• Follow us

Technology

WebAuthn: What you need to know about the future of the passwordless Web

WebAuthn is a new way of logging into websites that may finally free you from remembering passwords. Instead, you’ll use you: your fingerprint or face, or a hardware token.

The WebAuthn API is now an official standard, ratified by the World Wide Web Consortium (or W3C) on Monday. Fortunately, it’s already been built into many popular browsers as well as Windows 10. Now it’s up to the web itself to incorporate it. Here’s how it will work.

What makes WebAuthn better?

You may have heard of the Collections data breaches: millions of usernames and passwords, some linked to one another, and published to the web. In part, that’s because websites currently ask you to log in and store a username and password within the site itself. If that data leaks publicly, then bad actors can use that information to see whether you’ve used the passwords elsewhere. That can lead to a cascade effect, where hackers gain access to more and more of your personal information.

[ Further reading: The best antivirus for Windows PCs ]

WebAuthn doesn’t ask for a password. In fact, because it creates a one-time authentication token each time you log in, it’s basically following the recommended security practice of creating a unique password for every website. And it does so without forcing you to remember a thing. 

If you don’t need a password, what do you use instead?

WebAuthn supports two main categories of authentication: biometrics and hardware security tokens. You probably understand and already use biometrics such as fingerprint recognition via sensors in your smartphone or computer; or facial recognition, such as the depth camera that works with Windows Hello on your PC. 

Windows 10 Creators Update Windows Hello IDG / Mark Hachman

Windows Hello scans your face on Windows 10 PCs with a front-facing depth camera.

Hardware tokens are a little bit more obscure. The Yubico YubiKey is one popular example of a hardware token: Instead of using a password or biometrics, you simply put a Yubikey into a USB port on your PC. This is obviously handy for PCs that lack a depth camera. A YubiKey is essentially a complex password that you keep with you at all times. If you lose it, you’ll have to notify the site in question that you’ve lost it, deactivate that key, and then purchase and activate a new one.

How does WebAuthn work?

The Sophos Naked Security blog sums up the WebAuthn process rather neatly. If you log into a website that supports WebAuthn, that site challenges your browser to ask your PC (or smartphone) to prove that you are who you are. In this case, the browser asks your trusted authenticator to supply that proof. Your authenticator could be your phone’s fingerprint reader, Windows Hello, or a hardware token.

Because the authenticator itself is trusted, you don’t have to store fingerprint data or anything unique to you on the website—unlike the current way of doing things, where passwords are stored on the site. Basically, the authenticator is an intermediary: the good friend who can vouch for you when you meet somebody new, as an impeccable character reference.

security key by yubico with finger touch resized Yubico

Yubico YubiKeys like this one plug into the USB port on your PC for authentication.

When the website asks you to log in, the browser asks your authenticator to ask you to prove yourself by touching your fingerprint, for example. The authenticator then confirms that yep, you are who you say you are, and the browser passes that encrypted confirmation back to the web server. 

There’s a bit more to it than just this, including the encryption of your data with a public key and a challenge signed with your private key that unlocks it. The idea, though, is that you’re communicating your “secret” (your fingerprint, face, or token) only within the secure confines of your PC.

Here’s another way to look at it: Let’s say your bank representative was driving to your house to drop off your cash, and you had to prove who you were. You could shout your personal information and password to the driver to verify your identity, and let the whole neighborhood listen in. But it’s far better to bring a trusted friend inside your home, prove that you are you, and then have that friend go outside and yell,”hey, everything’s cool!

Is there a WebAuthn demo?

There is a WebAuthn demo you can view. Although it’s quite slow and didn’t seem to actually create a public key, Webauthn.org shows you how it will work. 

How does WebAuthn differ from two-factor authentication?

Essentially, WebAuthn is single-factor identification: a pretty ironclad way of identifying that you are you, but that’s all. If you passed out, could someone take your finger and authenticate yourself to your banking site? If that was the only way to verify your identity (i.e., no password), then yes, conceivably. Will WebAuthn work in conjunction with existing 2FA methods? That remains to be seen.

Mobile security: lock screen processing biometric fingerprint identification and encrypted password. Vijay Kumar / Getty Images

WebAuthn isn’t just for PCs; it works on mobile sites, too.

Two-factor authentication generally combines two of these three: something you know (a password) with something you have (a smartcard or token) or something you are—basically, you. In other words, your bank may still encourage you to use WebAuthn biometric identification with a password for even better security than what’s available today.

