The Buzz About FIDO2 and WebAuthn

This week, the FIDO Alliance and W3C, the world’s primary standards organization for the web, announced a new standard designed to bring FIDO-based biometric and hardware key authentication to Mozilla Firefox, Microsoft Edge, and the world’s most widely used browser, Google Chrome. The WebAuthn API specification is a core component of the new FIDO2 specification and has been moved to ‘Candidate Recommendation’ status by the W3C, which means it has been deemed to meet the organization’s standards and is ready for some real world test drives. Ultimately, as more developers implement these standards, it will mean that end users can take advantage of fingerprint scanners, USB keys like the YubiKey, or even a normal laptop webcam to easily and securely log into online services through a web browser.

This is big news, and accordingly, it has generated a lot of discussion:

Major stakeholders in the development have of course had some emphatic points to make:

Phillip Dunkelberger, the CEO of FIDO co-founder Nok Nok Labs, says FIDO2 and WebAuthn “will fundamentally alter the economics and accessibility of strong authentication, and we believe the security posture of the Internet as well.”

And Stina Ehrensvard, the CEO of hardware key provider Yubico, calls FIDO2 “a natural evolution” of FIDO Alliance standards that delivers “trusted, passwordless authentication for the modern and distributed workforce.”

But commentary is coming in from around the web:

The Verge‘s Russell Brandon predicts that “[a]s more open-source code is built for the new standards, it will get easier for developers to implement those logins, potentially leading to a lot more password-free logins across the web.”

TechRadar‘s Cat Ellis points out that “[t]his type authentication makes it much harder for criminals to pull off phishing attacks because there’s no consistent line of characters (like a conventional password) that provides access to your accounts.”

… And FIDO and W3C have something to say for themselves, too:

W3C CEO Jeff Jaffe says that password based security is one of the web’s “weakest links,” and that with WebAuthn “we are eliminating this weak link,” adding that the standard “will change the way that people access the web.”

Not that they’ll notice: Via email, FIDO Alliance Executive Director Brett McDowell tells Motherboard that “this will be a natural transition” for end users. “People everywhere are already using their fingers and faces to ‘unlock’ their mobile phones and PCs,” he says, “so this will be natural to them—and more convenient.”