Elvis Wiki - User contributions [en]

WebAuthn

2020-12-23T02:45:28Z

JTraumueller: /* Architecture */

[[File:webauthn_logo.PNG|500px|thumb|WebAuthn logo]]

== Summary ==

WebAuthn is an Application created by the FIDO (Fast Identity Online) alliance and the W3C (World Wide Web Consortium) to offer the possibility of passwordless authentication online. The latest recommendation is of March 2019 published by the W3C. Instead WebAuthn work either with the inbuild Authenticator of the device, such as fingerprint sensor or facial recognition, or with an extern media like an USB Stick for verification.

== Goal ==
Its purpose is to offer a more secure and easy possibility to log into your online accounts without storing or remembering huge amounts of passwords to prevent the possibility of passwords getting leaked or forgotten.

== Architecture <ref name="overview" /> ==

[[File:FIDO2-WebAuthn_Architecture.PNG|thumb|600px|FIDO2/WebAuthn Architecture<ref name="overview" />]]

;''' Authenticator '''
The authenticator creates credentials, generates cryptographic proof of user authentication and administrate the PIN.

There are two types of authenticators:

*external authenticator (e.g. security key) that is removable from the device
*internal authenticator (e.g. fingerprint reader) that is implemented on the device

;'''Client/Platform'''
The client implements CTAP2 and client-side WebAuthn API and proves the validity of the identity of the Relying Party to prevent phishing attacks.
The client could be a browser for web applications or an operating system subsystem that offers a platform-specific FIDO API for mobile or desktop apps.

;'''Relying Party (RP)'''
The Relying Party consists of at least one webserver, the server-side parts of the WebAuthn API and a WebAuthn Server, that has a trust store.
The trust store contains the public trust parts for the attestation of the authenticator.

== Functionality ==
WebAuthn works with two ceremonies:

'''The Registration:'''
The Registration involves a Relying Party, the server that hosts the Website, and the user client that must host at least one authenticator. To register, the user has to navigate to the website where he wishes to use Web Authentication and sign in using the method that was used to this point, which means for example a password. After that it is to choose to register this site from now an using Web Authentication, which leads to the request to submit the configures authorization gesture. When the provided gesture is accepted, the registrations is complete.

'''The Authentication:'''
For the user, the authentication using the Web Authenticator works seemingly as a normal login with just the difference that instead of typing a password to verify its identity, the user uses the same Authentication gesture that he used to register to the site.

== Examples ==
=== Login WebAuthn test website ===
[[File:webauthn_1.PNG|400px]]

First you have to navigate to the Website where you want to change the default login to WebAuthn, in this case it is the test website of WebAuthn, the link is provided below, so we create a new user and pick the option PMT for we are going to use the inbuilt fingerprint sensor of the laptop to verify our identity.

[[File:webauthn2.PNG|300px]]

The security feature now asks us to verify the identity with the same Authenticatior you want to use every time you log into the website. The choice will be stored with your ID and used every time you login.

[[File:webauthn3.PNG|600px]]

The login was a scucess and now we are able to login just using our fingerprint.

[[File:webauthn4.PNG|300px]]

You are ask to provide the same authentication which you used to login, in this case the fingerprint.

[[File:webauthn5.PNG|800px]]

If everything goes well, you are now logged in just using a fingerprint sensor!

----
Try it yourself if you want to!
[https://webauthn.io/ WebAuthn Demo]

----

=== Passwordless Login ===
This example shows how to add a security key to the Microsoft account and how to log in to the account without a username and password.

A passwordless login to the MS account was tested with the following in every possible combination (OS+Browser+Security Key):

{| class="wikitable"
|-
! scope="col"| Operating System
! scope="col"| Browser
! scope="col"| Security Key
! scope="col"| Successful
|-
| Windows 10
| Google Chrome Microsoft Edge Mozilla Firefox Opera
| [[Yubico Security Key]] [[Yubikey 5 C]] [[Yubikey 5 NFC]] [https://www.yubico.com/at/product/yubikey-5c-nfc/ Yubikey 5C NFC]
| Yes
|-
| Android 9
| Google Chrome Microsoft Edge Mozilla Firefox Opera
| Security Keys are not supported to login to the MS account
| No
|}

Assumption: one has a Microsoft account but has not yet added a security key

1. Sign in with your '''username''' and '''password'''.

2. Go to '''''Security>Advanced Security Options'''''.

3. Click on '''''Add a new way to sign in or verify'''''.
[[File:FIDO2-WebAuthn_pwless_1.PNG|none|800px|]]
 

4. The window shows the additional options to verify or sign in. Select '''''Use a security key'''''.
[[File:FIDO2-WebAuthn_pwless_2.PNG|none|300px]]
 

5. Read the instruction for your prefered method (USB or NFC) to register the security key. In this example USB was chosen.
[[File:FIDO2-WebAuthn_pwless_3.PNG|none|600px]]
 

6. Enter the PIN.
[[File:FIDO2-WebAuthn_pwless_pin.png|none|300px]]
 

7. Touch the button of the security key.
[[File:FIDO2-WebAuthn_pwless_touch.PNG|none|300px]]
 

8. Name the added security key. It is recommended to add more than one security key. Naming the security keys helps to distinguish them.
[[File:FIDO2-WebAuthn_pwless_keyname.PNG|none|300px]]
 

9. The key is now registered.
[[File:FIDO2-WebAuthn_pwless_finish.png|none|500px]]
 

No username and password are needed for the next login with the added key.
 

'''Login:''' 
1. Select '''''Sign in with a security key'''''.
[[File:FIDO2-WebAuthn_pwless_login.PNG|none|300px]]
 

2. Enter the PIN.
[[File:FIDO2-WebAuthn_pwless_login_pin.PNG|none|300px]]
 

3. Touch the button of the security key.
[[File:FIDO2-WebAuthn_pwless_login_touch.PNG|none|300px]]
 

If these steps were successful, the user is logged in.

----

=== Second Factor Login ===

This example shows how to add a security key to the Google account and how to log in to the account with the second factor method.

The second factor login to the Google account was tested with the following in every possible combination (OS+Browser+Security Key):

{| class="wikitable"
|-
! scope="col"| Operating System
! scope="col"| Browser
! scope="col"| Security Key
! scope="col"| Successful
|-
| Windows 10
| Google Chrome Microsoft Edge Mozilla Firefox Opera
| [[Yubico Security Key]] [[Yubikey 5 C]] [[Yubikey 5 NFC]] [https://www.yubico.com/at/product/yubikey-5c-nfc/ Yubikey 5C NFC]
| Yes
|-
| rowspan="3"|Android 9
| rowspan="2"|Google Chrome
| [[Yubico Security Key]] (USB A and no NFC)
| No
|-
|[[Yubikey 5 C]] [[Yubikey 5 NFC]] [https://www.yubico.com/at/product/yubikey-5c-nfc/ Yubikey 5C NFC]
| Yes
|-
| Microsoft Edge Mozilla Firefox Opera
| Security Keys are not supported on this device or in this browser
| No
|}

Assumption: one has a Google account but has not yet added a security key

1. Sign in with '''username''' and '''password'''.

2. Click on the profile on the top right and select '''''Manage your Google Account'''''.

3. Go to '''''Security'''''.

4. Select '''''2-Step Verification'''''.
[[File:FIDO2_2Step_1.PNG|none|500px]]
 

5. Enter your '''password'''.

6. Google shows the options that can be used for the 2-Step Verification. Choose '''''ADD SECURITY KEY'''''.
[[File:FIDO2_2Step_2.PNG|none|500px]]
 

7. Get your security key and select '''''Next''''' to continue the process.
[[File:FIDO2_2Step_3.PNG|none|300px]]
 

8. Insert the security key into the USB port.
[[File:FIDO2_2Step_4.PNG|none|300px]]
 

9. Tap on the button of the security key.
[[File:FIDO2_2Step_5.PNG|none|300px]]
 

10. Name the security key (optional)
[[File:FIDO2_2Step_6.PNG|none|300px]]
 

11. The key is registered now.
[[File:FIDO2_2Step_7.PNG|none|500px]]
 

'''Login:'''

1. Enter your '''username'''.

2. Enter your '''password'''-

3. Tap on the security key
[[File:FIDO2_2Step_login_1.PNG|none|300px]]
 

4. Select '''''Next''''' to finish the process. Optionally, you can select if the security key on this device should no longer be used for logging in to the Google account.
[[File:FIDO2_2Step_login_2.PNG|none|300px]]
 

== References ==

* https://webauthn.guide/#about-webauthn
* https://www.w3.org/TR/webauthn/#intro

<references>
<ref name="overview">https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Guide/Overview.html</ref>
</references>

[[Category:Documentation]]

WebAuthn

2020-12-23T02:39:40Z

JTraumueller: /* Passwordless Login */

[[File:webauthn_logo.PNG|500px|thumb|WebAuthn logo]]

== Summary ==

WebAuthn is an Application created by the FIDO (Fast Identity Online) alliance and the W3C (World Wide Web Consortium) to offer the possibility of passwordless authentication online. The latest recommendation is of March 2019 published by the W3C. Instead WebAuthn work either with the inbuild Authenticator of the device, such as fingerprint sensor or facial recognition, or with an extern media like an USB Stick for verification.

== Goal ==
Its purpose is to offer a more secure and easy possibility to log into your online accounts without storing or remembering huge amounts of passwords to prevent the possibility of passwords getting leaked or forgotten.

== Architecture <ref name="overview" /> ==

[[File:FIDO2-WebAuthn_Architecture.PNG|thumb|600px|FIDO2/WebAuthn Architecture<ref name="overview" />]]

;''' Authenticator '''
The authenticator creates credentials, generates cryptographic proof of user authentication and administrate the PIN.

There are two types of authenticators:

*external authenticator (e.g. security key) that is removable from the device
*internal authenticator (e.g. fingerprint reader) that is implemented on the device and is not removeable

;'''Client/Platform'''
The client implements CTAP2 and client-side WebAuthn API and proves the validity of the identity of the Relying Party to prevent phishing attacks.
The client could be a browser for web applications or an operating system subsystem that offers a platform-specific FIDO API for mobile or desktop apps.

;'''Relying Party (RP)'''
The Relying Party consists of at least one webserver, the server-side parts of the WebAuthn API and a WebAuthn Server, that has a trust store.
The trust store contains the public trust parts for the attestation of the authenticator.

== Functionality ==
WebAuthn works with two ceremonies:

'''The Registration:'''
The Registration involves a Relying Party, the server that hosts the Website, and the user client that must host at least one authenticator. To register, the user has to navigate to the website where he wishes to use Web Authentication and sign in using the method that was used to this point, which means for example a password. After that it is to choose to register this site from now an using Web Authentication, which leads to the request to submit the configures authorization gesture. When the provided gesture is accepted, the registrations is complete.

'''The Authentication:'''
For the user, the authentication using the Web Authenticator works seemingly as a normal login with just the difference that instead of typing a password to verify its identity, the user uses the same Authentication gesture that he used to register to the site.

== Examples ==
=== Login WebAuthn test website ===
[[File:webauthn_1.PNG|400px]]

First you have to navigate to the Website where you want to change the default login to WebAuthn, in this case it is the test website of WebAuthn, the link is provided below, so we create a new user and pick the option PMT for we are going to use the inbuilt fingerprint sensor of the laptop to verify our identity.

[[File:webauthn2.PNG|300px]]

The security feature now asks us to verify the identity with the same Authenticatior you want to use every time you log into the website. The choice will be stored with your ID and used every time you login.

[[File:webauthn3.PNG|600px]]

The login was a scucess and now we are able to login just using our fingerprint.

[[File:webauthn4.PNG|300px]]

You are ask to provide the same authentication which you used to login, in this case the fingerprint.

[[File:webauthn5.PNG|800px]]

If everything goes well, you are now logged in just using a fingerprint sensor!

----
Try it yourself if you want to!
[https://webauthn.io/ WebAuthn Demo]

----

=== Passwordless Login ===
This example shows how to add a security key to the Microsoft account and how to log in to the account without a username and password.

A passwordless login to the MS account was tested with the following in every possible combination (OS+Browser+Security Key):

{| class="wikitable"
|-
! scope="col"| Operating System
! scope="col"| Browser
! scope="col"| Security Key
! scope="col"| Successful
|-
| Windows 10
| Google Chrome Microsoft Edge Mozilla Firefox Opera
| [[Yubico Security Key]] [[Yubikey 5 C]] [[Yubikey 5 NFC]] [https://www.yubico.com/at/product/yubikey-5c-nfc/ Yubikey 5C NFC]
| Yes
|-
| Android 9
| Google Chrome Microsoft Edge Mozilla Firefox Opera
| Security Keys are not supported to login to the MS account
| No
|}

Assumption: one has a Microsoft account but has not yet added a security key

1. Sign in with your '''username''' and '''password'''.

2. Go to '''''Security>Advanced Security Options'''''.

3. Click on '''''Add a new way to sign in or verify'''''.
[[File:FIDO2-WebAuthn_pwless_1.PNG|none|800px|]]
 

4. The window shows the additional options to verify or sign in. Select '''''Use a security key'''''.
[[File:FIDO2-WebAuthn_pwless_2.PNG|none|300px]]
 

5. Read the instruction for your prefered method (USB or NFC) to register the security key. In this example USB was chosen.
[[File:FIDO2-WebAuthn_pwless_3.PNG|none|600px]]
 

6. Enter the PIN.
[[File:FIDO2-WebAuthn_pwless_pin.png|none|300px]]
 

7. Touch the button of the security key.
[[File:FIDO2-WebAuthn_pwless_touch.PNG|none|300px]]
 

8. Name the added security key. It is recommended to add more than one security key. Naming the security keys helps to distinguish them.
[[File:FIDO2-WebAuthn_pwless_keyname.PNG|none|300px]]
 

9. The key is now registered.
[[File:FIDO2-WebAuthn_pwless_finish.png|none|500px]]
 

No username and password are needed for the next login with the added key.
 

'''Login:''' 
1. Select '''''Sign in with a security key'''''.
[[File:FIDO2-WebAuthn_pwless_login.PNG|none|300px]]
 

2. Enter the PIN.
[[File:FIDO2-WebAuthn_pwless_login_pin.PNG|none|300px]]
 

3. Touch the button of the security key.
[[File:FIDO2-WebAuthn_pwless_login_touch.PNG|none|300px]]
 

If these steps were successful, the user is logged in.

----

=== Second Factor Login ===

This example shows how to add a security key to the Google account and how to log in to the account with the second factor method.

