The World Wide Web Consortium (W3C) today declared that the Web Authentication API (WebAuthn) is now an official web standard. First announced by the W3C and the FIDO Alliance in November 2015, WebAuthn is now an open standard for password-free logins on the web. It is supported by W3C contributors, including Airbnb, Alibaba, Apple, Google, IBM, Intel, Microsoft, Mozilla, PayPal, SoftBank, Tencent, and Yubico.

The specification lets users log into online accounts using biometrics, mobile devices, and/or FIDO security keys. WebAuthn is supported by Android and Windows 10. On the browser side, Google Chrome, Mozilla Firefox, and Microsoft Edge all added support last year. Apple has supported WebAuthn in preview versions of Safari since December.

Killing the password

“Now is the time for web services and businesses to adopt WebAuthn to move beyond vulnerable passwords and help web users improve the security of their online experiences,” W3C CEO Jeff Jaffe said in a statement. “W3C’s Recommendation establishes web-wide interoperability guidance, setting consistent expectations for web users and the sites they visit. W3C is working to implement this best practice on its own site.”

Although the W3C hasn’t adopted its own creation yet, WebAuthn is already implemented on sites such as Dropbox, Facebook, GitHub, Salesforce, Stripe, and Twitter. Now that WebAuthn is an official standard, the hope is that other sites will jump on board as well, leading to more password-free logins across the web.

But it’s not just the web. The FIDO Alliance wants to kill the password everywhere, a goal it has been working on for years and will likely still be working on for years to come.

FIDO2

W3C’s WebAuthn recommendation is a core component of the FIDO Alliance’s FIDO2 set of specifications. FIDO2 is a standard that supports public key cryptography and multifactor authentication — specifically, the Universal Authentication Framework (UAF) and Universal Second Factor (U2F) protocols. To help spur adoption, the FIDO Alliance provides testing tools and a certification program.

FIDO2 attempts to address traditional authentication issues in four ways:

Security: FIDO2 cryptographic login credentials are unique across every website; biometrics or other secrets like passwords never leave the user’s device and are never stored on a server. This security model eliminates the risks of phishing, all forms of password theft, and replay attacks.

Convenience: Users log in with simple methods such as fingerprint readers, cameras, FIDO security keys, or their personal mobile device.

Privacy: Because FIDO keys are unique for each internet site, they cannot be used to track users across sites.

Scalability: Websites can enable FIDO2 via an API call across all supported browsers and platforms on billions of devices consumers use every day.

“The Web Authentication component of FIDO2 is now an official web standard from W3C, an important achievement that represents many years of industry collaboration to develop a practical solution for phishing-resistant authentication on the web,” FIDO Alliance executive director Brett McDowell said in a statement. “With this milestone, we’re moving into the next phase of our shared mission to deliver simpler, stronger authentication to everyone using the internet today, and for years to come.”</s>The Internet is one step closer to a passwordless future. The World Wide Web Consortium (W3C), along with the FIDO Alliance, announced that Web Authentication (WebAuthn) specification is now a web standard.

WebAuthn is a core component of the FIDO Alliance’s FIDO 2 set of specifications, which aims to provide easier authentication services to mobile and desktop environments. According to the alliance, WebAuthn enables online services to leverage FIDO Authentication through a standard web API that can be used in browsers and other web platform infrastructure. The W3C’s WebAuthn Recommendation currently supports WIndows 10, Android, Google Chrome, Mozilla Firefox, Microsoft Edge and Apple Safari.

“Now is the time for web services and businesses to adopt WebAuthn to move beyond vulnerable passwords and help web users improve the security of their online experiences,” said Jeff Jaffe, W3C CEO. “W3C’s Recommendation establishes web-wide interoperability guidance, setting consistent expectations for web users and the sites they visit. W3C is working to implement this best practice on its own site.”

The W3C explained that passwords are no longer efficient enough to protect users. Recent reports have found 81 percent of data breaches are the result of stolen and weak passwords. Additionally, too much time and resources are spent on passwords with 10.9 hours of users time per year spent entering or resetting passwords. Traditional multi-factor authentication methods such as SMS or additional security layers are also too vulnerable to phishing attacks.

