FIDO2 / WebAuthn
Ayrıca şöyle anılır WebAuthn, FIDO2, passkeys, CTAP
WebAuthn is the browser API behind passkeys: a website asks the platform to prove possession of a key, and the platform handles the biometric or PIN locally. The private key never leaves the device and never reaches the site.
Why it succeeded where earlier attempts did not
Because the hard part was never the cryptography. It was persuading users to accept a new gesture and persuading sites to trust a key they did not issue. Building it into the operating system and the browser solved both at once, and phishing resistance came along as a property of origin binding rather than as a feature anyone had to sell.
The lesson for credentials
The interaction model is already installed in users' heads. A credential presentation that feels like a passkey prompt inherits that familiarity; one that requires scanning a code and switching apps does not. This is the same argument as the browser-native credential API, one layer down.
Where Solidus sits
Not implemented. Authentication is by password, OAuth provider or DID challenge, and none of those carries the phishing resistance origin binding provides.
Nereden geliyor
Bunu başkası belirtti. Solidus bir araya getiriyor.
WebAuthn is a W3C Recommendation, currently Level 3; CTAP is the FIDO Alliance half that lets an external authenticator speak to the platform. Together they are what users experience as passkeys. Solidus implements neither; both are other people's specifications with very large deployments behind them.
Bunu nasıl doğrularsınız
Solidus bunu inşa etmedi. Girdi kavramı açıklıyor.
WebAuthn is observable in any modern browser, and its absence here is observable in the auth backend, which authenticates with passwords, OAuth providers and DID challenges rather than with platform authenticators.