4 ms·
WebAuthn is coming. In fact, it's actually already here. There are only two things it needs before it can start to take over the world: a cross-browser, cross-p
by Ajedi32 8y ago
WebAuthn is coming. In fact, it's actually already here. There are only two things it needs before it can start to take over the world: a cross-browser, cross-platform implementation with synced credentials, and server-side implementations from a few large companies like Google and Facebook.
A cross-browser, cross-platform implementation with synced credentials will solve the one remaining usability issue WebAuthn has; the need for users to register every device with the site they want to sign up on. It's not acceptable for users to sign up on their PCs and then have to jump through a bunch of hoops to sign in on their phones; and bootstrapping with passwords eliminates many of the benefits of Web Authn.
Implementations from major companies will solve the chicken-egg problem that Troy mentions. Once the system is commonplace, smaller sites will be less hesitant to jump on board with an authentication solution that's different from the password-based one that users are used to.
- quickben 8y agoAnd that too, won't be a password killer. Heck almost 20 years ago Nortel had something better than what you described, and still we have passwords around. Everything old is new again, today we are solving passwords with X, tomorrow with Y, etc.
- Ajedi32 8y agoWebauthn is a web standard; not a proprietary product by a company I've never heard of. Whatever it was Nortel had, I highly doubt it was as usable or ubiquitous as what WebAuthn already is.
- creeble 8y agoDoesn't WebAuthn require hardware? I can't find any user examples that don't mention a phone or yubikey or whatever.
- detaro 8y agoNo, it doesn't. It's the most advertised scenario, but a software application could act as an Authenticator too. The spec explicitly mentions platform authenticators that just require a PIN as a possibility.