The second factor login to the Google account was tested with the following in every possible combination (OS+Browser+Security Key):

{| class="wikitable"
|-
! scope="col"| Operating System
! scope="col"| Browser
! scope="col"| Security Key
! scope="col"| Successful
|-
| Windows 10
| Google Chrome Microsoft Edge Mozilla Firefox Opera
| [[Yubico Security Key]] [[Yubikey 5 C]] [[Yubikey 5 NFC]] [https://www.yubico.com/at/product/yubikey-5c-nfc/ Yubikey 5C NFC]
| Yes
|-
| rowspan="3"|Android 9
| rowspan="2"|Google Chrome
| [[Yubico Security Key]] (USB A and no NFC)
| No
|-
|[[Yubikey 5 C]] [[Yubikey 5 NFC]] [https://www.yubico.com/at/product/yubikey-5c-nfc/ Yubikey 5C NFC]
| Yes
|-
| Microsoft Edge Mozilla Firefox Opera
| Security Keys are not supported on this device or in this browser
| No
|}

Assumption: one has a Google account but has not yet added a security key

1. Sign in with '''username''' and '''password'''.

2. Click on the profile on the top right and select '''''Manage your Google Account'''''.

3. Go to '''''Security'''''.

4. Select '''''2-Step Verification'''''.
[[File:FIDO2_2Step_1.PNG|none|500px]]
 

5. Enter your '''password'''.

6. Google shows the options that can be used for the 2-Step Verification. Choose '''''ADD SECURITY KEY'''''.
[[File:FIDO2_2Step_2.PNG|none|500px]]
 

7. Get your security key and select '''''Next''''' to continue the process.
[[File:FIDO2_2Step_3.PNG|none|300px]]
 

8. Insert the security key into the USB port.
[[File:FIDO2_2Step_4.PNG|none|300px]]
 

9. Tap on the button of the security key.
[[File:FIDO2_2Step_5.PNG|none|300px]]
 

10. Name the security key (optional)
[[File:FIDO2_2Step_6.PNG|none|300px]]
 

11. The key is registered now.
[[File:FIDO2_2Step_7.PNG|none|500px]]
 

'''Login:'''

1. Enter your '''username'''.

2. Enter your '''password'''-

3. Tap on the security key
[[File:FIDO2_2Step_login_1.PNG|none|300px]]
 

4. Select '''''Next''''' to finish the process. Optionally, you can select if the security key on this device should no longer be used for logging in to the Google account.
[[File:FIDO2_2Step_login_2.PNG|none|300px]]
 

== References ==

* https://webauthn.guide/#about-webauthn
* https://www.w3.org/TR/webauthn/#intro

<references>
<ref name="overview">https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Guide/Overview.html</ref>
</references>

[[Category:Documentation]]

WebAuthn

2020-12-23T02:37:33Z

JTraumueller: /* Passwordless Login */

[[File:webauthn_logo.PNG|500px|thumb|WebAuthn logo]]

== Summary ==

WebAuthn is an Application created by the FIDO (Fast Identity Online) alliance and the W3C (World Wide Web Consortium) to offer the possibility of passwordless authentication online. The latest recommendation is of March 2019 published by the W3C. Instead WebAuthn work either with the inbuild Authenticator of the device, such as fingerprint sensor or facial recognition, or with an extern media like an USB Stick for verification.

== Goal ==
Its purpose is to offer a more secure and easy possibility to log into your online accounts without storing or remembering huge amounts of passwords to prevent the possibility of passwords getting leaked or forgotten.

== Architecture <ref name="overview" /> ==

[[File:FIDO2-WebAuthn_Architecture.PNG|thumb|600px|FIDO2/WebAuthn Architecture<ref name="overview" />]]

;''' Authenticator '''
The authenticator creates credentials, generates cryptographic proof of user authentication and administrate the PIN.

There are two types of authenticators:

*external authenticator (e.g. security key) that is removable from the device
*internal authenticator (e.g. fingerprint reader) that is implemented on the device and is not removeable

;'''Client/Platform'''
The client implements CTAP2 and client-side WebAuthn API and proves the validity of the identity of the Relying Party to prevent phishing attacks.
The client could be a browser for web applications or an operating system subsystem that offers a platform-specific FIDO API for mobile or desktop apps.

;'''Relying Party (RP)'''
The Relying Party consists of at least one webserver, the server-side parts of the WebAuthn API and a WebAuthn Server, that has a trust store.
The trust store contains the public trust parts for the attestation of the authenticator.

== Functionality ==
WebAuthn works with two ceremonies:

'''The Registration:'''
The Registration involves a Relying Party, the server that hosts the Website, and the user client that must host at least one authenticator. To register, the user has to navigate to the website where he wishes to use Web Authentication and sign in using the method that was used to this point, which means for example a password. After that it is to choose to register this site from now an using Web Authentication, which leads to the request to submit the configures authorization gesture. When the provided gesture is accepted, the registrations is complete.

'''The Authentication:'''
For the user, the authentication using the Web Authenticator works seemingly as a normal login with just the difference that instead of typing a password to verify its identity, the user uses the same Authentication gesture that he used to register to the site.

== Examples ==
=== Login WebAuthn test website ===
[[File:webauthn_1.PNG|400px]]

First you have to navigate to the Website where you want to change the default login to WebAuthn, in this case it is the test website of WebAuthn, the link is provided below, so we create a new user and pick the option PMT for we are going to use the inbuilt fingerprint sensor of the laptop to verify our identity.

[[File:webauthn2.PNG|300px]]

The security feature now asks us to verify the identity with the same Authenticatior you want to use every time you log into the website. The choice will be stored with your ID and used every time you login.

[[File:webauthn3.PNG|600px]]

The login was a scucess and now we are able to login just using our fingerprint.

[[File:webauthn4.PNG|300px]]

You are ask to provide the same authentication which you used to login, in this case the fingerprint.

[[File:webauthn5.PNG|800px]]

If everything goes well, you are now logged in just using a fingerprint sensor!

----
Try it yourself if you want to!
[https://webauthn.io/ WebAuthn Demo]

----

=== Passwordless Login ===
This example shows how to add a security key to the Microsoft account and how to log in to the account without a username and password.

A passwordless login to the MS account was tested with the following in every possible combination (OS+Browser+Security Key):

{| class="wikitable"
|-
! scope="col"| Operating System
! scope="col"| Browser
! scope="col"| Security Key
! scope="col"| Successful
|-
| Windows 10
| Google Chrome Microsoft Edge Mozilla Firefox Opera
| [[Yubico Security Key]] [[Yubikey 5 C]] [[Yubikey 5 NFC]] [https://www.yubico.com/at/product/yubikey-5c-nfc/ Yubikey 5C NFC]
| Yes
|-
| Android 9
| Google Chrome Microsoft Edge Mozilla Firefox Opera
| Security Keys are not supported to login to the MS account
| No
|}

Assumption: one has a Microsoft account but has not yet added a security key

1. Sign in with your '''username''' and '''password'''.

2. Go to '''''Security>Advanced Security Options'''''.

3. Click on '''''Add a new way to sign in or verify'''''.
[[File:FIDO2-WebAuthn_pwless_1.PNG|none|800px|]]
 

4. The window shows the additional options to verify or sign in. Select '''''Use a security key'''''.
[[File:FIDO2-WebAuthn_pwless_2.PNG|none|300px]]
 

5. Read the instruction for your prefered method (USB or NFC) to register the security key. In this example USB was chosen.
[[File:FIDO2-WebAuthn_pwless_3.PNG|none|600px]]
 

6. Enter the PIN.
[[File:FIDO2-WebAuthn_pwless_pin.png|none|300px]]
 

7. Touch the button of the security key.
[[File:FIDO2-WebAuthn_pwless_touch.PNG|none|300px]]
 

8. Name the added security key. It is recommended to add more than one security key. Naming the security keys helps to distinguish them.
[[File:FIDO2-WebAuthn_pwless_keyname.PNG|none|300px]]
 

9. The key is now registered.
[[File:FIDO2-WebAuthn_pwless_finish.png|none|500px]]
 

No username and password are needed for the next login with the added key.
 

'''Login:''' 
1. Select '''''Sign in with a security key'''''.
[[File:FIDO2-WebAuthn_pwless_login.PNG|none|300px]]
 

2. Enter the PIN.
[[File:FIDO2-WebAuthn_pwless_login_pin.PNG|none|300px]]
 

3. Touch the button of the security key.
[[File:FIDO2-WebAuthn_pwless_login_touch.PNG|none|300px]]
 

If these steps were successful, the user is logged in.

----

=== Second Factor Login ===

This example shows how to add a security key to the Google account and how to log in to the account with the second factor method.

The second factor login to the Google account was tested with the following in every possible combination (OS+Browser+Security Key):

{| class="wikitable"
|-
! scope="col"| Operating System
! scope="col"| Browser
! scope="col"| Security Key
! scope="col"| Successful
|-
| Windows 10
| Google Chrome Microsoft Edge Mozilla Firefox Opera
| [[Yubico Security Key]] [[Yubikey 5 C]] [[Yubikey 5 NFC]] [https://www.yubico.com/at/product/yubikey-5c-nfc/ Yubikey 5C NFC]
| Yes
|-
| rowspan="3"|Android 9
| rowspan="2"|Google Chrome
| [[Yubico Security Key]] (USB A and no NFC)
| No
|-
|[[Yubikey 5 C]] [[Yubikey 5 NFC]] [https://www.yubico.com/at/product/yubikey-5c-nfc/ Yubikey 5C NFC]
| Yes
|-
| Microsoft Edge Mozilla Firefox Opera
| Security Keys are not supported on this device or in this browser
| No
|}

Assumption: one has a Google account but has not yet added a security key

1. Sign in with '''username''' and '''password'''.

2. Click on the profile on the top right and select '''''Manage your Google Account'''''.

3. Go to '''''Security'''''.

4. Select '''''2-Step Verification'''''.
[[File:FIDO2_2Step_1.PNG|none|500px]]
 

5. Enter your '''password'''.

6. Google shows the options that can be used for the 2-Step Verification. Choose '''''ADD SECURITY KEY'''''.
[[File:FIDO2_2Step_2.PNG|none|500px]]
 

7. Get your security key and select '''''Next''''' to continue the process.
[[File:FIDO2_2Step_3.PNG|none|300px]]
 

8. Insert the security key into the USB port.
[[File:FIDO2_2Step_4.PNG|none|300px]]
 

9. Tap on the button of the security key.
[[File:FIDO2_2Step_5.PNG|none|300px]]
 

10. Name the security key (optional)
[[File:FIDO2_2Step_6.PNG|none|300px]]
 

11. The key is registered now.
[[File:FIDO2_2Step_7.PNG|none|500px]]
 

'''Login:'''

1. Enter your '''username'''.

2. Enter your '''password'''-

3. Tap on the security key
[[File:FIDO2_2Step_login_1.PNG|none|300px]]
 

4. Select '''''Next''''' to finish the process. Optionally, you can select if the security key on this device should no longer be used for logging in to the Google account.
[[File:FIDO2_2Step_login_2.PNG|none|300px]]
 

== References ==

* https://webauthn.guide/#about-webauthn
* https://www.w3.org/TR/webauthn/#intro

<references>
<ref name="overview">https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Guide/Overview.html</ref>
</references>

[[Category:Documentation]]

WebAuthn

2020-12-23T02:29:40Z

JTraumueller: /* Second Factor Login */

[[File:webauthn_logo.PNG|500px|thumb|WebAuthn logo]]

== Summary ==

WebAuthn is an Application created by the FIDO (Fast Identity Online) alliance and the W3C (World Wide Web Consortium) to offer the possibility of passwordless authentication online. The latest recommendation is of March 2019 published by the W3C. Instead WebAuthn work either with the inbuild Authenticator of the device, such as fingerprint sensor or facial recognition, or with an extern media like an USB Stick for verification.

== Goal ==
Its purpose is to offer a more secure and easy possibility to log into your online accounts without storing or remembering huge amounts of passwords to prevent the possibility of passwords getting leaked or forgotten.

== Architecture <ref name="overview" /> ==

[[File:FIDO2-WebAuthn_Architecture.PNG|thumb|600px|FIDO2/WebAuthn Architecture<ref name="overview" />]]

;''' Authenticator '''
The authenticator creates credentials, generates cryptographic proof of user authentication and administrate the PIN.

There are two types of authenticators:

*external authenticator (e.g. security key) that is removable from the device
*internal authenticator (e.g. fingerprint reader) that is implemented on the device and is not removeable

;'''Client/Platform'''
The client implements CTAP2 and client-side WebAuthn API and proves the validity of the identity of the Relying Party to prevent phishing attacks.
The client could be a browser for web applications or an operating system subsystem that offers a platform-specific FIDO API for mobile or desktop apps.

;'''Relying Party (RP)'''
The Relying Party consists of at least one webserver, the server-side parts of the WebAuthn API and a WebAuthn Server, that has a trust store.
The trust store contains the public trust parts for the attestation of the authenticator.

== Functionality ==
WebAuthn works with two ceremonies:

'''The Registration:'''
The Registration involves a Relying Party, the server that hosts the Website, and the user client that must host at least one authenticator. To register, the user has to navigate to the website where he wishes to use Web Authentication and sign in using the method that was used to this point, which means for example a password. After that it is to choose to register this site from now an using Web Authentication, which leads to the request to submit the configures authorization gesture. When the provided gesture is accepted, the registrations is complete.

'''The Authentication:'''
For the user, the authentication using the Web Authenticator works seemingly as a normal login with just the difference that instead of typing a password to verify its identity, the user uses the same Authentication gesture that he used to register to the site.

== Examples ==
=== Login WebAuthn test website ===
[[File:webauthn_1.PNG|400px]]

First you have to navigate to the Website where you want to change the default login to WebAuthn, in this case it is the test website of WebAuthn, the link is provided below, so we create a new user and pick the option PMT for we are going to use the inbuilt fingerprint sensor of the laptop to verify our identity.

[[File:webauthn2.PNG|300px]]

The security feature now asks us to verify the identity with the same Authenticatior you want to use every time you log into the website. The choice will be stored with your ID and used every time you login.

[[File:webauthn3.PNG|600px]]

The login was a scucess and now we are able to login just using our fingerprint.

[[File:webauthn4.PNG|300px]]

You are ask to provide the same authentication which you used to login, in this case the fingerprint.

[[File:webauthn5.PNG|800px]]

If everything goes well, you are now logged in just using a fingerprint sensor!

----
Try it yourself if you want to!
[https://webauthn.io/ WebAuthn Demo]

----

=== Passwordless Login ===
This example shows how to add a security key to the Microsoft account and how to log in to the account without a username and password.

