#3581 - Web Authentication (passwordless login matching private keys on phones to public keys on websites being logged into) [passkeys]

https://venturebeat.com/2019/03/04/w3c-approves-webauthn-as-the-web-standard-for-password-free-logins/
I'm hoping this tech will be a Facebook Login, OpenID, and oAuth killer (for login purposes). Then we can move to a web standards approach, and even remove Facebook login support.
Looking at the tech, I can see this is a 'passwordless login' kind of technology, and not an identity technology. So it won't generate a username, won't provide your e-mail address, etc.
I think realistically this means it's not a Facebook Login competitor - it's not going to be able to provide one-click registrations.
Good articles:
https://www.vegard.net/webauthn/
https://webauthn.guide/

I have a feeling this tech will be stillborn. It's complex to implement, needs to work seamlessly across many new integration layers, and it seems to be anti-2FA - it's not trying to supplement passwords, but remove them. That means access to your phone+unlock-code becomes a key to everywhere.
I think regular 2FA is a better bet, then we can implement this if it looks like all the big players are adopting it.
Here is the draft version of the webauth spec:
https://w3c.github.io/webauthn/

There is also another spec which allows login using encryption keys:
https://w3c.github.io/vc-data-model/
The Passkey launch by large companies has largely been talked about as a failure. I haven't time to dig into that now, but there have been many standardized technologies over the years that just haven't panned out and this may be another one of them. Look at adoption/success rates before seriously considering implementing this.
What seems to be getting popular instead is reframing regular username/password login as "Log in with email", and then having "Log in with Google" etc as equal top-level log in choices (as opposed to alternative log in forms).
0 guests and 0 members have recently viewed this.