97 Things Every Application Security Professional Should Know

Chapter 34. Will Passwordless Authentication Save Your Application?

Aldo Salas

Web applications can use a number of different options when it comes to authentication schemes. Without a doubt, and historically, usernames and passwords have been the preferred method of authentication for the last few decades.

The shortcomings of password-based authentication have been discussed at length, and almost every week we keep hearing of a new breach that involved or resulted in a password compromise.

Passwordless and WebAuthn

Thankfully, we now have stronger authentication mechanisms, such as passwordless systems. Specifically for web applications, we now have the Web Authentication (WebAuthn) specification that uses public key cryptography in order to authenticate any given user to a web application. The Fast Identity Online (FIDO) Alliance is the association behind this specification.

WebAuthn allows consumers to use strong authenticators such as security keys, biometrics, and mobile devices to prove their identity. Essentially, WebAuthn is a set of browser-based APIs that allow web applications to authenticate users by using the aforementioned authenticators.

Most modern devices have at least one of these authenticators already built in. For instance, you can use biometrics for mobile devices (fingerprint, face recognition, etc.), Touch ID for MacOS, and Windows Hello on Microsoft devices, to name a few.

These authenticators are phishing-resistant, which means that even if a bad ...