A passwordless login to the MS account was tested with the following in every possible combination (OS+Browser+Security Key):

{| class="wikitable"
|-
! scope="col"| Operating System
! scope="col"| Browser
! scope="col"| Security Key
! scope="col"| Successful
|-
| Windows 10
| Google Chrome Microsoft Edge Mozilla Firefox Opera
| [[Yubico Security Key]] [[Yubikey 5 C]] [[Yubikey 5 NFC]] [https://www.yubico.com/at/product/yubikey-5c-nfc/ Yubikey 5C NFC]
| Yes
|-
| Android 9
| Google Chrome Microsoft Edge Mozilla Firefox Opera
| Security Keys are not supported to login to the MS account
| No
|}

Assumption: one has a Microsoft account but has not yet added a security key

1. Sign in with username and password.

2. Go to '''''Security>Advanced Security Options'''''.

3. Click on '''''Add a new way to sign in or verify'''''.
[[File:FIDO2-WebAuthn_pwless_1.PNG|none|800px|]]
 
4. A window shows the additional options to verify or sign in. Select '''''Use a security key'''''.
[[File:FIDO2-WebAuthn_pwless_2.PNG|none|300px]]
 
5. Read the instruction for your prefered method (USB or NFC) to register the security key. In this example USB was chosen.
[[File:FIDO2-WebAuthn_pwless_3.PNG|none|600px]]
 
6. Enter the PIN.
[[File:FIDO2-WebAuthn_pwless_pin.png|none|300px]]
 
7. Touch the button of the security key.
[[File:FIDO2-WebAuthn_pwless_touch.PNG|none|300px]]
 
8. Name the added security key. It is recommended to add more than one security key. Naming the security keys helps to distinguish them.
[[File:FIDO2-WebAuthn_pwless_keyname.PNG|none|300px]]
 
9. The key is now registered.
[[File:FIDO2-WebAuthn_pwless_finish.png|none|500px]]
 
No username and password are needed for the next login with the added key.
 

'''Login:''' 
1. Select '''''Sign in with a security key'''''.
[[File:FIDO2-WebAuthn_pwless_login.PNG|none|300px]]
 
2. Enter the PIN.
[[File:FIDO2-WebAuthn_pwless_login_pin.PNG|none|300px]]
 
3. Touch the button of the security key.
[[File:FIDO2-WebAuthn_pwless_login_touch.PNG|none|300px]]
 

If these steps were successful, the user is logged in.

----

=== Second Factor Login ===

This example shows how to add a security key to the Google account and how to log in to the account with the second factor method.

The second factor login to the Google account was tested with the following in every possible combination (OS+Browser+Security Key):

{| class="wikitable"
|-
! scope="col"| Operating System
! scope="col"| Browser
! scope="col"| Security Key
! scope="col"| Successful
|-
| Windows 10
| Google Chrome Microsoft Edge Mozilla Firefox Opera
| [[Yubico Security Key]] [[Yubikey 5 C]] [[Yubikey 5 NFC]] [https://www.yubico.com/at/product/yubikey-5c-nfc/ Yubikey 5C NFC]
| Yes
|-
| rowspan="3"|Android 9
| rowspan="2"|Google Chrome
| [[Yubico Security Key]] (USB A and no NFC)
| No
|-
|[[Yubikey 5 C]] [[Yubikey 5 NFC]] [https://www.yubico.com/at/product/yubikey-5c-nfc/ Yubikey 5C NFC]
| Yes
|-
| Microsoft Edge Mozilla Firefox Opera
| Security Keys are not supported on this device or in this browser
| No
|}

Assumption: one has a Google account but has not yet added a security key

1. Sign in with '''username''' and '''password'''.

2. Click on the profile on the top right and select '''''Manage your Google Account'''''.

3. Go to '''''Security'''''.

4. Select '''''2-Step Verification'''''.
[[File:FIDO2_2Step_1.PNG|none|500px]]
 

5. Enter your '''password'''.

6. Google shows the options that can be used for the 2-Step Verification. Choose '''''ADD SECURITY KEY'''''.
[[File:FIDO2_2Step_2.PNG|none|500px]]
 

7. Get your security key and select '''''Next''''' to continue the process.
[[File:FIDO2_2Step_3.PNG|none|300px]]
 

8. Insert the security key into the USB port.
[[File:FIDO2_2Step_4.PNG|none|300px]]
 

9. Tap on the button of the security key.
[[File:FIDO2_2Step_5.PNG|none|300px]]
 

10. Name the security key (optional)
[[File:FIDO2_2Step_6.PNG|none|300px]]
 

11. The key is registered now.
[[File:FIDO2_2Step_7.PNG|none|500px]]
 

'''Login:'''

1. Enter your '''username'''.

2. Enter your '''password'''-

3. Tap on the security key
[[File:FIDO2_2Step_login_1.PNG|none|300px]]
 

4. Select '''''Next''''' to finish the process. Optionally, you can select if the security key on this device should no longer be used for logging in to the Google account.
[[File:FIDO2_2Step_login_2.PNG|none|300px]]
 

== References ==

* https://webauthn.guide/#about-webauthn
* https://www.w3.org/TR/webauthn/#intro

<references>
<ref name="overview">https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Guide/Overview.html</ref>
</references>

[[Category:Documentation]]

WebAuthn

2020-12-23T02:28:20Z

JTraumueller: /* Second Factor Login */

[[File:webauthn_logo.PNG|500px|thumb|WebAuthn logo]]

== Summary ==

WebAuthn is an Application created by the FIDO (Fast Identity Online) alliance and the W3C (World Wide Web Consortium) to offer the possibility of passwordless authentication online. The latest recommendation is of March 2019 published by the W3C. Instead WebAuthn work either with the inbuild Authenticator of the device, such as fingerprint sensor or facial recognition, or with an extern media like an USB Stick for verification.

== Goal ==
Its purpose is to offer a more secure and easy possibility to log into your online accounts without storing or remembering huge amounts of passwords to prevent the possibility of passwords getting leaked or forgotten.

== Architecture <ref name="overview" /> ==

[[File:FIDO2-WebAuthn_Architecture.PNG|thumb|600px|FIDO2/WebAuthn Architecture<ref name="overview" />]]

;''' Authenticator '''
The authenticator creates credentials, generates cryptographic proof of user authentication and administrate the PIN.

There are two types of authenticators:

*external authenticator (e.g. security key) that is removable from the device
*internal authenticator (e.g. fingerprint reader) that is implemented on the device and is not removeable

;'''Client/Platform'''
The client implements CTAP2 and client-side WebAuthn API and proves the validity of the identity of the Relying Party to prevent phishing attacks.
The client could be a browser for web applications or an operating system subsystem that offers a platform-specific FIDO API for mobile or desktop apps.

;'''Relying Party (RP)'''
The Relying Party consists of at least one webserver, the server-side parts of the WebAuthn API and a WebAuthn Server, that has a trust store.
The trust store contains the public trust parts for the attestation of the authenticator.

== Functionality ==
WebAuthn works with two ceremonies:

'''The Registration:'''
The Registration involves a Relying Party, the server that hosts the Website, and the user client that must host at least one authenticator. To register, the user has to navigate to the website where he wishes to use Web Authentication and sign in using the method that was used to this point, which means for example a password. After that it is to choose to register this site from now an using Web Authentication, which leads to the request to submit the configures authorization gesture. When the provided gesture is accepted, the registrations is complete.

'''The Authentication:'''
For the user, the authentication using the Web Authenticator works seemingly as a normal login with just the difference that instead of typing a password to verify its identity, the user uses the same Authentication gesture that he used to register to the site.

== Examples ==
=== Login WebAuthn test website ===
[[File:webauthn_1.PNG|400px]]

First you have to navigate to the Website where you want to change the default login to WebAuthn, in this case it is the test website of WebAuthn, the link is provided below, so we create a new user and pick the option PMT for we are going to use the inbuilt fingerprint sensor of the laptop to verify our identity.

[[File:webauthn2.PNG|300px]]

The security feature now asks us to verify the identity with the same Authenticatior you want to use every time you log into the website. The choice will be stored with your ID and used every time you login.

[[File:webauthn3.PNG|600px]]

The login was a scucess and now we are able to login just using our fingerprint.

[[File:webauthn4.PNG|300px]]

You are ask to provide the same authentication which you used to login, in this case the fingerprint.

[[File:webauthn5.PNG|800px]]

If everything goes well, you are now logged in just using a fingerprint sensor!

----
Try it yourself if you want to!
[https://webauthn.io/ WebAuthn Demo]

----

=== Passwordless Login ===
This example shows how to add a security key to the Microsoft account and how to log in to the account without a username and password.

A passwordless login to the MS account was tested with the following in every possible combination (OS+Browser+Security Key):

{| class="wikitable"
|-
! scope="col"| Operating System
! scope="col"| Browser
! scope="col"| Security Key
! scope="col"| Successful
|-
| Windows 10
| Google Chrome Microsoft Edge Mozilla Firefox Opera
| [[Yubico Security Key]] [[Yubikey 5 C]] [[Yubikey 5 NFC]] [https://www.yubico.com/at/product/yubikey-5c-nfc/ Yubikey 5C NFC]
| Yes
|-
| Android 9
| Google Chrome Microsoft Edge Mozilla Firefox Opera
| Security Keys are not supported to login to the MS account
| No
|}

Assumption: one has a Microsoft account but has not yet added a security key

1. Sign in with username and password.

2. Go to '''''Security>Advanced Security Options'''''.

3. Click on '''''Add a new way to sign in or verify'''''.
[[File:FIDO2-WebAuthn_pwless_1.PNG|none|800px|]]
 
4. A window shows the additional options to verify or sign in. Select '''''Use a security key'''''.
[[File:FIDO2-WebAuthn_pwless_2.PNG|none|300px]]
 
5. Read the instruction for your prefered method (USB or NFC) to register the security key. In this example USB was chosen.
[[File:FIDO2-WebAuthn_pwless_3.PNG|none|600px]]
 
6. Enter the PIN.
[[File:FIDO2-WebAuthn_pwless_pin.png|none|300px]]
 
7. Touch the button of the security key.
[[File:FIDO2-WebAuthn_pwless_touch.PNG|none|300px]]
 
8. Name the added security key. It is recommended to add more than one security key. Naming the security keys helps to distinguish them.
[[File:FIDO2-WebAuthn_pwless_keyname.PNG|none|300px]]
 
9. The key is now registered.
[[File:FIDO2-WebAuthn_pwless_finish.png|none|500px]]
 
No username and password are needed for the next login with the added key.
 

'''Login:''' 
1. Select '''''Sign in with a security key'''''.
[[File:FIDO2-WebAuthn_pwless_login.PNG|none|300px]]
 
2. Enter the PIN.
[[File:FIDO2-WebAuthn_pwless_login_pin.PNG|none|300px]]
 
3. Touch the button of the security key.
[[File:FIDO2-WebAuthn_pwless_login_touch.PNG|none|300px]]
 

If these steps were successful, the user is logged in.

----

=== Second Factor Login ===

This example shows how to add a security key to the Google account and how to log in to the account with the second factor method.

The second factor login to the Google account was tested with the following in every possible combination (OS+Browser+Security Key):

{| class="wikitable"
|-
! scope="col"| Operating System
! scope="col"| Browser
! scope="col"| Security Key
! scope="col"| Successful
|-
| Windows 10
| Google Chrome Microsoft Edge Mozilla Firefox Opera
| [[Yubico Security Key]] [[Yubikey 5 C]] [[Yubikey 5 NFC]] [https://www.yubico.com/at/product/yubikey-5c-nfc/ Yubikey 5C NFC]
| Yes
|-
| rowspan="3"|Android 9
| rowspan="2"|Google Chrome
| [[Yubico Security Key]] (USB A and no NFC)
| No
|-
|[[Yubikey 5 C]] [[Yubikey 5 NFC]] [https://www.yubico.com/at/product/yubikey-5c-nfc/ Yubikey 5C NFC]
| Yes
|-
| Microsoft Edge Mozilla Firefox Opera
| Security Keys are not supported on this device or in this browser
| No
|}

Assumption: one has a Google account but has not yet added a security key

1. Sign in with '''username''' and '''password'''.

2. Click on the profile on the top right and select '''''Manage your Google Account'''''.

3. Go to '''''Security'''''.

4. Select '''''2-Step Verification'''''.
[[File:FIDO2_2Step_1.PNG|none|500px]]
 

5. Enter your '''password'''.

6. Google shows options that can be used for the 2-Step Verification. Choose '''''ADD SECURITY KEY'''''.
[[File:FIDO2_2Step_2.PNG|none|500px]]
 

7. Get your security key and select '''''Next''''' to continue the process.
[[File:FIDO2_2Step_3.PNG|none|300px]]
 

8. Insert the security key into the USB port.
[[File:FIDO2_2Step_4.PNG|none|300px]]
 

9. Tap on the button of the security key.
[[File:FIDO2_2Step_5.PNG|none|300px]]
 

10. Name the security key (optional)
[[File:FIDO2_2Step_6.PNG|none|300px]]
 

11. The key is registered now.
[[File:FIDO2_2Step_7.PNG|none|500px]]
 

'''Login:'''

1. Enter your '''username'''.

2. Enter your '''password'''-

3. Tap on the security key
[[File:FIDO2_2Step_login_1.PNG|none|300px]]
 

4. Select '''''Next''''' to finish the process. Optionally, you can select if the security key on this device should no longer be used for logging in to the Google account.
[[File:FIDO2_2Step_login_2.PNG|none|300px]]
 

== References ==

* https://webauthn.guide/#about-webauthn
* https://www.w3.org/TR/webauthn/#intro

<references>
<ref name="overview">https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Guide/Overview.html</ref>
</references>

[[Category:Documentation]]

WebAuthn

2020-12-23T00:31:30Z

JTraumueller: /* Second Factor Login */

[[File:webauthn_logo.PNG|500px|thumb|WebAuthn logo]]

== Summary ==

WebAuthn is an Application created by the FIDO (Fast Identity Online) alliance and the W3C (World Wide Web Consortium) to offer the possibility of passwordless authentication online. The latest recommendation is of March 2019 published by the W3C. Instead WebAuthn work either with the inbuild Authenticator of the device, such as fingerprint sensor or facial recognition, or with an extern media like an USB Stick for verification.

== Goal ==
Its purpose is to offer a more secure and easy possibility to log into your online accounts without storing or remembering huge amounts of passwords to prevent the possibility of passwords getting leaked or forgotten.

== Architecture <ref name="overview" /> ==

[[File:FIDO2-WebAuthn_Architecture.PNG|thumb|600px|FIDO2/WebAuthn Architecture<ref name="overview" />]]

;''' Authenticator '''
The authenticator creates credentials, generates cryptographic proof of user authentication and administrate the PIN.

There are two types of authenticators:

*external authenticator (e.g. security key) that is removable from the device
*internal authenticator (e.g. fingerprint reader) that is implemented on the device and is not removeable

;'''Client/Platform'''
The client implements CTAP2 and client-side WebAuthn API and proves the validity of the identity of the Relying Party to prevent phishing attacks.
The client could be a browser for web applications or an operating system subsystem that offers a platform-specific FIDO API for mobile or desktop apps.

;'''Relying Party (RP)'''
The Relying Party consists of at least one webserver, the server-side parts of the WebAuthn API and a WebAuthn Server, that has a trust store.
The trust store contains the public trust parts for the attestation of the authenticator.

