FIDO WebAuthn Authentication Standard

Global

2019

Cybersecurity

Overview

The FIDO WebAuthn standard, finalized by the World Wide Web Consortium (W3C) in 2019, provides a global framework for passwordless, phishing-resistant authentication using public-key cryptography. Developed in collaboration with the FIDO (Fast IDentity Online) Alliance, it is part of the broader FIDO2 specification and works alongside the Client to Authenticator Protocol (CTAP).

WebAuthn enables users to authenticate using biometrics, security keys, or device-based authenticators, offering strong protection against credential theft. Credentials are unique per service and never stored on central servers. The standard is supported across all major browsers and platforms, making it applicable to banks, healthcare providers, government agencies, consumer platforms, and enterprise applications that require secure user verification.

Key Obligations

Implement WebAuthn for secure, passwordless login where applicable
Ensure compatibility with platform and roaming authenticators
Use public-key cryptography to prevent credential reuse and phishing

Adopt CTAP standards when integrating with hardware authenticators
Align authentication strategies with regulatory expectations from NIST, ENISA, and other authorities

FAQ

Related Regulations

Identity Theft Red Flags Rule

GLBA Safeguards Rule Compliance