Apple’s latest preview version of Safari features support for the WebAuthentication (WebAuthn) API that lets users login using using USB security sticks, according to the release notes. Users can enable a feature that allows them to log in using USB-based CTAP2 sticks, which offer a higher level of protection than regular text-based passwords. The hardware devices are typically used in conjunction with passwords, a one-two protection punch that makes hacking and phishing exponentially more difficult.
Safari is late to the game here, as Firefox launched support for WebAuthn earlier this year, followed shortly by Google with Chrome. Individual sites and apps also support the standard, including Twitter, Facebook and Office 365.
USB key authentication is another option to two-factor systems that use SMS text messages or apps like Duo or Google’s own Authenticator. Hardware keys are particularly effective, however — Google has said that it completely eliminated phishing attacks by equipping 85,000 of its employees with its own Titan Key hardware (above).
That’s not to say that they’re problem free. You might be in a world of hurt if you lose the key, though the same logic can apply to passwords and other systems. It also requires carrying an extra device, as if you don’t have enough keys, dongles and cards already. If you’re curious to try it out, however, Safari Preview release 71 is now available for download — though there’s no guarantee, of course, that the feature will be released widely.
Source: engadget.com