FIDO2 was created to strengthen online protection with cryptographic login credentials, biometrics, fingerprint readers, and unique privacy keys.

“Web Authentication as an official web standard is the pinnacle of many years of industry collaboration to develop a practical solution for stronger authentication on the web,” said Brett McDowell, executive director of the FIDO Alliance. “With this milestone, we’re moving into a new era of ubiquitous, hardware-backed FIDO Authentication protection for everyone using the Internet.”</s>Today, the World Wide Web Consortium (W3C), the organization behind all web standards, has formally promoted the Web Authentication API to the title of official web standard.

This promotion means the Web Authentication API --more commonly referred to as WebAuthn-- has now reached a stable version and can be implemented and rolled out by websites in its current form, without fear of future breaking changes.

The standard is already supported in browsers like Google Chrome, Edge, and Firefox, and the preview version of Apple's Safari. It is also supported on Android and Windows 10.

WebAuthn is what security experts are calling a passwordless authentication system and what they see as the future of user account security.

WebAuthn allows users to register and authenticate on websites or mobile apps using an "authenticator" instead of a password.

The "authenticator" can be a hardware security key that the user has connected to his computer or a biometric ID that can be acquired from the PC or smartphone's sensors --such as fingerprints, face scans, iris scans, and others.

Development on the WebAuthn standard started back in November 2015, after the FIDO (Fast IDentity Online) Alliance donated the FIDO 2.0 Web API to the W3C.

The original FIDO 2.0 Web API is already supported by browsers and online services. It's what currently allows users to use secret tokens stored on YubiKey USB thumb drives (aka hardware security keys) to log into websites such as Google, Facebook, Dropbox, AWS, GitHub, YouTube, and others.

The WebAuthn API is an upgrade of the old FIDO 2.0 Web API and will support a multitude of other authentication systems besides USB-stored security keys --including biometrics.

Besides W3C and browser makers, the FIDO Alliance has also greatly contributed to the new WebAuthn standard.

The FIDO Alliance is an industry consortium that includes some of the tech world's largest companies. The FIDO Alliance's main mission is to create interoperable authentication methods and standards fit for the future of technology and move users and devices away from using antiquated passwords-based login systems.

"Now is the time for web services and businesses to adopt WebAuthn to move beyond vulnerable passwords and help web users improve the security of their online experiences," said Jeff Jaffe, W3C CEO.
• Chrome and Firefox are borrowing from each other's performance features
• A third of all Chrome extensions request access to user data on any site
• Surveillance firm asks Mozilla to be included in Firefox's certificate whitelist
• New browser attack lets hackers run bad code even after users leave a web page
• Google Chrome bug used in the wild to collect user data via PDF files
• What enterprises need to know about the new Chromium-based Edge TechRepublic
• Ad-blocking Brave gets memory advantage over Chrome on news websites CNET</s>The World Wide Web Consortium (W3C) and the FIDO Alliance have finalized the Web Authentication (WebAuthn) standard for no-password sign-ins.

Despite being officially finalized on March 4th, the standard has been in use for some time. Further, it’s already supported by Windows 10 and Android, along with several browsers including Chrome, Edge, Firefox and Safari.

WebAuthn allows users to log into websites using biometrics, like fingerprints or facial recognition, USB security keys or nearby mobile devices like phones and smartwatches.

Additionally, WebAuthn uses unique encrypted login details across every website, which should eliminate the risk of phishing, password theft and replay attacks. Further, it means your passwords and biometric data never leave the device, and the unique keys prevent you from being tracked across sites.

Unfortunately, the challenged with WebAuthn will be getting sites on board. There are a lot of webpages on the internet, and most of them probably won’t be rushing to ditch passwords.

That said, an official standard should help convince sites to adopt WebAuthn.</s>A new report has revealed a significant development for the technology world. As part of the report, the W3C (World Wide Web Consortium) has just approved the WebAuthn API, a new standard for authentication that is likely to gradually replace passwords to be the only means of authentication across multiple websites and services. As noted by the report, this new API is already supported by major web browsers including Google Chrome, Firefox, Microsoft Edge, and Apple Safari. Now that W3C has approved the API as an official web standard, it is likely that more websites will start adapting WebAuthn for authentication.