What needs to happen to make WebAuthn a reality?

Much of the groundwork for WebAuthn has already been completed.  Windows 10, Android, and Google Chrome, Mozilla Firefox, Microsoft Edge and Apple Safari (in preview) already support it.

Now, it’s up to the websites themselves to begin implementing support for WebAuthn, which may go a bit beyond simply rewriting their code to accept WebAuthn logins. It’s not clear, for example, whether a website that relies on WebAuthn will need to “fall back” to a less secure password if Windows Hello can’t recognize you for some reason, or your fingerprint reader fails as well. Those sites will also have to educate users on the advantages of using WebAuthn, and alter their login pages and the like. Do they force customers with older PCs to buy a hardware token? Probably not, but those decisions have to be made.

What happened this week, though, was an important step forward. The W3C essentially legislates web standards. With WebAuthn in place, sites are now clear to make it a reality.

To comment on this article and other PCWorld content, visit our Facebook page or our Twitter feed. Read More



Leave A Comment

More News

Electrek

Tesla carrier spotted transporting a wrapped pickup truck, 2019-03-07 05:30:39 A Tesla carrier was spotted with a truckload of Tesla vehicles, which is nothing out of the ordinary, aside from the fact that one of the vehicles wa

Tesla launches new Supercharger with 1,000 mph charging, 2019-03-06 23:02:32 In Fremont today, Tesla is launching the next generation Supercharger V3 with higher charging capacity (250 kW), better efficiency, and more. Some of

Tesla updates self-driving language, creates confusion and walks 2019-03-06 21:01:28 Today, Tesla updated its language regarding Autopilot and self-driving capability on its website – walking back some previously announced featu

Biomass battle: lawsuit challenges EU on ‘renewable energy’ 2019-03-06 15:38:45 The European Union is relying heavily on burning forest biomass to meet its carbon emissions goals. And now it’s facing a legal challenge that&

Tesla releases first glimpse of Supercharger V3 ahead 2019-03-06 14:50:41 Tesla has released a first glimpse of Supercharger V3 in an invite to a select few owners ahead of the launch of the new fast-charging station in Fre

Lightning Strike electric motorcycle capable of charging on 2019-03-06 14:18:43 Lightning Motorcycles still hasn’t entirely dropped the veil on their upcoming 150 mph (241 km/h) Strike electric motorcycle. But they have sha

Harley-Davidson updates LiveWire electric motorcycle specs, boosts range 2019-03-06 13:10:19 Harley-Davidson’s new LiveWire premium electric motorcycle will begin deliveries this fall. Ahead of production, the company has now released m

Tesla produces first batch of standard Model 3 2019-03-06 13:02:51 Less than a week after having launched the new base versions of the Model 3, Tesla has already produced the first batch of Model 3 vehicles with the

Michael Bloomberg passes on presidential run to go 2019-03-06 12:39:05 Michael Bloomberg won’t be running for president in 2020, but the former New York City mayor/billionaire businessman has set his sights on clim

Green Deals: WORX 20V 12-inch Cordless Electric String 2019-03-06 12:25:02 Today only, Woot offers the WORX WG163 20V GT 3.0 12-inch Cordless String Trimmer/Edger with three batteries for $79.99 Prime shipped. Non-Prime memb

Waymo selling its custom-built LIDAR sensor to robotics, 2019-03-06 11:19:15 In addition to operating a Lyft/Uber competitor, commercial trucks, and possibly licensing self-driving tech to carmakers, Waymo has another way to m

This cute little Motochimp V2 electric scooter is 2019-03-06 11:09:49 Much like the riders that use them, electric scooters come in all shapes and sizes. While you’re probably familiar with the standard electric k

PCWorld

6 big questions cord-cutters should ask about AT&T's 2019-03-07 06:00:00AT&T's management shakeup raises new questions about its streaming TV plans.

WebAuthn: What you need to know about the 2019-03-07 06:00:00WebAuthn is a new way of logging into websites that may finally free you from remembering passwords. Instead, you’ll use you: your fingerpr

Why you should or shouldn't buy a GeForce 2019-03-06 19:58:00Nvidia’s GeForce RTX GPU for laptops has arrived, hot on the heels of its announcement at CES. Unfortunately, all the hand-wringing and chest-be

Zuckerberg, Facebook commit to building 'privacy focused platform,' 2019-03-06 15:19:00Facebook chief executive Mark Zuckerberg said Wednesday that Facebook would commit to building a new “privacy-focused platform” that would

Best Fitbit: We help you choose the right 2019-03-06 13:30:00What is the best Fitbit? Our guide will help you find the one that best matches your activity level and habits, without spending more than you need.

