Login with no password – Major Standards Milestone in Global Effort Towards Simpler, Stronger Authentication on the Web
10 April 2018 | Archive
W3C and the FIDO Alliance have achieved a major standards milestone in the global effort to bring simpler yet stronger web authentication to users around the world. The completion of the FIDO2 standardization efforts, the recent advancement of Web Authentication (WebAuthn) to Candidate Recommendation, –and the commitment of leading browser vendors to implement– enable users to login easily to online services with desktop or mobile devices with phishing-resistant security. WebAuthn, a standard web API to give users new methods to securely authenticate across sites and devices, has been developed in coordination with FIDO Alliance and is a core component of the FIDO2 Project along with FIDO’s Client to Authenticator Protocol (CTAP) specification, which enables an external authenticator, such as a security key or a mobile phone, to communicate strong authentication credentials locally over USB, Bluetooth or NFC to the user’s computer or tablet. Please, read the joint Press release and testimonials from W3C Members.
W3C Advisory Committee Elects Technical Architecture Group
3 April 2018 | Archive
The W3C Advisory Committee has elected Kenneth Rohde Christiansen (Intel Corporation) to fill the W3C Technical Architecture Group (TAG) additional seat created by the adoption of Process 2018. He joins co-Chairs Tim Berners-Lee, Daniel Appelquist (Samsung Electronics), Peter Linss (W3C Invited Expert), continuing participants David Baron (Mozilla Foundation), Hadley Beeman (W3C Invited Expert), Travis Leithead (Microsoft), Sangwhan Moon (Odd Concepts), Lukasz Olejnik (W3C Invited Expert), Alex Russell (Google), and staff contact Yves Lafon. The mission of the TAG is to build consensus around principles of Web architecture and to interpret and clarify these principles when necessary, to resolve issues involving general Web architecture brought to the TAG, and to help coordinate cross-technology architecture developments inside and outside W3C. Learn more about the TAG.
W3C Invites Implementations of Encoding
27 March 2018 | Archive
The Internationalization Working Group invites implementations of an updated Candidate Recommendation of Encoding. The utf-8 encoding is the most appropriate encoding for interchange of Unicode, the universal coded character set. Therefore for new protocols and formats, as well as existing formats deployed in new contexts, this specification requires (and defines) the utf-8 encoding.
The other (legacy) encodings have been defined to some extent in the past. However, user agents have not always implemented them in the same way, have not always used the same labels, and often differ in dealing with undefined and former proprietary areas of encodings. This specification addresses those gaps so that new user agents do not have to reverse engineer encoding implementations and existing user agents can converge.
W3C Invites Implementations of the Web Authentication: An API for accessing Public Key Credentials Level 1
20 March 2018 | Archive
The Web Authentication Working Group invites implementations of the Web Authentication: An API for accessing Public Key Credentials Level 1 Candidate Recommendation. This specification defines an API enabling the creation and use of strong, attested, scoped, public key-based credentials by web applications, for the purpose of strongly authenticating users. Conceptually, one or more public key credentials, each scoped to a given Relying Party, are created and stored on an authenticator by the user agent in conjunction with the web application. The user agent mediates access to public key credentials in order to preserve user privacy. Authenticators are responsible for ensuring that no operation is performed without user consent. Authenticators provide cryptographic proof of their properties to relying parties via attestation. This specification also describes the functional model for WebAuthn conformant authenticators, including their signature and attestation functionality.