== Functionality ==
WebAuthn works with two ceremonies:

'''The Registration:'''
The Registration involves a Relying Party, the server that hosts the Website, and the user client that must host at least one authenticator. To register, the user has to navigate to the website where he wishes to use Web Authentication and sign in using the method that was used to this point, which means for example a password. After that it is to choose to register this site from now an using Web Authentication, which leads to the request to submit the configures authorization gesture. When the provided gesture is accepted, the registrations is complete.

'''The Authentication:'''
For the user, the authentication using the Web Authenticator works seemingly as a normal login with just the difference that instead of typing a password to verify its identity, the user uses the same Authentication gesture that he used to register to the site.

== Examples ==
=== Login WebAuthn test website ===
[[File:webauthn_1.PNG|400px]]

First you have to navigate to the Website where you want to change the default login to WebAuthn, in this case it is the test website of WebAuthn, the link is provided below, so we create a new user and pick the option PMT for we are going to use the inbuilt fingerprint sensor of the laptop to verify our identity.

[[File:webauthn2.PNG|300px]]

The security feature now asks us to verify the identity with the same Authenticatior you want to use every time you log into the website. The choice will be stored with your ID and used every time you login.

[[File:webauthn3.PNG|600px]]

The login was a scucess and now we are able to login just using our fingerprint.

[[File:webauthn4.PNG|300px]]

You are ask to provide the same authentication which you used to login, in this case the fingerprint.

[[File:webauthn5.PNG|800px]]

If everything goes well, you are now logged in just using a fingerprint sensor!

----
Try it yourself if you want to!
[https://webauthn.io/ WebAuthn Demo]

----

=== Passwordless Login ===
This example shows how to add a security key to the Microsoft account and how to log in to the account without a username and password.

A passwordless login to the MS account was tested with the following in every possible combination (OS+Browser+Security Key):

{| class="wikitable"
|-
! scope="col"| Operating System
! scope="col"| Browser
! scope="col"| Security Key
! scope="col"| Successful
|-
| Windows 10
| Google Chrome Microsoft Edge Mozilla Firefox Opera
| [[Yubico Security Key]] [[Yubikey 5 C]] [[Yubikey 5 NFC]] [https://www.yubico.com/at/product/yubikey-5c-nfc/ Yubikey 5C NFC]
| Yes
|-
| Android 9
| Google Chrome Microsoft Edge Mozilla Firefox Opera
| Security Keys are not supported to login to the MS account
| No
|}

Assumption: one has a Microsoft account but has not yet added a security key

1. Sign in with username and password.

2. Go to '''''Security>Advanced Security Options'''''.

3. Click on '''''Add a new way to sign in or verify'''''.
[[File:FIDO2-WebAuthn_pwless_1.PNG|none|800px|]]
 
4. A window shows the additional options to verify or sign in. Select '''''Use a security key'''''.
[[File:FIDO2-WebAuthn_pwless_2.PNG|none|300px]]
 
5. Read the instruction for your prefered method (USB or NFC) to register the security key. In this example USB was chosen.
[[File:FIDO2-WebAuthn_pwless_3.PNG|none|600px]]
 
6. Enter the PIN.
[[File:FIDO2-WebAuthn_pwless_pin.png|none|300px]]
 
7. Touch the button of the security key.
[[File:FIDO2-WebAuthn_pwless_touch.PNG|none|300px]]
 
8. Name the added security key. It is recommended to add more than one security key. Naming the security keys helps to distinguish them.
[[File:FIDO2-WebAuthn_pwless_keyname.PNG|none|300px]]
 
9. The key is now registered.
[[File:FIDO2-WebAuthn_pwless_finish.png|none|500px]]
 
No username and password are needed for the next login with the added key.
 

'''Login:''' 
1. Select '''''Sign in with a security key'''''.
[[File:FIDO2-WebAuthn_pwless_login.PNG|none|300px]]
 
2. Enter the PIN.
[[File:FIDO2-WebAuthn_pwless_login_pin.PNG|none|300px]]
 
3. Touch the button of the security key.
[[File:FIDO2-WebAuthn_pwless_login_touch.PNG|none|300px]]
 

If these steps were successful, the user is logged in.

----

=== Second Factor Login ===

This example shows how to add a security key to the Google account and how to log in to the account with the second factor method.

The second factor login to the Google account was tested with the following in every possible combination (OS+Browser+Security Key):

{| class="wikitable"
|-
! scope="col"| Operating System
! scope="col"| Browser
! scope="col"| Security Key
! scope="col"| Successful
|-
| Windows 10
| Google Chrome Microsoft Edge Mozilla Firefox Opera
| [[Yubico Security Key]] [[Yubikey 5 C]] [[Yubikey 5 NFC]] [https://www.yubico.com/at/product/yubikey-5c-nfc/ Yubikey 5C NFC]
| Yes
|-
| rowspan="3"|Android 9
| rowspan="2"|Google Chrome
| [[Yubico Security Key]] (USB A and no NFC)
| No
|-
|[[Yubikey 5 C]] [[Yubikey 5 NFC]] [https://www.yubico.com/at/product/yubikey-5c-nfc/ Yubikey 5C NFC]
| Yes
|-
| Microsoft Edge Mozilla Firefox Opera
| Security Keys are not supported on this device or in this browser
| No
|}

Assumption: one has a Google account but has not yet added a security key

1. Sign in with '''username''' and '''password'''.

2. Click on the profile on the top right and select '''''Manage your Google Account'''''.

3. Go to '''''Security'''''.

4. Select '''''2-Step Verification'''''.
[[File:FIDO2_2Step_1.PNG|none|500px]]
 

5. Enter your '''password'''.

6. Google shows options that can be used for the 2-Step Verification. Choose '''''ADD SECURITY KEY'''''.
[[File:FIDO2_2Step_2.PNG|none|500px]]
 

7. Get your security key and select '''''Next''''' to continue the process.
[[File:FIDO2_2Step_3.PNG|none|300px]]
 

8. Insert the security key into the USB port.
[[File:FIDO2_2Step_4.PNG|none|300px]]
 

9. Tap on the button of the security key.
[[File:FIDO2_2Step_5.PNG|none|300px]]
 

10. Name the security key (optional)
[[File:FIDO2_2Step_6.PNG|none|300px]]
 

11. The key is registered now.
[[File:FIDO2_2Step_7.PNG|none|500px]]
 

'''Login:'''

1. Choose your Google account and enter your password

2. Touch the button on the security key.

3.

== References ==

* https://webauthn.guide/#about-webauthn
* https://www.w3.org/TR/webauthn/#intro

<references>
<ref name="overview">https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Guide/Overview.html</ref>
</references>

[[Category:Documentation]]

WebAuthn

2020-12-23T00:01:20Z

JTraumueller: /* Second Factor Login */

[[File:webauthn_logo.PNG|500px|thumb|WebAuthn logo]]

== Summary ==

WebAuthn is an Application created by the FIDO (Fast Identity Online) alliance and the W3C (World Wide Web Consortium) to offer the possibility of passwordless authentication online. The latest recommendation is of March 2019 published by the W3C. Instead WebAuthn work either with the inbuild Authenticator of the device, such as fingerprint sensor or facial recognition, or with an extern media like an USB Stick for verification.

== Goal ==
Its purpose is to offer a more secure and easy possibility to log into your online accounts without storing or remembering huge amounts of passwords to prevent the possibility of passwords getting leaked or forgotten.

== Architecture <ref name="overview" /> ==

[[File:FIDO2-WebAuthn_Architecture.PNG|thumb|600px|FIDO2/WebAuthn Architecture<ref name="overview" />]]

;''' Authenticator '''
The authenticator creates credentials, generates cryptographic proof of user authentication and administrate the PIN.

There are two types of authenticators:

*external authenticator (e.g. security key) that is removable from the device
*internal authenticator (e.g. fingerprint reader) that is implemented on the device and is not removeable

;'''Client/Platform'''
The client implements CTAP2 and client-side WebAuthn API and proves the validity of the identity of the Relying Party to prevent phishing attacks.
The client could be a browser for web applications or an operating system subsystem that offers a platform-specific FIDO API for mobile or desktop apps.

;'''Relying Party (RP)'''
The Relying Party consists of at least one webserver, the server-side parts of the WebAuthn API and a WebAuthn Server, that has a trust store.
The trust store contains the public trust parts for the attestation of the authenticator.

== Functionality ==
WebAuthn works with two ceremonies:

'''The Registration:'''
The Registration involves a Relying Party, the server that hosts the Website, and the user client that must host at least one authenticator. To register, the user has to navigate to the website where he wishes to use Web Authentication and sign in using the method that was used to this point, which means for example a password. After that it is to choose to register this site from now an using Web Authentication, which leads to the request to submit the configures authorization gesture. When the provided gesture is accepted, the registrations is complete.

'''The Authentication:'''
For the user, the authentication using the Web Authenticator works seemingly as a normal login with just the difference that instead of typing a password to verify its identity, the user uses the same Authentication gesture that he used to register to the site.

== Examples ==
=== Login WebAuthn test website ===
[[File:webauthn_1.PNG|400px]]

First you have to navigate to the Website where you want to change the default login to WebAuthn, in this case it is the test website of WebAuthn, the link is provided below, so we create a new user and pick the option PMT for we are going to use the inbuilt fingerprint sensor of the laptop to verify our identity.

[[File:webauthn2.PNG|300px]]

The security feature now asks us to verify the identity with the same Authenticatior you want to use every time you log into the website. The choice will be stored with your ID and used every time you login.

[[File:webauthn3.PNG|600px]]

The login was a scucess and now we are able to login just using our fingerprint.

[[File:webauthn4.PNG|300px]]

You are ask to provide the same authentication which you used to login, in this case the fingerprint.

[[File:webauthn5.PNG|800px]]

If everything goes well, you are now logged in just using a fingerprint sensor!

----
Try it yourself if you want to!
[https://webauthn.io/ WebAuthn Demo]

----

=== Passwordless Login ===
This example shows how to add a security key to the Microsoft account and how to log in to the account without a username and password.

A passwordless login to the MS account was tested with the following in every possible combination (OS+Browser+Security Key):

{| class="wikitable"
|-
! scope="col"| Operating System
! scope="col"| Browser
! scope="col"| Security Key
! scope="col"| Successful
|-
| Windows 10
| Google Chrome Microsoft Edge Mozilla Firefox Opera
| [[Yubico Security Key]] [[Yubikey 5 C]] [[Yubikey 5 NFC]] [https://www.yubico.com/at/product/yubikey-5c-nfc/ Yubikey 5C NFC]
| Yes
|-
| Android 9
| Google Chrome Microsoft Edge Mozilla Firefox Opera
| Security Keys are not supported to login to the MS account
| No
|}

Assumption: one has a Microsoft account but has not yet added a security key

1. Sign in with username and password.

2. Go to '''''Security>Advanced Security Options'''''.

3. Click on '''''Add a new way to sign in or verify'''''.
[[File:FIDO2-WebAuthn_pwless_1.PNG|none|800px|]]
 
4. A window shows the additional options to verify or sign in. Select '''''Use a security key'''''.
[[File:FIDO2-WebAuthn_pwless_2.PNG|none|300px]]
 
5. Read the instruction for your prefered method (USB or NFC) to register the security key. In this example USB was chosen.
[[File:FIDO2-WebAuthn_pwless_3.PNG|none|600px]]
 
6. Enter the PIN.
[[File:FIDO2-WebAuthn_pwless_pin.png|none|300px]]
 
7. Touch the button of the security key.
[[File:FIDO2-WebAuthn_pwless_touch.PNG|none|300px]]
 
8. Name the added security key. It is recommended to add more than one security key. Naming the security keys helps to distinguish them.
[[File:FIDO2-WebAuthn_pwless_keyname.PNG|none|300px]]
 
9. The key is now registered.
[[File:FIDO2-WebAuthn_pwless_finish.png|none|500px]]
 
No username and password are needed for the next login with the added key.
 

'''Login:''' 
1. Select '''''Sign in with a security key'''''.
[[File:FIDO2-WebAuthn_pwless_login.PNG|none|300px]]
 
2. Enter the PIN.
[[File:FIDO2-WebAuthn_pwless_login_pin.PNG|none|300px]]
 
3. Touch the button of the security key.
[[File:FIDO2-WebAuthn_pwless_login_touch.PNG|none|300px]]
 

If these steps were successful, the user is logged in.

----

=== Second Factor Login ===

This example shows how to add a security key to the Google account and how to log in to the account with the second factor method.

The second factor login to the Google account was tested with the following in every possible combination (OS+Browser+Security Key):

{| class="wikitable"
|-
! scope="col"| Operating System
! scope="col"| Browser
! scope="col"| Security Key
! scope="col"| Successful
|-
| Windows 10
| Google Chrome Microsoft Edge Mozilla Firefox Opera
| [[Yubico Security Key]] [[Yubikey 5 C]] [[Yubikey 5 NFC]] [https://www.yubico.com/at/product/yubikey-5c-nfc/ Yubikey 5C NFC]
| Yes
|-
| rowspan="3"|Android 9
| rowspan="2"|Google Chrome
| [[Yubico Security Key]] (USB A and no NFC)
| No
|-
|[[Yubikey 5 C]] [[Yubikey 5 NFC]] [https://www.yubico.com/at/product/yubikey-5c-nfc/ Yubikey 5C NFC]
| Yes
|-
| Microsoft Edge Mozilla Firefox Opera
| Security Keys are not supported on this device or in this browser
| No
|}

Assumption: one has a Google account but has not yet added a security key

1. Sign in with '''username''' and '''password'''.

2. Click on the profile on the top right and select '''''Manage your Google Account'''''.

3. Go to '''''Security'''''.

4. Select '''''2-Step Verification'''''.
[[File:FIDO2_2Step_1.PNG|none|500px]]
 

5. Enter your '''password'''.

6. Google shows options that can be used for the 2-Step Verification. Choose '''''ADD SECURITY KEY'''''.
[[File:FIDO2_2Step_2.PNG|none|500px]]
 

7. Get your security key and select '''''Next''''' to continue the process.
[[File:FIDO2_2Step_3.PNG|none|300px]]
 

8. Insert the security key into the USB port.
[[File:FIDO2_2Step_4.PNG|none|300px]]
 

9. Tap on the button of the security key.
[[File:FIDO2_2Step_5.PNG|none|300px]]
 

10. Name the security key (optional)
[[File:FIDO2_2Step_6.PNG|none|300px]]
 

11.
[[File:FIDO2_2Step_7.PNG|none|500px]]
 

Login:

1. Choose your Google account and enter your password

2. Touch the button on the security key.

3.

