Leading web browsers such as Google Chrome, Microsoft Edge and Mozilla Firefox have announced their support for a new web authentication standard, aimed at improving security and reducing reliance on passwords. The decision to implement the standard developed by the FIDO Alliance follows the W3C standards group approving the WebAuth system for a candidate recommendation.
WebAuthn is a standard web API to give users new methods to securely authenticate across sites and devices. It was developed by industry members in coordination with the FIDO Alliance and is a core component of the FIDO2 Project along with FIDO’s Client to Authenticator Protocol (CTAP) specification, which enables an external authenticator, such as a security key or a mobile phone, to communicate strong authentication credentials locally over USB, Bluetooth or NFC to the user’s computer or tablet.
Google, Microsoft and Mozilla have committed to supporting the WebAuthn standard in their flagship browsers and have started implementation for Windows, Mac, Linux, Chrome OS and Android platforms. Both the WebAuthn and CTAP specifications are available already for developers and vendors to start implementing support in their products. According to the standards groups, by using the new standards, enterprises and online service providers will be able to protect themselves and their customers better from the risks associated with passwords, such as phishing, man-in-the-middle attacks and the abuse of stolen credentials.
The standardization of the new FIDO2 specifications in browsers and operating systems will further expand the reach of FIDO Authentication, which is referenced by regulators and standards-setting bodies worldwide and is already available on hundreds of millions of devices and offered to more than 3.5 billion user accounts worldwide through services from companies such as Google, Facebook, NTT Docomo and Bank of America.
FIDO will soon launch interoperability testing and will issue certifications for servers, clients and authenticators adhering to FIDO2 specifications. The conformance test tools are available on FIDO’s website. Additionally, FIDO will introduce a new Universal Server certification for servers that interoperate with all FIDO authenticator types (FIDO UAF, FIDO U2F, WebAuthn, CTAP).