Sonos is shipping a second-generation Sonos One smart 2019-03-06 13:17:00The Sonos One (Gen 2) features Bluetooth LE connectivity, a faster processor, and more memory.

Fitbit Versa Lite and Inspire HR hands-on: Affordability 2019-03-06 12:23:00Fitbit slims its lineup, trims prices with new Versa, Inspire, and Ace 2 in an effort to attract first-time wearable buyers.

Devil May Cry 5 review: Satisfying, slick, and 2019-03-06 11:00:00The problem is when Devil May Cry is at its best, it defies explanation. Sure you can try, and I’m going to for professional reasons.

Up your PC game with an all-time low 2019-03-06 09:52:00Switching to a good mechanical keyboard can completely transform your PC experience, especially if, like us, the majority of your day consists of tapp

How to add music to your PowerPoint presentations 2019-03-06 06:31:00You can add music to your PowerPoint presentations—and if done right, your audience will thank you. It can't replace good content, of course, b

Cambridge Audio Alva TT turntable review: Spin all 2019-03-06 06:00:00This easy-to-use, high-performance turntable lets you stream your favorite records to any audio system with a Bluetooth receiver, including wireless h

HP Spectre x360 15 (2019) review: A prettier, 2019-03-06 05:55:00The 2019 edition of the HP Spectre x360 15 convertible has a hard act to follow. We previously awarded HP’s Spectre x360 15 (2018) an Edito

GNT - actualités

Boring Company : un transport rapide souterrain à 2019-03-06 14:30:01The Boring Company a obtenu un avis favorable pour créer un système de transport souterrain sous le Convention Center de Las Vegas, avec

La sonde lunaire israélienne fait un selfie avec 2019-03-06 13:30:01Développé par une société privée, l'atterrisseur lunaire israélien Beresheet fait un selfie avec la Terre p

Pininfarina Battista : l'hypercar électrique qui promet du 2019-03-06 11:10:01La Pininfarina Battista promet, du haut de ses 1900 chevaux, de réaliser un 0-100 km/h en moins de deux secondes.

Aston Martin dévoile son concept Lagonda de SUV 2019-03-06 05:45:01Le constructeur Aston Martin présente au salon de l'Auto de Genève son concept de SUV tout électrique de luxe Lagonda.

La sonde InSight commence à pénétrer le sol 2019-03-05 14:10:01L'atterrisseur InSight sur Mars a commencé à creuser le sol de la planète rouge avec son instrument HP3. Une opération de

Audi Q4 e-Tron : le concept de SUV 2019-03-05 13:30:01Apparu sous forme de croquis il y a quelques jours, le concept Audi Q4 e-Tron se dévoile pleinement pour le salon de l'Auto de Genève e

Tesla Model Y : la présentation officielle dès 2019-03-04 07:10:01Modèle ultime de la gamme S 3 X Y rêvée par Elon Musk, la Tesla Model Y, qui devrait correspondre à un SUV compact dé

Le robot Mini Cheetah du MIT fait un 2019-03-03 11:10:01Il y a le robot quadrupède Cheetah du MIT, mais il existe aussi une version mini qui se présente avec un salto arrière comme sign

La capsule habitable de SpaceX devrait rejoindre l'ISS 2019-03-03 07:23:16Un premier vol d'essai vers l'ISS avec la capsule habitable de SpaceX qui ne sera pas habitée. Décollage prévu pour Crew Dragon

Fiat Chrysler veut développer des Jeep électriques 2019-03-03 07:10:01Le groupe automobile Fiat - Chrysler a annoncé investir lourdement dans la restructuration de ses chaînes de production du Michigan avec

GPS : gare au bug du 6 avril 2019-03-02 12:10:01Après le bug de l'an 2000, voilà venir le bug du 6 avril qui s'adresse avant tout aux modules GPS.