== References ==

* https://webauthn.guide/#about-webauthn
* https://www.w3.org/TR/webauthn/#intro

<references>
<ref name="overview">https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Guide/Overview.html</ref>
</references>

[[Category:Documentation]]

File:FIDO2 2Step 7.PNG

2020-12-22T23:40:46Z

JTraumueller: added security key (Google account)

== Summary ==
added security key (Google account)

File:FIDO2 2Step login 2.PNG

2020-12-22T23:38:51Z

JTraumueller: Login: sucess (Google account)

== Summary ==
Login: sucess (Google account)

File:FIDO2 2Step login 1.PNG

2020-12-22T23:37:36Z

JTraumueller: Login: request tap the security key (Google account)

== Summary ==
Login: request tap the security key (Google account)

File:FIDO2 2Step 6.PNG

2020-12-22T23:36:17Z

JTraumueller: Naming security key (Google account)

== Summary ==
Naming security key (Google account)

File:FIDO2 2Step 5.PNG

2020-12-22T23:35:35Z

JTraumueller: Request to tap the security key (Google account)

== Summary ==
Request to tap the security key (Google account)

File:FIDO2 2Step 4.PNG

2020-12-22T23:34:31Z

JTraumueller: Request to insert the security key (Google account)

== Summary ==
Request to insert the security key (Google account)

File:FIDO2 2Step 3.PNG

2020-12-22T23:31:40Z

JTraumueller: Got your security key? (Google account)

== Summary ==
Got your security key? (Google account)

File:FIDO2 2Step 2.PNG

2020-12-22T23:30:25Z

JTraumueller: Add security key (Google account)

== Summary ==
Add security key (Google account)

File:FIDO2 2Step 1.PNG

2020-12-22T23:28:09Z

JTraumueller: Select 2-Step Verification on Google account

== Summary ==
Select 2-Step Verification on Google account

WebAuthn

2020-12-22T23:24:24Z

JTraumueller: /* Second Factor Login */

[[File:webauthn_logo.PNG|500px|thumb|WebAuthn logo]]

== Summary ==

WebAuthn is an Application created by the FIDO (Fast Identity Online) alliance and the W3C (World Wide Web Consortium) to offer the possibility of passwordless authentication online. The latest recommendation is of March 2019 published by the W3C. Instead WebAuthn work either with the inbuild Authenticator of the device, such as fingerprint sensor or facial recognition, or with an extern media like an USB Stick for verification.

== Goal ==
Its purpose is to offer a more secure and easy possibility to log into your online accounts without storing or remembering huge amounts of passwords to prevent the possibility of passwords getting leaked or forgotten.

== Architecture <ref name="overview" /> ==

[[File:FIDO2-WebAuthn_Architecture.PNG|thumb|600px|FIDO2/WebAuthn Architecture<ref name="overview" />]]

;''' Authenticator '''
The authenticator creates credentials, generates cryptographic proof of user authentication and administrate the PIN.

There are two types of authenticators:

*external authenticator (e.g. security key) that is removable from the device
*internal authenticator (e.g. fingerprint reader) that is implemented on the device and is not removeable

;'''Client/Platform'''
The client implements CTAP2 and client-side WebAuthn API and proves the validity of the identity of the Relying Party to prevent phishing attacks.
The client could be a browser for web applications or an operating system subsystem that offers a platform-specific FIDO API for mobile or desktop apps.

;'''Relying Party (RP)'''
The Relying Party consists of at least one webserver, the server-side parts of the WebAuthn API and a WebAuthn Server, that has a trust store.
The trust store contains the public trust parts for the attestation of the authenticator.

== Functionality ==
WebAuthn works with two ceremonies:

'''The Registration:'''
The Registration involves a Relying Party, the server that hosts the Website, and the user client that must host at least one authenticator. To register, the user has to navigate to the website where he wishes to use Web Authentication and sign in using the method that was used to this point, which means for example a password. After that it is to choose to register this site from now an using Web Authentication, which leads to the request to submit the configures authorization gesture. When the provided gesture is accepted, the registrations is complete.

'''The Authentication:'''
For the user, the authentication using the Web Authenticator works seemingly as a normal login with just the difference that instead of typing a password to verify its identity, the user uses the same Authentication gesture that he used to register to the site.

== Examples ==
=== Login WebAuthn test website ===
[[File:webauthn_1.PNG|400px]]

First you have to navigate to the Website where you want to change the default login to WebAuthn, in this case it is the test website of WebAuthn, the link is provided below, so we create a new user and pick the option PMT for we are going to use the inbuilt fingerprint sensor of the laptop to verify our identity.

[[File:webauthn2.PNG|300px]]

The security feature now asks us to verify the identity with the same Authenticatior you want to use every time you log into the website. The choice will be stored with your ID and used every time you login.

[[File:webauthn3.PNG|600px]]

The login was a scucess and now we are able to login just using our fingerprint.

[[File:webauthn4.PNG|300px]]

You are ask to provide the same authentication which you used to login, in this case the fingerprint.

[[File:webauthn5.PNG|800px]]

If everything goes well, you are now logged in just using a fingerprint sensor!

----
Try it yourself if you want to!
[https://webauthn.io/ WebAuthn Demo]

----

=== Passwordless Login ===
This example shows how to add a security key to the Microsoft account and how to log in to the account without a username and password.

A passwordless login to the MS account was tested with the following in every possible combination (OS+Browser+Security Key):

{| class="wikitable"
|-
! scope="col"| Operating System
! scope="col"| Browser
! scope="col"| Security Key
! scope="col"| Successful
|-
| Windows 10
| Google Chrome Microsoft Edge Mozilla Firefox Opera
| [[Yubico Security Key]] [[Yubikey 5 C]] [[Yubikey 5 NFC]] [https://www.yubico.com/at/product/yubikey-5c-nfc/ Yubikey 5C NFC]
| Yes
|-
| Android 9
| Google Chrome Microsoft Edge Mozilla Firefox Opera
| Security Keys are not supported to login to the MS account
| No
|}

Assumption: one has a Microsoft account but has not yet added a security key

1. Sign in with username and password.

2. Go to '''''Security>Advanced Security Options'''''.

3. Click on '''''Add a new way to sign in or verify'''''.
[[File:FIDO2-WebAuthn_pwless_1.PNG|none|800px|]]
 
4. A window shows the additional options to verify or sign in. Select '''''Use a security key'''''.
[[File:FIDO2-WebAuthn_pwless_2.PNG|none|300px]]
 
5. Read the instruction for your prefered method (USB or NFC) to register the security key. In this example USB was chosen.
[[File:FIDO2-WebAuthn_pwless_3.PNG|none|600px]]
 
6. Enter the PIN.
[[File:FIDO2-WebAuthn_pwless_pin.png|none|300px]]
 
7. Touch the button of the security key.
[[File:FIDO2-WebAuthn_pwless_touch.PNG|none|300px]]
 
8. Name the added security key. It is recommended to add more than one security key. Naming the security keys helps to distinguish them.
[[File:FIDO2-WebAuthn_pwless_keyname.PNG|none|300px]]
 
9. The key is now registered.
[[File:FIDO2-WebAuthn_pwless_finish.png|none|500px]]
 
No username and password are needed for the next login with the added key.
 

'''Login:''' 
1. Select '''''Sign in with a security key'''''.
[[File:FIDO2-WebAuthn_pwless_login.PNG|none|300px]]
 
2. Enter the PIN.
[[File:FIDO2-WebAuthn_pwless_login_pin.PNG|none|300px]]
 
3. Touch the button of the security key.
[[File:FIDO2-WebAuthn_pwless_login_touch.PNG|none|300px]]
 

If these steps were successful, the user is logged in.

=== Second Factor Login ===

This example shows how to add a security key to the Google account and how to log in to the account with the second factor method.

The second factor login to the Google account was tested with the following in every possible combination (OS+Browser+Security Key):

{| class="wikitable"
|-
! scope="col"| Operating System
! scope="col"| Browser
! scope="col"| Security Key
! scope="col"| Successful
|-
| Windows 10
| Google Chrome Microsoft Edge Mozilla Firefox Opera
| [[Yubico Security Key]] [[Yubikey 5 C]] [[Yubikey 5 NFC]] [https://www.yubico.com/at/product/yubikey-5c-nfc/ Yubikey 5C NFC]
| Yes
|-
| rowspan="3"|Android 9
| rowspan="2"|Google Chrome
| [[Yubico Security Key]] (USB A and no NFC)
| No
|-
|[[Yubikey 5 C]] [[Yubikey 5 NFC]] [https://www.yubico.com/at/product/yubikey-5c-nfc/ Yubikey 5C NFC]
| Yes
|-
| Microsoft Edge Mozilla Firefox Opera
| Security Keys are not supported on this device or in this browser
| No
|}

Assumption: one has a Google account but has not yet added a security key

1. Sign in with username and password.

2. Click on the profile on the top right and select '''''Manage your Google Account'''''.

3. Go to '''''Security'''''.

4. Select '''''2-Step Verification'''''.

5. Enter your password.

6. Google shows options that can be used for the 2-Step Verification. Choose '''''ADD SECURITY KEY'''''.

7. Get your security key and select '''''Next''''' to continue the process.

8. Insert the security key into the USB port.

9. Tap on the button of the security key.

10. Name the security key (optional)

11.

Login:

1. Choose your Google account and enter your password

2. Touch the button on the security key.

3.

== References ==

* https://webauthn.guide/#about-webauthn
* https://www.w3.org/TR/webauthn/#intro

<references>
<ref name="overview">https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Guide/Overview.html</ref>
</references>

[[Category:Documentation]]

WebAuthn

2020-12-22T23:08:39Z

JTraumueller: /* Passwordless Login */

[[File:webauthn_logo.PNG|500px|thumb|WebAuthn logo]]

== Summary ==

WebAuthn is an Application created by the FIDO (Fast Identity Online) alliance and the W3C (World Wide Web Consortium) to offer the possibility of passwordless authentication online. The latest recommendation is of March 2019 published by the W3C. Instead WebAuthn work either with the inbuild Authenticator of the device, such as fingerprint sensor or facial recognition, or with an extern media like an USB Stick for verification.

== Goal ==
Its purpose is to offer a more secure and easy possibility to log into your online accounts without storing or remembering huge amounts of passwords to prevent the possibility of passwords getting leaked or forgotten.

== Architecture <ref name="overview" /> ==

[[File:FIDO2-WebAuthn_Architecture.PNG|thumb|600px|FIDO2/WebAuthn Architecture<ref name="overview" />]]

;''' Authenticator '''
The authenticator creates credentials, generates cryptographic proof of user authentication and administrate the PIN.

There are two types of authenticators:

*external authenticator (e.g. security key) that is removable from the device
*internal authenticator (e.g. fingerprint reader) that is implemented on the device and is not removeable

;'''Client/Platform'''
The client implements CTAP2 and client-side WebAuthn API and proves the validity of the identity of the Relying Party to prevent phishing attacks.
The client could be a browser for web applications or an operating system subsystem that offers a platform-specific FIDO API for mobile or desktop apps.

;'''Relying Party (RP)'''
The Relying Party consists of at least one webserver, the server-side parts of the WebAuthn API and a WebAuthn Server, that has a trust store.
The trust store contains the public trust parts for the attestation of the authenticator.

== Functionality ==
WebAuthn works with two ceremonies:

'''The Registration:'''
The Registration involves a Relying Party, the server that hosts the Website, and the user client that must host at least one authenticator. To register, the user has to navigate to the website where he wishes to use Web Authentication and sign in using the method that was used to this point, which means for example a password. After that it is to choose to register this site from now an using Web Authentication, which leads to the request to submit the configures authorization gesture. When the provided gesture is accepted, the registrations is complete.

'''The Authentication:'''
For the user, the authentication using the Web Authenticator works seemingly as a normal login with just the difference that instead of typing a password to verify its identity, the user uses the same Authentication gesture that he used to register to the site.

== Examples ==
=== Login WebAuthn test website ===
[[File:webauthn_1.PNG|400px]]

First you have to navigate to the Website where you want to change the default login to WebAuthn, in this case it is the test website of WebAuthn, the link is provided below, so we create a new user and pick the option PMT for we are going to use the inbuilt fingerprint sensor of the laptop to verify our identity.

[[File:webauthn2.PNG|300px]]

The security feature now asks us to verify the identity with the same Authenticatior you want to use every time you log into the website. The choice will be stored with your ID and used every time you login.

[[File:webauthn3.PNG|600px]]

The login was a scucess and now we are able to login just using our fingerprint.

[[File:webauthn4.PNG|300px]]

You are ask to provide the same authentication which you used to login, in this case the fingerprint.

[[File:webauthn5.PNG|800px]]

If everything goes well, you are now logged in just using a fingerprint sensor!

----
Try it yourself if you want to!
[https://webauthn.io/ WebAuthn Demo]

----

=== Passwordless Login ===
This example shows how to add a security key to the Microsoft account and how to log in to the account without a username and password.

A passwordless login to the MS account was tested with the following in every possible combination (OS+Browser+Security Key):

{| class="wikitable"
|-
! scope="col"| Operating System
! scope="col"| Browser
! scope="col"| Security Key
! scope="col"| Successful
|-
| Windows 10
| Google Chrome Microsoft Edge Mozilla Firefox Opera
| [[Yubico Security Key]] [[Yubikey 5 C]] [[Yubikey 5 NFC]] [https://www.yubico.com/at/product/yubikey-5c-nfc/ Yubikey 5C NFC]
| Yes
|-
| Android 9
| Google Chrome Microsoft Edge Mozilla Firefox Opera
| Security Keys are not supported to login to the MS account
| No
|}

Assumption: one has a Microsoft account but has not yet added a security key

1. Sign in with username and password.

2. Go to '''''Security>Advanced Security Options'''''.

3. Click on '''''Add a new way to sign in or verify'''''.
[[File:FIDO2-WebAuthn_pwless_1.PNG|none|800px|]]
 
4. A window shows the additional options to verify or sign in. Select '''''Use a security key'''''.
[[File:FIDO2-WebAuthn_pwless_2.PNG|none|300px]]
 
5. Read the instruction for your prefered method (USB or NFC) to register the security key. In this example USB was chosen.
[[File:FIDO2-WebAuthn_pwless_3.PNG|none|600px]]
 
6. Enter the PIN.
[[File:FIDO2-WebAuthn_pwless_pin.png|none|300px]]
 
7. Touch the button of the security key.
[[File:FIDO2-WebAuthn_pwless_touch.PNG|none|300px]]
 
8. Name the added security key. It is recommended to add more than one security key. Naming the security keys helps to distinguish them.
[[File:FIDO2-WebAuthn_pwless_keyname.PNG|none|300px]]
 
9. The key is now registered.
[[File:FIDO2-WebAuthn_pwless_finish.png|none|500px]]
 
No username and password are needed for the next login with the added key.
 

'''Login:''' 
1. Select '''''Sign in with a security key'''''.
[[File:FIDO2-WebAuthn_pwless_login.PNG|none|300px]]
 
2. Enter the PIN.
[[File:FIDO2-WebAuthn_pwless_login_pin.PNG|none|300px]]
 
3. Touch the button of the security key.
[[File:FIDO2-WebAuthn_pwless_login_touch.PNG|none|300px]]
 

If these steps were successful, the user is logged in.

=== Second Factor Login ===

This example shows how to add a security key to the Google account and how to log in to the account with the second factor method.

