From 4717953e02482e3b2c6b65010eb5a0043d1e2180 Mon Sep 17 00:00:00 2001 From: pilcrowOnPaper Date: Sun, 23 Jun 2024 23:43:42 +0900 Subject: [PATCH] passkeys 2fa --- pages/mfa.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/pages/mfa.md b/pages/mfa.md index 514ca94..dcd8299 100644 --- a/pages/mfa.md +++ b/pages/mfa.md @@ -11,7 +11,7 @@ title: "Multi-factor authentication (MFA)" - [Generate QR code](#generate-qr-code) - [Validate OTPs](#validate-otps) - [SMS](#sms) -- [Passkeys](#passkeys) +- [WebAuthn (passkeys)](#webauthn-passkeys) - [Recovery codes](#recovery-codes) ## Overview @@ -91,9 +91,11 @@ We discourage SMS based MFA as it can be intercepted and unreliable at times. Ho Throttling must be implemented. A basic example is blocking attempts for 15 to 60 minutes after the 5th consecutive failed attempt. The user should also be notified to change the password as well. -## Passkeys +## WebAuthn (passkeys) -Passkeys allow you to use in-device authentication methods, such as biometrics and pin-codes. See the [Passkeys](/passkeys) guide. +The [Web Authentication API (WebAuthn)](https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API) allows applications to use user devices for authentication using public key cryptography. You can either verify the user's identity with the devices PIN code or biometrics, or just verify the device. Both works as a second factor and the latter can be more user-friendly as users aren't prompted for their password/fingerprint. + +See the [passkeys](/passkeys) guide for implementations. ## Recovery codes