#3581 - Web Authentication (passwordless login matching private keys on phones to public keys on websites being logged into) [passkeys]
| Identifier | #3581 |
|---|---|
| Issue type | Feature request or suggestion |
| Title | Web Authentication (passwordless login matching private keys on phones to public keys on websites being logged into) [passkeys] |
| Status | Open |
| Tags |
Type: Security (custom) Type: Standards compliance (custom) |
| Handling member | Deleted |
| Addon | core |
| Description | There's a new W3C "web authentication" spec, that has moved to candidate recommendation stage.
It will be a way of logging into sites direct from your web browser. Update tut_webapp to reference the specs. |
| Steps to reproduce | |
| Additional information | It's coming soon to Firefox and Edge. |
| Related to | #974 - Implement oAuth login framework |
| Funded? | No |
The system will post a comment when this issue is modified (e.g., status changes). To be notified of this, click "Enable comment notifications".


Comments
I think realistically this means it's not a Facebook Login competitor - it's not going to be able to provide one-click registrations.
https://www.vegard.net/webauthn/
https://webauthn.guide/
I think regular 2FA is a better bet, then we can implement this if it looks like all the big players are adopting it.
https://w3c.github.io/webauthn/
There is also another spec which allows login using encryption keys:
https://w3c.github.io/vc-data-model/
What seems to be getting popular instead is reframing regular username/password login as "Log in with email", and then having "Log in with Google" etc as equal top-level log in choices (as opposed to alternative log in forms).