The second factor login to the Google account was tested with the following in every possible combination (OS+Browser+Security Key):

{| class="wikitable"
|-
! scope="col"| Operating System
! scope="col"| Browser
! scope="col"| Security Key
! scope="col"| Successful
|-
| Windows 10
| Google Chrome Microsoft Edge Mozilla Firefox Opera
| [[Yubico Security Key]] [[Yubikey 5 C]] [[Yubikey 5 NFC]] [https://www.yubico.com/at/product/yubikey-5c-nfc/ Yubikey 5C NFC]
| Yes
|-
| rowspan="3"|Android 9
| rowspan="2"|Google Chrome
| [[Yubico Security Key]] (USB A and no NFC)
| No
|-
|[[Yubikey 5 C]] [[Yubikey 5 NFC]] [https://www.yubico.com/at/product/yubikey-5c-nfc/ Yubikey 5C NFC]
| Yes
|-
| Microsoft Edge Mozilla Firefox Opera
| Security Keys are not supported on this device or in this browser
| No
|}

Assumption: one has a Google account but has not yet added a security key

1. Sign in with username and password

2. Click on the profile on the top right and select '''''Manage your Google Account'''''

3. Go to '''''Security'''''

4. Select '''''2-Step Verification'''''

5. Enter your password

6. Google shows options that can be used for the 2-Step Verification. Choose '''''ADD SECURITY KEY'''''

7. Get your security key and select '''''Next''''' to continue the process

8. Insert the security key into the USB port

9.

Login:

1. Choose your Google account and enter your password

2. Touch the button on the security key.

== References ==

* https://webauthn.guide/#about-webauthn
* https://www.w3.org/TR/webauthn/#intro

<references>
<ref name="overview">https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Guide/Overview.html</ref>
</references>

[[Category:Documentation]]

WebAuthn

2020-12-22T23:07:58Z

JTraumueller: /* Passwordless Login */

[[File:webauthn_logo.PNG|500px|thumb|WebAuthn logo]]

== Summary ==

WebAuthn is an Application created by the FIDO (Fast Identity Online) alliance and the W3C (World Wide Web Consortium) to offer the possibility of passwordless authentication online. The latest recommendation is of March 2019 published by the W3C. Instead WebAuthn work either with the inbuild Authenticator of the device, such as fingerprint sensor or facial recognition, or with an extern media like an USB Stick for verification.

== Goal ==
Its purpose is to offer a more secure and easy possibility to log into your online accounts without storing or remembering huge amounts of passwords to prevent the possibility of passwords getting leaked or forgotten.

== Architecture <ref name="overview" /> ==

[[File:FIDO2-WebAuthn_Architecture.PNG|thumb|600px|FIDO2/WebAuthn Architecture<ref name="overview" />]]

;''' Authenticator '''
The authenticator creates credentials, generates cryptographic proof of user authentication and administrate the PIN.

There are two types of authenticators:

*external authenticator (e.g. security key) that is removable from the device
*internal authenticator (e.g. fingerprint reader) that is implemented on the device and is not removeable

;'''Client/Platform'''
The client implements CTAP2 and client-side WebAuthn API and proves the validity of the identity of the Relying Party to prevent phishing attacks.
The client could be a browser for web applications or an operating system subsystem that offers a platform-specific FIDO API for mobile or desktop apps.

;'''Relying Party (RP)'''
The Relying Party consists of at least one webserver, the server-side parts of the WebAuthn API and a WebAuthn Server, that has a trust store.
The trust store contains the public trust parts for the attestation of the authenticator.

== Functionality ==
WebAuthn works with two ceremonies:

'''The Registration:'''
The Registration involves a Relying Party, the server that hosts the Website, and the user client that must host at least one authenticator. To register, the user has to navigate to the website where he wishes to use Web Authentication and sign in using the method that was used to this point, which means for example a password. After that it is to choose to register this site from now an using Web Authentication, which leads to the request to submit the configures authorization gesture. When the provided gesture is accepted, the registrations is complete.

'''The Authentication:'''
For the user, the authentication using the Web Authenticator works seemingly as a normal login with just the difference that instead of typing a password to verify its identity, the user uses the same Authentication gesture that he used to register to the site.

== Examples ==
=== Login WebAuthn test website ===
[[File:webauthn_1.PNG|400px]]

First you have to navigate to the Website where you want to change the default login to WebAuthn, in this case it is the test website of WebAuthn, the link is provided below, so we create a new user and pick the option PMT for we are going to use the inbuilt fingerprint sensor of the laptop to verify our identity.

[[File:webauthn2.PNG|300px]]

The security feature now asks us to verify the identity with the same Authenticatior you want to use every time you log into the website. The choice will be stored with your ID and used every time you login.

[[File:webauthn3.PNG|600px]]

The login was a scucess and now we are able to login just using our fingerprint.

[[File:webauthn4.PNG|300px]]

You are ask to provide the same authentication which you used to login, in this case the fingerprint.

[[File:webauthn5.PNG|800px]]

If everything goes well, you are now logged in just using a fingerprint sensor!

----
Try it yourself if you want to!
[https://webauthn.io/ WebAuthn Demo]

----

=== Passwordless Login ===
This example shows how to add a security key to the Microsoft account and how to log in to the account without a username and password.

A passwordless login to the MS account was tested with the following in every possible combination (OS+Browser+Security Key):

{| class="wikitable"
|-
! scope="col"| Operating System
! scope="col"| Browser
! scope="col"| Security Key
! scope="col"| Successful
|-
| Windows 10
| Google Chrome Microsoft Edge Mozilla Firefox Opera
| [[Yubico Security Key]] [[Yubikey 5 C]] [[Yubikey 5 NFC]] [https://www.yubico.com/at/product/yubikey-5c-nfc/ Yubikey 5C NFC]
| Yes
|-
| Android 9
| Google Chrome Microsoft Edge Mozilla Firefox Opera
| Security Keys are not supported to login to the MS account
| No
|}

Assumption: one has a Microsoft account but has not yet added a security key

1. Sign in with username and password.

2. Go to '''''Security>Advanced Security Options'''''.

3. Click on '''''Add a new way to sign in or verify'''''.
[[File:FIDO2-WebAuthn_pwless_1.PNG|none|800px|]]
 
4. A window shows the additional options to verify or sign in. Select '''''Use a security key'''''.
[[File:FIDO2-WebAuthn_pwless_2.PNG|none|300px]]
 
5. Read the instruction for your prefered method (USB or NFC) to register the security key. In this example USB was chosen.
[[File:FIDO2-WebAuthn_pwless_3.PNG|none|600px]]
 
6. Enter the PIN.
[[File:FIDO2-WebAuthn_pwless_pin.png|none|300px]]
 
7. Touch the button of the security key.
[[File:FIDO2-WebAuthn_pwless_touch.PNG|none|300px]]
 
8. Name the added security key. It is recommended to add more than one security key. Naming the security keys helps to distinguish them.
[[File:FIDO2-WebAuthn_pwless_keyname.PNG|none|300px]]
 
9. The key is now registered.
[[File:FIDO2-WebAuthn_pwless_finish.png|none|500px]]
 
No username and password are needed for the next login with the added key.
 

'''Login:''' 
1. Select '''''Sign in with a security key'''''.
[[File:FIDO2-WebAuthn_pwless_login.PNG|none|300px]]
 
2. Touch the button of the security key.
[[File:FIDO2-WebAuthn_pwless_login_touch.PNG|none|300px]]
 
3. Enter the PIN.
[[File:FIDO2-WebAuthn_pwless_login_pin.PNG|none|300px]]
 
4. Touch the button of the security key.
[[File:FIDO2-WebAuthn_pwless_login_touch.PNG|none|300px]]
 

If these steps were successful, the user is logged in.

=== Second Factor Login ===

This example shows how to add a security key to the Google account and how to log in to the account with the second factor method.

The second factor login to the Google account was tested with the following in every possible combination (OS+Browser+Security Key):

{| class="wikitable"
|-
! scope="col"| Operating System
! scope="col"| Browser
! scope="col"| Security Key
! scope="col"| Successful
|-
| Windows 10
| Google Chrome Microsoft Edge Mozilla Firefox Opera
| [[Yubico Security Key]] [[Yubikey 5 C]] [[Yubikey 5 NFC]] [https://www.yubico.com/at/product/yubikey-5c-nfc/ Yubikey 5C NFC]
| Yes
|-
| rowspan="3"|Android 9
| rowspan="2"|Google Chrome
| [[Yubico Security Key]] (USB A and no NFC)
| No
|-
|[[Yubikey 5 C]] [[Yubikey 5 NFC]] [https://www.yubico.com/at/product/yubikey-5c-nfc/ Yubikey 5C NFC]
| Yes
|-
| Microsoft Edge Mozilla Firefox Opera
| Security Keys are not supported on this device or in this browser
| No
|}

Assumption: one has a Google account but has not yet added a security key

1. Sign in with username and password

2. Click on the profile on the top right and select '''''Manage your Google Account'''''

3. Go to '''''Security'''''

4. Select '''''2-Step Verification'''''

5. Enter your password

6. Google shows options that can be used for the 2-Step Verification. Choose '''''ADD SECURITY KEY'''''

7. Get your security key and select '''''Next''''' to continue the process

8. Insert the security key into the USB port

9.

Login:

1. Choose your Google account and enter your password

2. Touch the button on the security key.

== References ==

* https://webauthn.guide/#about-webauthn
* https://www.w3.org/TR/webauthn/#intro

<references>
<ref name="overview">https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Guide/Overview.html</ref>
</references>

[[Category:Documentation]]

WebAuthn

2020-12-22T23:05:53Z

JTraumueller: /* Second Factor Login */

[[File:webauthn_logo.PNG|500px|thumb|WebAuthn logo]]

== Summary ==

WebAuthn is an Application created by the FIDO (Fast Identity Online) alliance and the W3C (World Wide Web Consortium) to offer the possibility of passwordless authentication online. The latest recommendation is of March 2019 published by the W3C. Instead WebAuthn work either with the inbuild Authenticator of the device, such as fingerprint sensor or facial recognition, or with an extern media like an USB Stick for verification.

== Goal ==
Its purpose is to offer a more secure and easy possibility to log into your online accounts without storing or remembering huge amounts of passwords to prevent the possibility of passwords getting leaked or forgotten.

== Architecture <ref name="overview" /> ==

[[File:FIDO2-WebAuthn_Architecture.PNG|thumb|600px|FIDO2/WebAuthn Architecture<ref name="overview" />]]

;''' Authenticator '''
The authenticator creates credentials, generates cryptographic proof of user authentication and administrate the PIN.

There are two types of authenticators:

*external authenticator (e.g. security key) that is removable from the device
*internal authenticator (e.g. fingerprint reader) that is implemented on the device and is not removeable

;'''Client/Platform'''
The client implements CTAP2 and client-side WebAuthn API and proves the validity of the identity of the Relying Party to prevent phishing attacks.
The client could be a browser for web applications or an operating system subsystem that offers a platform-specific FIDO API for mobile or desktop apps.

;'''Relying Party (RP)'''
The Relying Party consists of at least one webserver, the server-side parts of the WebAuthn API and a WebAuthn Server, that has a trust store.
The trust store contains the public trust parts for the attestation of the authenticator.

== Functionality ==
WebAuthn works with two ceremonies:

'''The Registration:'''
The Registration involves a Relying Party, the server that hosts the Website, and the user client that must host at least one authenticator. To register, the user has to navigate to the website where he wishes to use Web Authentication and sign in using the method that was used to this point, which means for example a password. After that it is to choose to register this site from now an using Web Authentication, which leads to the request to submit the configures authorization gesture. When the provided gesture is accepted, the registrations is complete.

'''The Authentication:'''
For the user, the authentication using the Web Authenticator works seemingly as a normal login with just the difference that instead of typing a password to verify its identity, the user uses the same Authentication gesture that he used to register to the site.

== Examples ==
=== Login WebAuthn test website ===
[[File:webauthn_1.PNG|400px]]

First you have to navigate to the Website where you want to change the default login to WebAuthn, in this case it is the test website of WebAuthn, the link is provided below, so we create a new user and pick the option PMT for we are going to use the inbuilt fingerprint sensor of the laptop to verify our identity.

[[File:webauthn2.PNG|300px]]

The security feature now asks us to verify the identity with the same Authenticatior you want to use every time you log into the website. The choice will be stored with your ID and used every time you login.

[[File:webauthn3.PNG|600px]]

The login was a scucess and now we are able to login just using our fingerprint.

[[File:webauthn4.PNG|300px]]

You are ask to provide the same authentication which you used to login, in this case the fingerprint.

[[File:webauthn5.PNG|800px]]

If everything goes well, you are now logged in just using a fingerprint sensor!

----
Try it yourself if you want to!
[https://webauthn.io/ WebAuthn Demo]

----

=== Passwordless Login ===
This example shows how to add a security key to the Microsoft account and how to log in to the account without a username and password.

A passwordless login to the MS account was tested with the following in every possible combination (OS+Browser+Security Key):

{| class="wikitable"
|-
! scope="col"| Operating System
! scope="col"| Browser
! scope="col"| Security Key
! scope="col"| Successful
|-
| Windows 10
| Google Chrome Microsoft Edge Mozilla Firefox Opera
| [[Yubico Security Key]] [[Yubikey 5 C]] [[Yubikey 5 NFC]] [https://www.yubico.com/at/product/yubikey-5c-nfc/ Yubikey 5C NFC]
| Yes
|-
| Android 9
| Google Chrome Microsoft Edge Mozilla Firefox Opera
| Security Keys are not supported to login to the MS account
| No
|}

Assumption: one has a Microsoft account but has not yet added a security key

1. Sign in with username and password

2. Go to '''''Security>Advanced Security Options'''''

3. Click on '''''Add a new way to sign in or verify'''''
[[File:FIDO2-WebAuthn_pwless_1.PNG|none|800px|]]
 
4. A window shows the additional options to verify or sign in. Select '''''Use a security key'''''
[[File:FIDO2-WebAuthn_pwless_2.PNG|none|300px]]
 
5. Read the instruction for your prefered method (USB or NFC) to register the security key. In this example USB was chosen.
[[File:FIDO2-WebAuthn_pwless_3.PNG|none|600px]]
 
6. Touch the button of the security key
[[File:FIDO2-WebAuthn_pwless_touch.PNG|none|300px]]
 
7. Enter the PIN
[[File:FIDO2-WebAuthn_pwless_pin.png|none|300px]]
 
8. Touch the button of the security key
[[File:FIDO2-WebAuthn_pwless_touch.PNG|none|300px]]
 
9. Name the added security key. It is recommended to add more than one security key. Naming the security keys helps to distinguish them.
[[File:FIDO2-WebAuthn_pwless_keyname.PNG|none|300px]]
 
10. The key is now registered.
[[File:FIDO2-WebAuthn_pwless_finish.png|none|500px]]
 
No username and password are needed for the next login with the added key.
 

