网页新标准问世，浏览器开始消灭密码

一些全球人气最高的网页浏览器正努力弄死密码。

制定互联网标准的组织FIDO联盟和W3C联合推出了一个新的认证标准，允许网页浏览器和网站支持以生物辨识技术替代登陆密码。这项名为WebAuthn的标准其实是一种应用程序接口（API），网页开发者可以应用在网站上，通过指纹识别、甚至像苹果Face ID一样的面部扫描技术确认用户的身份。

据美国科技媒体Engadget稍早报道，火狐浏览器已经在配合WebAuthn，谷歌的Chrome和微软的Edge都将在未来几个月调整适配WebAuthn。运营Safari浏览器的苹果公司尚未宣布支持WebAuthn。

从技术角度看，WebAuthn问世可能提升互联网的安全性。多年来，黑客攻击、网络诈骗和数据泄密层出不穷，仅凭密码保护数据安全已经不够。互联网企业转而采用二元认证。这种方式要求用户除了提供密码，还要输入发送到智能手机上的验证码确认身份，但还是没有生物识别方式安全。

去年9月，苹果发布新款iPhone，当时详细介绍了生物识别安全技术。苹果表示，如果使用iPhone的Touch ID指纹扫描技术，每5万次识别之中可能会失败一次。而如果采用Face ID扫描面部，失败比例会下降到百万分之一。两种方式不管选哪种，都比单单一个密码要强。

不过，短期内密码不会很快消失。虽然WebAuthn已经正式发布，但还只是一种“推荐”方式，可能要经过调整才能成为行业标准。无论如何，新推荐方式为网站和浏览器替换现有密码奠定了基础。现在就看网站经营者和浏览器公司如何担负责任全力支持了。（财富中文网）

译者：Pessy

审校：夏林

Some of the most popular Web browsers are trying to kill your passwords.

Internet standards organizations the FIDO Alliance and W3C have launched a new specification that allows Web browsers and websites to support biometric encryption methods in place of passwords. The specification, called WebAuthn, is an application programming interface (API) that Web developers can integrate into their websites and allow fingerprint readers and even face scanners like Apple’s Face ID to verify a person’s identity.

According to Engadget, which earlier reported on WebAuthn, Firefox already works with the technology. Google’s Chrome and Microsoft Edge are slated to add support for WebAuthn within the next few months. Apple, which operates its Safari browser, has yet to announce support for WebAuthn.

The move could technically create a more secure Internet. As the rash of hacks, scams, and data breaches have shown over the last several years, passwords alone are not necessarily a suitable safeguard for data. Companies have moved to two-factor authentication, which requires users to input a code sent to their smartphones in addition to a password to verify their authenticity, but that still isn’t as secure as biometrics.

At its iPhone unveiling in September last year, Apple talked in detail about biometric security. The company said that its Touch ID fingerprint scanner could be duped in 1 in 50,000 cases. That jumped to 1 in 1 million cases with its Face ID face scanner. Either way, that’s better than a simple password.

Still, passwords aren’t dying anytime soon. While WebAuthn has officially launched, it’s still considered a “recommendation” and could be modified before it becomes a standard. The recommendation paves the way for websites and browsers to support alternatives to passwords, but now the onus is on website owners and browser companies to support it.