ArianeWorks pour accélérer sur un lanceur européen réutilisable 2019-03-02 10:10:01Un lanceur réutilisable européen est aussi à l'étude avec des démonstrateurs proches. ArianeGroup et le Cnes veule

Thetechhacker

How to protect yourself from Mobile Hacks and 2019-03-07 05:20:56Most people don’t realize just how valuable their smartphones are. Whether you have a top of the line iPhone or Samsung or a more budget-friendl

How to Access US Netflix While in China 2019-03-07 02:47:46Netflix has a unique fan base around the world. Unfortunately, in some parts of the world Netflix unavailable and in some countries they are expecting

How to Activate Google Assistant on My Phone 2019-03-07 00:46:44Google Assistant was released in 2016 by Google. This system app is one that serves as a virtual assistant for various mobile and smart devices develo

How to Access US Netflix While in Europe 2019-03-06 06:04:36Over the last few years, Netflix has greatly expanded its international presence. It’s now available in 190 countries. Every country not only ha

Key Tips On Starting A Website and How 2019-03-05 12:01:48Whether you are currently running a business or are working for yourself, starting a website can be a great way to generate some extra income. In a wo

Proxy providers under scrutiny in the first-of-its-kind market 2019-03-04 10:04:58Proxy service review site Proxyway.com assessed nine leading proxy providers in a first global proxy provider research report. The report finds that t

Advantages And Disadvantages Of Facebook 2019-03-04 05:00:42Over the years, Facebook has gained popularity and became the No.1 social networking website on the entire internet. Facebook is addictive in many way

How to Fix the “Screen Overlay Detected” Error 2019-03-04 00:59:08Screen Overlay Detected. An error that prevented you from using certain applications on your Android smartphone. The error will itself show you the so

KISSIN Dog Nail Grinder Quiet Portable USB Rechargeable 2019-03-03 21:49:51Every one of us must be using a nail cutter or a nail grinder for our personal use. This must be due to the fact that we need to cut our fingernails o

3 Small Changes That Can Boost Your Business 2019-03-03 06:23:17In this money driven world, all of us are looking to become more efficient, make better use of our time and earn as much money in as little time as po

10 Best Browsers for Linux 2019-03-02 03:23:15When it comes to choosing web browsers for Linux, it can be extremely difficult because the web browser is no just about its design but also about the

Best System Monitoring Apps for Android 2019-03-01 21:17:34Android is the most popular OS for its customization features. There are a ton of apps available in the Google Play Store like Android look customizat

Ars Technica UK

Anita Sarkeesian talks about exposing gaming’s most toxic 2019-03-07 07:30:18"A conversation happened in games that was previously only happening in the shadows."

Dragon has docked—but the real pucker moment for 2019-03-07 07:25:42NASA, SpaceX watch for a stable Dragon, good parachute performance on Friday.

Nintendo’s first VR product in 24 years is 2019-03-06 21:20:06Coming April 12; starts at $40, or pay $80 for a larger, accessory-filled "VR Kit."

Jeopardy! host reaches out directly to fans to 2019-03-06 17:40:34Trebek: "I wanted to prevent you from hearing inaccurate reports regarding my health."

Discless Xbox “Maverick” could arrive as soon as 2019-03-06 16:15:19Download-only device could be with us a little sooner than expected.

After the Galaxy Fold, Samsung has two more 2019-03-06 14:21:32Samsung is developing a Mate X-style wraparound display phone and a flip phone.

Nintendo to smartphone game makers: You can only 2019-03-06 13:36:50Dragalia Lost devs blame Nintendo's rules for reduced earnings forecast.

Las Vegas convention authority wants The Boring Company 2019-03-06 13:10:45Musk's company says it can deliver by early 2021 for $35 million to $55 million.

Latest trailer for Good Omens gives us our 2019-03-06 13:02:51Armageddon is just days away, and someone has lost the Antichrist.

OxyContin-pusher Purdue blames everyone but itself for opioid 2019-03-06 12:52:17Illicit drugs and dealers are currently driving deaths, Purdue argues.

Democrats’ net neutrality bill would fully restore Obama-era 2019-03-06 12:40:28Democrats' bill has good chance in House but faces tough odds in Senate.

After buying firm run by HackingTeam vets, Coinbase 2019-03-06 12:28:20CEO Armstrong "transitions out" Neutrino leaders who worked for exploit dealer.

