions, whether for registration or authentication, the "rp ID" (relying party ID) is a mandatory field. It represents the domain hostname of the current web page. If it doesn't match the current domain, the browser will reject the request. This means that passkeys are bound to a specific domain, and there's currently no way to migrate existing passkeys to a different domain. Additionally, passkeys cannot be used across different domains. For more details, please see this issue.
Comparing WebAuthn to traditional two-factor authentication methods, like Time-based One-Time Passwords (TOTP) and Authenticator apps, reveals several advantages. WebAuthn offers a more user-friendly and secure authentication experience. Unlike TOTP, which requires manual entry of a constantly changing code, or Authenticator apps that may be compromised if the device is stolen, WebAuthn relies on secure hardware and biometrics for a seamless and robust authentication process.
However, it's important to note that TOTP still has its advantages, such as easy backup and cross-device use, making it compatible with nearly all devices.
WebAuthn is undeniably exciting, but like any groundbreaking technology, it's vital to gain a comprehensive understanding before embracing it. This article aims to equip you with the knowledge needed to make informed decisions regarding WebAuthn integration. As you consider its potential benefits, keep in mind that staying informed is your key to success. By the way, stay tuned because Logto's next major feature will support WebAuthn, offering even more possibilities for seamless and secure authentication.