Loading post…
OktaAlisa DuncanTutorial
We're Living in a Passwordless World
Summary
Passwords and SMS one-time passwords are presented as vulnerable authentication methods, while the post explains how FIDO and W3C standards support passwordless, phishing-resistant sign-in. It contrasts passwords, SMS OTP, TOTP, and U2F security keys, then introduces FIDO2, which combines WebAuthn with CTAP2 and asymmetric cryptography. The registration and authentication walkthrough describes the Relying Party, client, server, browser, and authenticator interactions, including device-based PINs and biometrics. Passkeys build on WebAuthn and can work across compatible browsers and devices, with migration within some vendor ecosystems described as an additional convenience. Developers can call navigator.credentials.create and navigator.credentials.get directly or use libraries, while Identity Providers such as Okta can provide FIDO2 support through configuration.
Context
The post connects the FIDO Alliance’s authentication standards with W3C’s WebAuthn web standard. It frames passkeys as an evolution beyond passwords and earlier factors such as SMS OTP, TOTP, and U2F security keys.
Approach / What changed
It explains FIDO2 authentication through WebAuthn and CTAP2, using a registration and authentication walkthrough that follows interactions among the user, browser, web application, server, relying party, and authenticator. It also identifies the Web Authentication API methods navigator.credentials.create({options}) and navigator.credentials.get({options}), and describes using an Identity Provider with FIDO2 support.
Takeaways
FIDO2 combines WebAuthn, a browser-based web authentication API, with CTAP2, a protocol for interoperability between devices and web browsers.
Passkeys use secure credentials based on asymmetric encryption and can authenticate through built-in or external hardware such as fingerprint readers, cameras, phones, watches, and security keys.
Developers can use the Web Authentication API directly or adopt a library, while an Identity Provider supporting FIDO2 can reduce application-side implementation to configuration changes.
FAQ
How do WebAuthn and CTAP2 work together in FIDO2?
WebAuthn provides the web standard and browser-based API for authentication. CTAP2 enables compatible authenticators, including built-in and external devices, to interoperate with browsers.
Are passkeys separate from WebAuthn?
The post describes passkeys as an evolution on top of WebAuthn. It also refers to the combination of WebAuthn and CTAP2 hardware devices for passwordless authentication as a passkey.
Can developers implement passkeys without calling the API directly?
Yes. Developers can use libraries available for their technology stack instead of using navigator.credentials.create and navigator.credentials.get directly.
Source and freshness
- Source
- developer.okta.com
- Published
- Added to Yomu
Summaries are generated from the original by a language model. Check the original before relying on it.
Keep reading
Related reading
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
The best engineering reads, once a week
One useful email. Unsubscribe anytime.