Radio-Canada | Technologie

Plus privé, plus sûr et éphémère : le 2019-03-06 15:13:00Facebook passera progressivement de la plateforme ouverte et publique actuelle à un réseau social mettant de l'avant les cercles priv&e

La reconnaissance automatisée pour réduire le trafic de 2019-03-06 13:55:00Ces derniers mois, 770 visiteurs ont dû faire analyser leur visage, leur iris ou leurs papiers par un système informatique avant d'aller

La NSA transforme en logiciel ouvert Ghidra, un 2019-03-06 11:29:00La National Security Agency (NSA), une agence de renseignement américaine, vient de transformer l'un de ses puissants outils de cybersé

L'inventeur du web veut panser les maux d'Internet 2019-03-05 20:58:00L'inventeur du World Wide Web, le Britannique Tim Berners-Lee, a détaillé mardi comment il comptait s'attaquer à la dési

Ce robot du MIT peut faire un saut 2019-03-05 16:42:00Après les robots qui se déplacent comme des humains et les robots acrobates de Disney, voilà maintenant que le Massachusetts Inst

Le prix de 1 Go de données est 2019-03-05 11:56:00Une étude mondiale du coût des données mobiles démontre que le Canada est l'un des pays où il faut dépenser

Vous pouvez maintenant transformer une photo en tableau 2019-03-05 11:30:00Microsoft propose depuis mardi à certains utilisateurs de l'application mobile Excel de convertir automatiquement une photo de données

Voici comment débloquer le mode sombre caché dans 2019-03-04 16:36:00Apple, Google, Microsoft... Les entreprises technos sont de plus en plus nombreuses à proposer un mode sombre pour leurs applications, et Messe

Facebook ne garde pas privé votre numéro de 2019-03-04 11:46:00Des utilisateurs de Facebook se plaignent que le numéro qu'ils ont fourni au réseau social pour des raisons de sécurité a

Google s’excuse pour un microphone caché dans un 2019-02-20 17:13:00Google dit avoir commis une erreur en omettant d'informer les acheteurs de son système d'alarme résidentiel Nest Secure qu'un microph

Une vulnérabilité de WinRAR a persisté pendant 14 2019-02-20 17:08:00Une faille de sécurité du logiciel WinRAR permettant à des pirates de prendre le contrôle d'un ordinateur aurait pu ê

Samsung dévoile le Galaxy Fold, un téléphone pliable 2019-02-20 13:39:00Samsung a présenté mercredi plusieurs nouveaux appareils mobiles à San Francisco, dont un téléphone pliable.

Techno

La nouvelle stratégie de Facebook, les principes-clés 2019-03-06 19:17:28La transformation du réseau social, qui prendra des années, s’articule autour de plusieurs principes.

Vous pensiez avoir tout vu et entendu en 2019-03-06 13:56:59Les technologies audionumériques n’ont pas fini de nous étonner.

Voici le plus petit tourne-disque au monde! 2019-03-06 13:22:43Vous pouvez l’emporter partout avec vos disques vinyle, tout ce qu’il vous faut, c’est une surface plane et... un haut-parleur Bluet

DJ dans l’âme, vous n’aurez plus à casser 2019-03-06 12:52:35Elektron vient bouleverser le marché des synthétiseurs avec des prix plus accessibles.

L’inventeur du web veut s'attaquer aux maux d’internet 2019-03-05 16:39:24L'inventeur du World Wide Web, le Britannique Tim Berners-Lee, a détaillé comment il comptait s'attaquer à la désinforma

PAX East: une présentation de Borderlands 3 ? 2019-03-05 12:00:07Petit rappel: «Borderlands 2» est sorti en 2012

Halo Infinite sera un «reboot spirituel» 2019-03-05 11:52:13Halo Infinite, le prochain opus de la franchise Halo réalisé par les studios de Xbox, n’a pas encore de date de sortie.

Identification par numéro de téléphone: les abonnés de 2019-03-05 09:47:46Les utilisateurs de Facebook ont de quoi être mécontents.

Voici comment activer le «mode sombre» secret sur 2019-03-04 18:47:35Le système de messagerie instantanée de Facebook offre désormais un peu de répit à ceux qui ont les yeux sensibles

Un jeune Québécois champion de Fortnite 2019-03-03 20:21:27Cent joueurs parmi les meilleurs du monde du jeu vidéo phénomène Fortnite se sont affronté ce weekend à Katowice en

Bientôt un vol spatial habité privé 2019-03-02 06:00:00Huit ans après la fin des vols habités américains, la compagnie privée SpaceX fait l’essai à vide d’une

Bonne nouvelle! Twitter teste une fonction de modération! 2019-03-01 14:12:36La fonction de modération donnera aux abonnés la possibilité de cacher des réponses inappropriées ou inconvenantes


Disclaimer and Notice:WorldProNews.com is not responsible of these news or any information published on this website.