According to a report by The Verge, any website that supports the API can use WebAuthn to communicate with any specified security device to allow users to log into any given service. The type of security device has not been specified and it can range from a normal FIDO security key to a sophisticated biometric device such as a fingerprint scanner. These methods will help users by providing them with an additional layer of verification to log in to the service or website of their choice.

If an increasing number of users start using this API then this authentication process is still “more secure” than most of the passwords that a majority of internet users use to protect their services. Another benefit of this authentication method is that users will no longer need to keep on remembering long complicated strings of passwords which could mean that passwords may gradually be on their way out.

A number of websites are already supporting this new API including Dropbox and Microsoft with more to soon join the wagon. According to the official announcement, Jeff Jaffe, the CEO for W3C issued a statement adding, “Now is the time for web services and businesses to adopt WebAuthn to move beyond vulnerable passwords and help web users improve the security of their online experiences.”</s>The World Wide Web Consortium (W3C) has announced the adoption of the Web Authentication (WebAuthn) specification from the FIDO Alliance, as part of a move 'beyond vulnerable passwords'.

Founded in 2012, the FIDO Alliance - named for its promise to provide Fast Identity Online - launched its first standard, the Universal Second Factor (U2F), in October 2014. Designed for use with physical dongles, initially connected via USB but later expanded to include Bluetooth and Near Field Communication (NFC) connectivity for easier use with mobile devices, U2F allows a user to provide a cryptographic proof with a single button press. While most commonly used in addition to a password, providing the second authentication factor of 'something you have' as promised by its name, the same core technology was extended with the launch of FIDO2 to offer a replacement for traditional passwords - as adopted by Microsoft in November 2018 as an extension to Windows Hello.

Now, the FIDO Alliance's U2F standard has been formally adopted by the World Wide Web Consortium (W3C) as the W3C Web Authentication Standard, or WebAuthn. 'Now is the time for web services and businesses to adopt WebAuthn to move beyond vulnerable passwords and help web users improve the security of their online experiences,' claims W3C chief executive Jeff Jaffe of the standard's formal ratification and adoption. 'W3C's recommendation establishes web-wide interoperability guidance, setting consistent expectations for web users and the sites they visit. W3C is working to implement this best practice on its own site.'

'Web Authentication as an official web standard is the pinnacle of many years of industry collaboration to develop a practical solution for stronger authentication on the web,' adds Brett McDowell, executive director of the FIDO Alliance. 'With this milestone, we're moving into a new era of ubiquitous, hardware-backed FIDO Authentication protection for everyone using the internet.'

WebAuthn is supported as standard in the Windows 10 and Android operating systems and Chrome, Firefox, and Edge browsers, and in the preview release of Apple's Safari. It forms, however, only a subset of FIDO2 functionality, with the FIDO Alliance's Client to Authenticator Protocol (CTAP) joining WebAuthn to make up the standard proper. WebAuthn is also device-agnostic: While the FIDO Alliance recommends the use of its physical FIDO security dongles, authentication is also supported using alternative devices including smartphones, fingerprint readers, and cameras.

The full WebAuthn standard is available on the W3C website.</s>The World Wide Web Consortium (W3C) and the FIDO Alliance on Monday elevated the Web Authentication (WebAuthn) as an official web standard. The move is believed to be a big step towards making the internet safer and more secure for users around the world.

The new web standard paves way for a simpler and stronger authentication, according to the consortium. The Consortium has asked the internet services to enable the web standard to allow users to log in more securely through security keys and even biometrics. The standard is already supported by major platforms including Windows 10, Android, Google Chrome, Mozilla Firefox and Microsoft Edge.

“Not only are stolen, weak or default passwords behind 81% of data breaches, they are a drain of time and resources. According to a recent Yubico study, users spend 10.9 hours per year entering and/or resetting passwords, which costs companies an average of $5.2 million annually. While traditional multi-factor authentication (MFA) solutions like SMS one-time codes add another layer of security, they are still vulnerable to phishing attacks, aren’t simple to use and suffer from low opt-in rates,” said W3C and FIDO Alliance in a release.