'''Login:''' 
1. Select '''''Sign in with a security key'''''
[[File:FIDO2-WebAuthn_pwless_login.PNG|none|300px]]
 
2. Touch the button of the security key
[[File:FIDO2-WebAuthn_pwless_login_touch.PNG|none|300px]]
 
3. Enter the PIN
[[File:FIDO2-WebAuthn_pwless_login_pin.PNG|none|300px]]
 
4. Touch the button of the security key
[[File:FIDO2-WebAuthn_pwless_login_touch.PNG|none|300px]]
 

If these steps were successful, the user is logged in.

=== Second Factor Login ===

This example shows how to add a security key to the Google account and how to log in to the account with the second factor method.

The second factor login to the Google account was tested with the following in every possible combination (OS+Browser+Security Key):

{| class="wikitable"
|-
! scope="col"| Operating System
! scope="col"| Browser
! scope="col"| Security Key
! scope="col"| Successful
|-
| Windows 10
| Google Chrome Microsoft Edge Mozilla Firefox Opera
| [[Yubico Security Key]] [[Yubikey 5 C]] [[Yubikey 5 NFC]] [https://www.yubico.com/at/product/yubikey-5c-nfc/ Yubikey 5C NFC]
| Yes
|-
| rowspan="3"|Android 9
| rowspan="2"|Google Chrome
| [[Yubico Security Key]] (USB A and no NFC)
| No
|-
|[[Yubikey 5 C]] [[Yubikey 5 NFC]] [https://www.yubico.com/at/product/yubikey-5c-nfc/ Yubikey 5C NFC]
| Yes
|-
| Microsoft Edge Mozilla Firefox Opera
| Security Keys are not supported on this device or in this browser
| No
|}

Assumption: one has a Google account but has not yet added a security key

1. Sign in with username and password

2. Click on the profile on the top right and select '''''Manage your Google Account'''''

3. Go to '''''Security'''''

4. Select '''''2-Step Verification'''''

5. Enter your password

6. Google shows options that can be used for the 2-Step Verification. Choose '''''ADD SECURITY KEY'''''

7. Get your security key and select '''''Next''''' to continue the process

8. Insert the security key into the USB port

9.

Login:

1. Choose your Google account and enter your password

2. Touch the button on the security key.

== References ==

* https://webauthn.guide/#about-webauthn
* https://www.w3.org/TR/webauthn/#intro

<references>
<ref name="overview">https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Guide/Overview.html</ref>
</references>

[[Category:Documentation]]

WebAuthn

2020-12-22T21:17:04Z

JTraumueller: /* Second Factor Login */

[[File:webauthn_logo.PNG|500px|thumb|WebAuthn logo]]

== Summary ==

WebAuthn is an Application created by the FIDO (Fast Identity Online) alliance and the W3C (World Wide Web Consortium) to offer the possibility of passwordless authentication online. The latest recommendation is of March 2019 published by the W3C. Instead WebAuthn work either with the inbuild Authenticator of the device, such as fingerprint sensor or facial recognition, or with an extern media like an USB Stick for verification.

== Goal ==
Its purpose is to offer a more secure and easy possibility to log into your online accounts without storing or remembering huge amounts of passwords to prevent the possibility of passwords getting leaked or forgotten.

== Architecture <ref name="overview" /> ==

[[File:FIDO2-WebAuthn_Architecture.PNG|thumb|600px|FIDO2/WebAuthn Architecture<ref name="overview" />]]

;''' Authenticator '''
The authenticator creates credentials, generates cryptographic proof of user authentication and administrate the PIN.

There are two types of authenticators:

*external authenticator (e.g. security key) that is removable from the device
*internal authenticator (e.g. fingerprint reader) that is implemented on the device and is not removeable

;'''Client/Platform'''
The client implements CTAP2 and client-side WebAuthn API and proves the validity of the identity of the Relying Party to prevent phishing attacks.
The client could be a browser for web applications or an operating system subsystem that offers a platform-specific FIDO API for mobile or desktop apps.

;'''Relying Party (RP)'''
The Relying Party consists of at least one webserver, the server-side parts of the WebAuthn API and a WebAuthn Server, that has a trust store.
The trust store contains the public trust parts for the attestation of the authenticator.

== Functionality ==
WebAuthn works with two ceremonies:

'''The Registration:'''
The Registration involves a Relying Party, the server that hosts the Website, and the user client that must host at least one authenticator. To register, the user has to navigate to the website where he wishes to use Web Authentication and sign in using the method that was used to this point, which means for example a password. After that it is to choose to register this site from now an using Web Authentication, which leads to the request to submit the configures authorization gesture. When the provided gesture is accepted, the registrations is complete.

'''The Authentication:'''
For the user, the authentication using the Web Authenticator works seemingly as a normal login with just the difference that instead of typing a password to verify its identity, the user uses the same Authentication gesture that he used to register to the site.

== Examples ==
=== Login WebAuthn test website ===
[[File:webauthn_1.PNG|400px]]

First you have to navigate to the Website where you want to change the default login to WebAuthn, in this case it is the test website of WebAuthn, the link is provided below, so we create a new user and pick the option PMT for we are going to use the inbuilt fingerprint sensor of the laptop to verify our identity.

[[File:webauthn2.PNG|300px]]

The security feature now asks us to verify the identity with the same Authenticatior you want to use every time you log into the website. The choice will be stored with your ID and used every time you login.

[[File:webauthn3.PNG|600px]]

The login was a scucess and now we are able to login just using our fingerprint.

[[File:webauthn4.PNG|300px]]

You are ask to provide the same authentication which you used to login, in this case the fingerprint.

[[File:webauthn5.PNG|800px]]

If everything goes well, you are now logged in just using a fingerprint sensor!

----
Try it yourself if you want to!
[https://webauthn.io/ WebAuthn Demo]

----

=== Passwordless Login ===
This example shows how to add a security key to the Microsoft account and how to log in to the account without a username and password.

A passwordless login to the MS account was tested with the following in every possible combination (OS+Browser+Security Key):

{| class="wikitable"
|-
! scope="col"| Operating System
! scope="col"| Browser
! scope="col"| Security Key
! scope="col"| Successful
|-
| Windows 10
| Google Chrome Microsoft Edge Mozilla Firefox Opera
| [[Yubico Security Key]] [[Yubikey 5 C]] [[Yubikey 5 NFC]] [https://www.yubico.com/at/product/yubikey-5c-nfc/ Yubikey 5C NFC]
| Yes
|-
| Android 9
| Google Chrome Microsoft Edge Mozilla Firefox Opera
| Security Keys are not supported to login to the MS account
| No
|}

Assumption: one has a Microsoft account but has not yet added a security key

1. Sign in with username and password

2. Go to '''''Security>Advanced Security Options'''''

3. Click on '''''Add a new way to sign in or verify'''''
[[File:FIDO2-WebAuthn_pwless_1.PNG|none|800px|]]
 
4. A window shows the additional options to verify or sign in. Select '''''Use a security key'''''
[[File:FIDO2-WebAuthn_pwless_2.PNG|none|300px]]
 
5. Read the instruction for your prefered method (USB or NFC) to register the security key. In this example USB was chosen.
[[File:FIDO2-WebAuthn_pwless_3.PNG|none|600px]]
 
6. Touch the button of the security key
[[File:FIDO2-WebAuthn_pwless_touch.PNG|none|300px]]
 
7. Enter the PIN
[[File:FIDO2-WebAuthn_pwless_pin.png|none|300px]]
 
8. Touch the button of the security key
[[File:FIDO2-WebAuthn_pwless_touch.PNG|none|300px]]
 
9. Name the added security key. It is recommended to add more than one security key. Naming the security keys helps to distinguish them.
[[File:FIDO2-WebAuthn_pwless_keyname.PNG|none|300px]]
 
10. The key is now registered.
[[File:FIDO2-WebAuthn_pwless_finish.png|none|500px]]
 
No username and password are needed for the next login with the added key.
 

'''Login:''' 
1. Select '''''Sign in with a security key'''''
[[File:FIDO2-WebAuthn_pwless_login.PNG|none|300px]]
 
2. Touch the button of the security key
[[File:FIDO2-WebAuthn_pwless_login_touch.PNG|none|300px]]
 
3. Enter the PIN
[[File:FIDO2-WebAuthn_pwless_login_pin.PNG|none|300px]]
 
4. Touch the button of the security key
[[File:FIDO2-WebAuthn_pwless_login_touch.PNG|none|300px]]
 

If these steps were successful, the user is logged in.

=== Second Factor Login ===

This example shows how to add a security key to the Google account and how to log in to the account with the second factor method.

== References ==

* https://webauthn.guide/#about-webauthn
* https://www.w3.org/TR/webauthn/#intro

<references>
<ref name="overview">https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Guide/Overview.html</ref>
</references>

[[Category:Documentation]]

WebAuthn

2020-12-22T12:19:38Z

JTraumueller: /* Passwordless Login */

[[File:webauthn_logo.PNG|500px|thumb|WebAuthn logo]]

== Summary ==

WebAuthn is an Application created by the FIDO (Fast Identity Online) alliance and the W3C (World Wide Web Consortium) to offer the possibility of passwordless authentication online. The latest recommendation is of March 2019 published by the W3C. Instead WebAuthn work either with the inbuild Authenticator of the device, such as fingerprint sensor or facial recognition, or with an extern media like an USB Stick for verification.

== Goal ==
Its purpose is to offer a more secure and easy possibility to log into your online accounts without storing or remembering huge amounts of passwords to prevent the possibility of passwords getting leaked or forgotten.

== Architecture <ref name="overview" /> ==

[[File:FIDO2-WebAuthn_Architecture.PNG|thumb|600px|FIDO2/WebAuthn Architecture<ref name="overview" />]]

;''' Authenticator '''
The authenticator creates credentials, generates cryptographic proof of user authentication and administrate the PIN.

There are two types of authenticators:

*external authenticator (e.g. security key) that is removable from the device
*internal authenticator (e.g. fingerprint reader) that is implemented on the device and is not removeable

;'''Client/Platform'''
The client implements CTAP2 and client-side WebAuthn API and proves the validity of the identity of the Relying Party to prevent phishing attacks.
The client could be a browser for web applications or an operating system subsystem that offers a platform-specific FIDO API for mobile or desktop apps.

;'''Relying Party (RP)'''
The Relying Party consists of at least one webserver, the server-side parts of the WebAuthn API and a WebAuthn Server, that has a trust store.
The trust store contains the public trust parts for the attestation of the authenticator.

== Functionality ==
WebAuthn works with two ceremonies:

'''The Registration:'''
The Registration involves a Relying Party, the server that hosts the Website, and the user client that must host at least one authenticator. To register, the user has to navigate to the website where he wishes to use Web Authentication and sign in using the method that was used to this point, which means for example a password. After that it is to choose to register this site from now an using Web Authentication, which leads to the request to submit the configures authorization gesture. When the provided gesture is accepted, the registrations is complete.

'''The Authentication:'''
For the user, the authentication using the Web Authenticator works seemingly as a normal login with just the difference that instead of typing a password to verify its identity, the user uses the same Authentication gesture that he used to register to the site.

== Examples ==
=== Login WebAuthn test website ===
[[File:webauthn_1.PNG|400px]]

First you have to navigate to the Website where you want to change the default login to WebAuthn, in this case it is the test website of WebAuthn, the link is provided below, so we create a new user and pick the option PMT for we are going to use the inbuilt fingerprint sensor of the laptop to verify our identity.

[[File:webauthn2.PNG|300px]]

The security feature now asks us to verify the identity with the same Authenticatior you want to use every time you log into the website. The choice will be stored with your ID and used every time you login.

[[File:webauthn3.PNG|600px]]

The login was a scucess and now we are able to login just using our fingerprint.

[[File:webauthn4.PNG|300px]]

You are ask to provide the same authentication which you used to login, in this case the fingerprint.

[[File:webauthn5.PNG|800px]]

If everything goes well, you are now logged in just using a fingerprint sensor!

----
Try it yourself if you want to!
[https://webauthn.io/ WebAuthn Demo]

----

=== Passwordless Login ===
This example shows how to add a security key to the Microsoft account and how to log in to the account without a username and password.

A passwordless login to the MS account was tested with the following in every possible combination (OS+Browser+Security Key):

{| class="wikitable"
|-
! scope="col"| Operating System
! scope="col"| Browser
! scope="col"| Security Key
! scope="col"| Successful
|-
| Windows 10
| Google Chrome Microsoft Edge Mozilla Firefox Opera
| [[Yubico Security Key]] [[Yubikey 5 C]] [[Yubikey 5 NFC]] [https://www.yubico.com/at/product/yubikey-5c-nfc/ Yubikey 5C NFC]
| Yes
|-
| Android 9
| Google Chrome Microsoft Edge Mozilla Firefox Opera
| Security Keys are not supported to login to the MS account
| No
|}

Assumption: one has a Microsoft account but has not yet added a security key

1. Sign in with username and password

2. Go to '''''Security>Advanced Security Options'''''

3. Click on '''''Add a new way to sign in or verify'''''
[[File:FIDO2-WebAuthn_pwless_1.PNG|none|800px|]]
 
4. A window shows the additional options to verify or sign in. Select '''''Use a security key'''''
[[File:FIDO2-WebAuthn_pwless_2.PNG|none|300px]]
 
5. Read the instruction for your prefered method (USB or NFC) to register the security key. In this example USB was chosen.
[[File:FIDO2-WebAuthn_pwless_3.PNG|none|600px]]
 
6. Touch the button of the security key
[[File:FIDO2-WebAuthn_pwless_touch.PNG|none|300px]]
 
7. Enter the PIN
[[File:FIDO2-WebAuthn_pwless_pin.png|none|300px]]
 
8. Touch the button of the security key
[[File:FIDO2-WebAuthn_pwless_touch.PNG|none|300px]]
 
9. Name the added security key. It is recommended to add more than one security key. Naming the security keys helps to distinguish them.
[[File:FIDO2-WebAuthn_pwless_keyname.PNG|none|300px]]
 
10. The key is now registered.
[[File:FIDO2-WebAuthn_pwless_finish.png|none|500px]]
 
No username and password are needed for the next login with the added key.
 

'''Login:''' 
1. Select '''''Sign in with a security key'''''
[[File:FIDO2-WebAuthn_pwless_login.PNG|none|300px]]
 
2. Touch the button of the security key
[[File:FIDO2-WebAuthn_pwless_login_touch.PNG|none|300px]]
 
3. Enter the PIN
[[File:FIDO2-WebAuthn_pwless_login_pin.PNG|none|300px]]
 
4. Touch the button of the security key
[[File:FIDO2-WebAuthn_pwless_login_touch.PNG|none|300px]]
 

If these steps were successful, the user is logged in.

