A new web standard is expected to kill passwords, meaning users will no longer have to remember difficult logins(登录) for each and every website or service they use.
The Web Authentication (WebAuthn网络认证) standard is designed to replace the password with tools that users already own, such as a security key, a smart phone, a fingerprint scanner or webcam. Instead of having to remember long characters, users can authenticate their login with their body or something they have, communicating directly with the website through Bluetooth, USB or NFC.
"WebAuthn will change the way that people access the Web," said Jeff Jaffe, CEO of the World Wide Web Consortium (W3C), the body that controls web standards. One example of how WebAuthn will work is that when a user visits a site, they put in a user name and then get a message on their smart phone. Tapping on the message on their phone then logs them into the website without the need for a password.
WebAuthn promises to protect users against phishing attacks(钓鱼攻击) and the use of stolen information as there will be nothing to steal, the authentication sign is produced and used once by their special tool each time the user enters.
"After years of increasingly serious data and password being stolen, now it is the time for service providers to end their dependency on easily-attacked passwords and use phishing-resistant FIDO Authentication(快速身份认证联盟) for all websites and apps," said Brett McDowell, CEO of the FIDO Alliance, one of the bodies pushing the new standard.
WebAuthn should also help people use special login details for each and every service they use, instead of using the same login and password for every site, which many people still do, leaving them further attacked if one site is hacked(黑客攻击).
The W3C has moved WebAuthn to what's called the "candidate recommendation" stage – the last-but-one step before it becomes an approved web standard – inviting sites and services to begin using it. The web standards body announced that Google, Microsoft and Mozilla had been devoted to supporting WebAuthn, meaning that all major web explorers except Apple's Safari will use the new standard.
"While there are many web security problems and we can't fix them all, relying on passwords is one of the weakest links. With WebAuthn's solutions we are removing this weak link," said Jaffe.
Several sites and services already use similar methods to enter, including Google and Facebook, which can both be entered using a USB security key. But a single cross-platform, cross-service standard approved by the W3C will mean that many more sites and services will be able to kill the password as the login method.
WebAuthn is the top of many years of work and the change will not happen overnight. But as it increasingly seems unavoidably that our email or other online services will get hacked into, removing the password is an important step in improving online security and making using sites and services easier.