WebAuthn can be implemented as an API which will allow sites to connect with a security device when a user logging into their accounts. The security device could range from a biometric-based device or a simpler USB token. TheVerge reports that WebAuthn is a more secure way of logging into accounts that the weak passwords users have some of their accounts. WebAuthn is also quite flexible allowing users to log into their accounts online using devices they prefer.

ALSO READ: Intel Thunderbolt-based ‘USB 4’ to deliver up to 40Gbps data transfer speed

“FIDO2 cryptographic login credentials are unique across every website, biometrics or other secrets like passwords never leave the user’s device and are never stored on a server. This security model eliminates the risks of phishing, all forms of password theft and replay attacks,” said the consortium. “Because FIDO keys are unique for each Internet site, they cannot be used to track you across sites.”

FIDO Alliance has released testing tools and launched a certification programme to help service providers get started with the new standard.

ALSO READ: 14.5% Indian companies could not detect any cyber attack in 2018: F-Secure Report</s>WebAuthn has become an official web standard for logins, the World Wide Web Consortium and the FIDO Alliance said Monday.

"It's common knowledge that passwords have outlived their efficacy," the organizations wrote in a press release. "Not only are stolen, weak or default passwords behind 81 percent of data breaches, they are a drain of time and resources."

WebAuthn, short for Web Authentication, is a browser and platform standard for simpler and stronger authentication processes, according to W3C and the FIDO Alliance. It lets users log in to their online accounts using their preferred device, biometrics or FIDO security keys.

WebAuthn is already supported in Windows 10, Android, Google Chrome, Mozilla Firefox, Microsoft Edge and Apple Safari browsers. Now that it's an official web standard, that should encourage wider adoption of WebAuthn instead of passwords.

Passwords are becoming less popular. Google in February said Android is FIDO2-certified, which means devices can use fingerprints and security keys for logging in to accounts instead of passwords. The change affects those running Android 7 and up, half of all Android users. That's approximately a billion devices.</s>Ever dreamed of a password-free internet? Well the World Wide Web Consortium (W3C), an organisation which maintains the international standards for the world wide web, has approved WebAuthn. What is WebAuthn? In simple terms, it is a new authentication standard which when implemented will remove passwords as a source of authentication for your online accounts.

WebAuthn, which is short for Web Authentication, is an API which is a core component of FIDO Alliance's FIDO 2 set of specifications. The FIDO Alliance is an industry consortium launched back in February 2013 to address the problems users face creating and remembering multiple usernames and passwords.

With WebAuthn, you can log into your internet accounts using your preferred device with the help of biometrics and FIDO security keys. Basically, these methods are more secure than your password and are also not required to be remembered.

“W3C's Recommendation establishes web-wide interoperability guidance, setting consistent expectations for web users and the sites they visit. W3C is working to implement this best practice on its own site.” said Jeff Jaffe, W3C CEO.

While most browsers including Chrome, Firefox, Edge, and Safari already support this standard, the next step is for websites to integrate it as well. Dropbox and Microsoft have already done so last year and more websites should follow suit soon.

Tech2 is now on WhatsApp. For all the buzz on the latest tech and science, sign up for our WhatsApp services. Just go to Tech2.com/Whatsapp and hit the Subscribe button.</s>The technology links unique encrypted login details to each website, reducing the risks of phishing, keystroke logging and other attacks that watch for your input. It's also theoretically more private when those same unique site credentials prevent across-the-web tracking.

You don't really have to wait for the software you use to support Web Authentication. It's already supported on a system level in Android, Chrome OS and Windows 10 as well as most common browsers, including Chrome, Edge, Firefox and Safari. The greater challenge is convincing the sites themselves to use this method -- there are many, many web pages, and not all of them will be in a rush to ditch passwords. An official standard could still boost adoption, though, if just by reassuring site operators that Web Authentication won't vanish overnight.
The World Wide Web Consortium announces that WebAuthn, a standard for password-free logins on the web, is now an official web standard.