FIDO2WebAuthnstandardeja

FIDO2 WebAuthn is a set of standards developed by the FIDO Alliance and the World Wide Web Consortium (W3C) to enable passwordless, phishing-resistant authentication on the web. It combines the Web Authentication (WebAuthn) API with the Client To Authenticator Protocol (CTAP) to support a broad range of authenticators, including built-in platform biometrics and external security keys. The goal is to replace or supplement passwords with cryptographic credentials bound to a user and a relying party (the website or service).

During registration, the authenticator generates a new public/private key pair; the public key is registered with the service, while the private key remains securely on the authenticator. During authentication, the service sends a challenge; the authenticator signs the challenge with the private key, proving possession without revealing the key. The private key never leaves the device, and the credentials are restricted to the origin of the relying party, reducing phishing risks.

CTAP defines how an external device or platform component communicates with the client; CTAP2 supports roaming and multi-device use. WebAuthn is supported across major browsers (Chrome, Edge, Firefox, Safari) and across platforms such as Windows Hello, macOS, Android, and iOS, enabling both platform and roaming authenticators.

Benefits include phishing resistance, reduced password management, and support for multi-factor setups. Limitations include deployment complexity, potential user friction during initial setup, and privacy considerations around attestation data, which can be mitigated by configuring optional attestation or relying on privacy-preserving modes.