WebAuthn

Since the first computer systems emerged, the question of user authentication has been a constant concern. Passwords quickly became the obvious answer: a character string known to the user, simple to implement, easy to understand. Except that this simplicity poorly conceals its weaknesses. Passwords are stolen, guessed, intercepted. In 2024, more than 80% of security breaches still exploit weak or stolen passwords.

Over time, other methods have emerged. Two-factor verification, digital certificates, biometrics. Each contributes its part, but they sometimes remain cumbersome to deploy or lack true uniformity. This is where the W3C and the FIDO Alliance decided to change the game with Web Authentication, more simply called WebAuthn.

Google, Mozilla, Microsoft, and Yubico rolled up their sleeves to develop this specification published in 2019. The idea breaks with what had been done for decades. Instead of sharing a secret between the user and the server, WebAuthn relies on asymmetric cryptography. When you register with a service, a key pair is created. The private key stays securely on your device, while the public key goes to the server with a randomly generated identifier.

In this architecture, the public key stored on the server side is useless for hacking your account. Attackers are increasingly losing interest in databases. Authentication is tied to the exact domain of the site: a key created for example.com will never work on evil-example.com. Phishing attempts lose much of their effectiveness.

WebAuthn rests on three pillars. Robustness first: authentication relies, when possible, on a hardware security module that keeps private keys and performs cryptographic calculations. Scope second: each key pair is only valid for a specific origin, like the cookies we know well. Attestation finally: authenticators can provide a certificate that proves to the server that the public key comes from a trusted source.

Browsers quickly adopted this technology. Chrome, Firefox, Edge, Safari: all support the standard. Developers therefore have the ability to integrate it uniformly. Modern operating systems followed with their own authentication systems: Windows Hello at Microsoft, Touch ID at Apple.

The process itself unfolds in several stages. During registration, the server transmits data that links the user to their credentials, with information about the organization and a random string to counter replay attacks. The browser uses the Web Authentication API to request the creation of a new key pair.

The response contains the authenticator identifier, client data in JSON, an attestation object. The server verifies all this according to a 19-step procedure described in the specification. Once validated, it stores the public key and identifier in its database.

For subsequent logins, you prove that you possess the private key by creating an assertion. The server sends a new random string, the authenticator generates a digital signature that the server verifies with the public key it has kept. No more risk of password theft, and the user experience is improved.

WebAuthn is part of FIDO2, a set of technologies that aims to generalize passwordless authentication. The need is felt: in 2024, only 28% of users enable two-factor authentication on their online accounts.

The specification continues to evolve with new features and implementations that are refined. Developers find code examples and libraries in different languages, notably Python and Go, to integrate WebAuthn into their applications.

The history of WebAuthn shows how authentication methods on the Internet are transforming. By replacing passwords with cryptographic keys, this standard meets current security requirements while simplifying users’ lives. Major web players are increasingly adopting it, and one can bet that in the future, authentication will become both more secure and more convenient.

This evolution is part of a broader movement where asymmetric cryptography is gradually replacing the shared secrets of the past. WebAuthn represents an important milestone in the history of computer security, providing a standardized solution to this authentication problem that has pursued us since the beginning.