UAF is designed to provide passwordless authentication using strong, device-based methods such as biometrics or PINs.
How it Works:
Registration: Users register their device with an online service by creating a key pair. The private key stays on the device, while the public key is stored on the service.
Authentication: Users authenticate by using their device’s biometric or PIN system. The device uses the private key to sign a challenge from the service, which verifies it with the public key.
User Experience:
Users enjoy a seamless login experience by authenticating directly through their device’s biometric sensors or a PIN, without needing to remember passwords.
Security:
The private key never leaves the device, and biometric data is not transmitted, reducing the risk of phishing and man-in-the-middle attacks.
Get Chuni Lal Kukreja’s stories in your inbox
Join Medium for free to get updates from this writer.
Universal 2nd Factor (U2F)
Purpose:
U2F adds a second layer of security to existing password-based authentication systems.
How it Works:
Registration: Users register a U2F device (like a USB security key) with an online service. A key pair is generated, with the private key stored on the U2F device and the public key stored by the service.
Authentication: After entering their username and password, users use the U2F device to complete the login by pressing a button on the device, which signs a challenge from the service. The service verifies the signature with the public key.
User Experience:
Users perform two-factor authentication by entering their credentials and then using the U2F device to verify their identity. This typically involves plugging in a USB key and pressing a button.
Security:
Enhances security by requiring something the user knows (password) and something the user has (U2F device). The private key never leaves the U2F device, which mitigates phishing and man-in-the-middle attacks.
Is UAF & WebAuthn same thing?
UAF (Universal Authentication Framework) and WebAuthn (Web Authentication) are both authentication standards developed by the FIDO (Fast IDentity Online) Alliance, but they are not the same thing. WebAuthn can be seen as an evolution and expansion of the capabilities provided by UAF, adapted specifically for the web.