=== Second Factor Login ===

== References ==

* https://webauthn.guide/#about-webauthn
* https://www.w3.org/TR/webauthn/#intro

<references>
<ref name="overview">https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Guide/Overview.html</ref>
</references>

[[Category:Documentation]]

WebAuthn

2020-12-22T02:16:32Z

JTraumueller: /* Passwordless Login */

[[File:webauthn_logo.PNG|500px|thumb|WebAuthn logo]]

== Summary ==

WebAuthn is an Application created by the FIDO (Fast Identity Online) alliance and the W3C (World Wide Web Consortium) to offer the possibility of passwordless authentication online. The latest recommendation is of March 2019 published by the W3C. Instead WebAuthn work either with the inbuild Authenticator of the device, such as fingerprint sensor or facial recognition, or with an extern media like an USB Stick for verification.

== Goal ==
Its purpose is to offer a more secure and easy possibility to log into your online accounts without storing or remembering huge amounts of passwords to prevent the possibility of passwords getting leaked or forgotten.

== Architecture <ref name="overview" /> ==

[[File:FIDO2-WebAuthn_Architecture.PNG|thumb|600px|FIDO2/WebAuthn Architecture<ref name="overview" />]]

;''' Authenticator '''
The authenticator creates credentials, generates cryptographic proof of user authentication and administrate the PIN.

There are two types of authenticators:

*external authenticator (e.g. security key) that is removable from the device
*internal authenticator (e.g. fingerprint reader) that is implemented on the device and is not removeable

;'''Client/Platform'''
The client implements CTAP2 and client-side WebAuthn API and proves the validity of the identity of the Relying Party to prevent phishing attacks.
The client could be a browser for web applications or an operating system subsystem that offers a platform-specific FIDO API for mobile or desktop apps.

;'''Relying Party (RP)'''
The Relying Party consists of at least one webserver, the server-side parts of the WebAuthn API and a WebAuthn Server, that has a trust store.
The trust store contains the public trust parts for the attestation of the authenticator.

== Functionality ==
WebAuthn works with two ceremonies:

'''The Registration:'''
The Registration involves a Relying Party, the server that hosts the Website, and the user client that must host at least one authenticator. To register, the user has to navigate to the website where he wishes to use Web Authentication and sign in using the method that was used to this point, which means for example a password. After that it is to choose to register this site from now an using Web Authentication, which leads to the request to submit the configures authorization gesture. When the provided gesture is accepted, the registrations is complete.

'''The Authentication:'''
For the user, the authentication using the Web Authenticator works seemingly as a normal login with just the difference that instead of typing a password to verify its identity, the user uses the same Authentication gesture that he used to register to the site.

== Examples ==
=== Login WebAuthn test website ===
[[File:webauthn_1.PNG|400px]]

First you have to navigate to the Website where you want to change the default login to WebAuthn, in this case it is the test website of WebAuthn, the link is provided below, so we create a new user and pick the option PMT for we are going to use the inbuilt fingerprint sensor of the laptop to verify our identity.

[[File:webauthn2.PNG|300px]]

The security feature now asks us to verify the identity with the same Authenticatior you want to use every time you log into the website. The choice will be stored with your ID and used every time you login.

[[File:webauthn3.PNG|600px]]

The login was a scucess and now we are able to login just using our fingerprint.

[[File:webauthn4.PNG|300px]]

You are ask to provide the same authentication which you used to login, in this case the fingerprint.

[[File:webauthn5.PNG|800px]]

If everything goes well, you are now logged in just using a fingerprint sensor!

----
Try it yourself if you want to!
[https://webauthn.io/ WebAuthn Demo]

----

=== Passwordless Login ===
This example shows how to add a security key to the Microsoft account and how to log in to the account without a username and password.

A passwordless login to the MS account was tested with the following in every possible combination (OS+Browser+Security Key):

{| class="wikitable"
|-
! scope="col"| Operating System
! scope="col"| Browser
! scope="col"| Security Key
! scope="col"| Successful
|-
| Windows 10
| Google Chrome Microsoft Edge Mozilla Firefox Opera
| [[Yubico Security Key]] [[Yubikey 5 C]] [[Yubikey 5 NFC]] [https://www.yubico.com/at/product/yubikey-5c-nfc/ Yubikey 5C NFC]
| Yes
|-
| Android 9
| Google Chrome Microsoft Edge Mozilla Firefox Opera
| Security Keys are not supported to login to the MS account
| No
|}

Assumption: one has a Microsoft account but has not yet added a security key

1. Sign in with username and password

2. Go to '''''Security>Advanced Security Options'''''

3. Click on '''''Add a new way to sign in or verify'''''
[[File:FIDO2-WebAuthn_pwless_1.PNG|none|800px|]]
 
4. A window shows the additional options to verify or sign in. Select '''''Use a security key'''''
[[File:FIDO2-WebAuthn_pwless_2.PNG|none|300px]]
 
5. Read the instruction for your prefered method (USB or NFC) to register the security key. In this example USB was chosen.
[[File:FIDO2-WebAuthn_pwless_3.PNG|none|600px]]
 
6. Touch the button of the security key
[[File:FIDO2-WebAuthn_pwless_touch.PNG|none|300px]]
 
7. Enter the PIN
[[File:FIDO2-WebAuthn_pwless_pin.png|none|300px]]
 
8. Touch the button of the security key
[[File:FIDO2-WebAuthn_pwless_touch.PNG|none|300px]]
 
9. Name the added security key. It is recommended to add more than one security key. Naming the security keys helps to distinguish them.
[[File:FIDO2-WebAuthn_pwless_keyname.PNG|none|300px]]
 
10. The key is now registered.
[[File:FIDO2-WebAuthn_pwless_finish.png|none|500px]]
 
For the next login with the added key no username and password are needed.
 

'''Login:''' 
1. Select '''''Sign in with a security key'''''
[[File:FIDO2-WebAuthn_pwless_login.PNG|none|300px]]
 
2. Touch the button of the security key
[[File:FIDO2-WebAuthn_pwless_login_touch.PNG|none|300px]]
 
3. Enter the PIN
[[File:FIDO2-WebAuthn_pwless_login_pin.PNG|none|300px]]
 
4. Touch the button of the security key
[[File:FIDO2-WebAuthn_pwless_login_touch.PNG|none|300px]]
 

If these steps were successful, the user is logged in.

=== Second Factor Login ===

== References ==

* https://webauthn.guide/#about-webauthn
* https://www.w3.org/TR/webauthn/#intro

<references>
<ref name="overview">https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Guide/Overview.html</ref>
</references>

[[Category:Documentation]]

WebAuthn

2020-12-22T01:41:44Z

JTraumueller: /* Passwordless Login */

[[File:webauthn_logo.PNG|500px|thumb|WebAuthn logo]]

== Summary ==

WebAuthn is an Application created by the FIDO (Fast Identity Online) alliance and the W3C (World Wide Web Consortium) to offer the possibility of passwordless authentication online. The latest recommendation is of March 2019 published by the W3C. Instead WebAuthn work either with the inbuild Authenticator of the device, such as fingerprint sensor or facial recognition, or with an extern media like an USB Stick for verification.

== Goal ==
Its purpose is to offer a more secure and easy possibility to log into your online accounts without storing or remembering huge amounts of passwords to prevent the possibility of passwords getting leaked or forgotten.

== Architecture <ref name="overview" /> ==

[[File:FIDO2-WebAuthn_Architecture.PNG|thumb|600px|FIDO2/WebAuthn Architecture<ref name="overview" />]]

;''' Authenticator '''
The authenticator creates credentials, generates cryptographic proof of user authentication and administrate the PIN.

There are two types of authenticators:

*external authenticator (e.g. security key) that is removable from the device
*internal authenticator (e.g. fingerprint reader) that is implemented on the device and is not removeable

;'''Client/Platform'''
The client implements CTAP2 and client-side WebAuthn API and proves the validity of the identity of the Relying Party to prevent phishing attacks.
The client could be a browser for web applications or an operating system subsystem that offers a platform-specific FIDO API for mobile or desktop apps.

;'''Relying Party (RP)'''
The Relying Party consists of at least one webserver, the server-side parts of the WebAuthn API and a WebAuthn Server, that has a trust store.
The trust store contains the public trust parts for the attestation of the authenticator.

== Functionality ==
WebAuthn works with two ceremonies:

'''The Registration:'''
The Registration involves a Relying Party, the server that hosts the Website, and the user client that must host at least one authenticator. To register, the user has to navigate to the website where he wishes to use Web Authentication and sign in using the method that was used to this point, which means for example a password. After that it is to choose to register this site from now an using Web Authentication, which leads to the request to submit the configures authorization gesture. When the provided gesture is accepted, the registrations is complete.

'''The Authentication:'''
For the user, the authentication using the Web Authenticator works seemingly as a normal login with just the difference that instead of typing a password to verify its identity, the user uses the same Authentication gesture that he used to register to the site.

== Examples ==
=== Login WebAuthn test website ===
[[File:webauthn_1.PNG|400px]]

First you have to navigate to the Website where you want to change the default login to WebAuthn, in this case it is the test website of WebAuthn, the link is provided below, so we create a new user and pick the option PMT for we are going to use the inbuilt fingerprint sensor of the laptop to verify our identity.

[[File:webauthn2.PNG|300px]]

The security feature now asks us to verify the identity with the same Authenticatior you want to use every time you log into the website. The choice will be stored with your ID and used every time you login.

[[File:webauthn3.PNG|600px]]

The login was a scucess and now we are able to login just using our fingerprint.

[[File:webauthn4.PNG|300px]]

You are ask to provide the same authentication which you used to login, in this case the fingerprint.

[[File:webauthn5.PNG|800px]]

If everything goes well, you are now logged in just using a fingerprint sensor!

----
Try it yourself if you want to!
[https://webauthn.io/ WebAuthn Demo]

----

=== Passwordless Login ===
This example shows how to add a security key to the Microsoft account and how to log in to the account without a username and password.

The following was used for this example:

'''Security Key:''' [[Yubico Security Key]], [[Yubikey 5 C]], [[Yubikey 5 NFC]], [https://www.yubico.com/at/product/yubikey-5c-nfc/ Yubikey 5C NFC]

'''Operating System''': Windows 10

'''Browser:''' Google Chrome, Mozilla Firefox, Microsoft Edge, Opera

Assumption: one has a Microsoft account but has not yet added a security key

1. Sign in with username and password

2. Go to '''''Security>Advanced Security Options'''''

3. Click on '''''Add a new way to sign in or verify'''''
[[File:FIDO2-WebAuthn_pwless_1.PNG|none|800px|]]
 
4. A window shows the additional options to verify or sign in. Select '''''Use a security key'''''
[[File:FIDO2-WebAuthn_pwless_2.PNG|none|300px]]
 
5. Read the instruction for your prefered method (USB or NFC) to register the security key. In this example USB was chosen.
[[File:FIDO2-WebAuthn_pwless_3.PNG|none|600px]]
 
6. Touch the button of the security key
[[File:FIDO2-WebAuthn_pwless_touch.PNG|none|300px]]
 
7. Enter the PIN
[[File:FIDO2-WebAuthn_pwless_pin.png|none|300px]]
 
8. Touch the button of the security key
[[File:FIDO2-WebAuthn_pwless_touch.PNG|none|300px]]
 
9. Name the added security key. It is recommended to add more than one security key. Naming the security keys helps to distinguish them.
[[File:FIDO2-WebAuthn_pwless_keyname.PNG|none|300px]]
 
10. The key is now registered.
[[File:FIDO2-WebAuthn_pwless_finish.png|none|500px]]
 
For the next login with the added key no username and password are needed.
 

'''Login:''' 
1. Select '''''Sign in with a security key'''''
[[File:FIDO2-WebAuthn_pwless_login.PNG|none|300px]]
 
2. Touch the button of the security key
[[File:FIDO2-WebAuthn_pwless_login_touch.PNG|none|300px]]
 
3. Enter the PIN
[[File:FIDO2-WebAuthn_pwless_login_pin.PNG|none|300px]]
 
4. Touch the button of the security key
[[File:FIDO2-WebAuthn_pwless_login_touch.PNG|none|300px]]
 

If these steps were successful, the user is logged in.

=== Second Factor Login ===

== References ==

* https://webauthn.guide/#about-webauthn
* https://www.w3.org/TR/webauthn/#intro

<references>
<ref name="overview">https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Guide/Overview.html</ref>
</references>

[[Category:Documentation]]

WebAuthn

2020-12-22T01:21:48Z

JTraumueller: /* Architecture */

WebAuthn

2020-12-22T01:20:59Z

JTraumueller: /* Passwordless Login */

File:FIDO2-WebAuthn pwless login pin.PNG

2020-12-22T01:12:45Z

JTraumueller: Login: enter PIN

== Summary ==
Login: enter PIN

File:FIDO2-WebAuthn pwless login touch.PNG

2020-12-22T01:12:00Z

JTraumueller: Login: touch security key

== Summary ==
Login: touch security key

WebAuthn

2020-12-22T01:09:35Z

JTraumueller: /* Passwordless Login */

WebAuthn

2020-12-21T23:02:39Z

JTraumueller: /* Passwordless Login */

WebAuthn

2020-12-21T22:56:32Z

JTraumueller: /* Passwordless Login */

WebAuthn

2020-12-21T22:55:27Z

JTraumueller: /* Passwordless Login */

WebAuthn

2020-12-21T22:03:42Z

JTraumueller: /* Passwordless Login */

WebAuthn

2020-12-21T20:42:32Z

JTraumueller: /* Architecture */

WebAuthn

2020-12-21T20:39:54Z

JTraumueller: /* Architecture */

WebAuthn

2020-12-21T20:38:08Z

JTraumueller: /* Examples */

WebAuthn

2020-12-21T20:35:00Z

JTraumueller: /* Passwordless Login */

WebAuthn

2020-12-21T20:30:09Z

JTraumueller: /* Passwordless Login */

WebAuthn

2020-12-21T20:21:48Z

JTraumueller: /* Passwordless Login */

WebAuthn

2020-12-21T20:15:59Z

JTraumueller: /* Authenticators */

WebAuthn

2020-12-21T20:13:06Z

JTraumueller: /* Architecture */

WebAuthn

2020-12-21T19:54:52Z

JTraumueller: /* Architecture */

WebAuthn

2020-12-21T19:12:06Z

JTraumueller: /* Architecture */

WebAuthn

2020-12-21T19:10:15Z

JTraumueller: /* References */

WebAuthn

2020-12-21T19:09:32Z

JTraumueller: /* Architecture */

WebAuthn

2020-12-21T19:03:38Z

JTraumueller: /* Architecture */

WebAuthn

2020-12-21T19:02:15Z

JTraumueller: /* References */

WebAuthn

2020-12-21T18:53:09Z

JTraumueller: /* Architecture */

WebAuthn

2020-12-21T18:03:58Z

JTraumueller: /* Passwordless Login */

File:FIDO2-WebAuthn pwless login.PNG

2020-12-21T17:58:12Z

JTraumueller: login MS account

== Summary ==
login MS account