Credential Management - Revision history

Tom: /* Problems Addressed */

2025-05-26T18:29:29Z

‎Problems Addressed

2025-05-26T18:27:54Z

‎Full Title

2025-05-26T18:25:16Z

‎W3C API

2025-05-26T18:24:20Z

‎Problems Addressed

2021-11-19T01:29:36Z

‎References

2021-05-24T19:30:05Z

‎Problems Addressed

2021-02-21T06:04:20Z

‎Solutions

2021-02-21T04:15:30Z

‎Solutions

2021-02-21T04:14:23Z

‎Solutions

2021-02-20T19:53:13Z

‎Solutions

@@ Line 8: / Line 8: @@
 * Protection against phishing: An attacker who creates a fake login website can't login as the user because the signature changes with the origin of the website.
 *Reduced impact of data breaches: Developers don't need to hash the public key, and if an attacker gets access to the public key used to verify the authentication, it can't authenticate because it needs the private key.
-* Invulnerable to password attacks: Some users might reuse passwords, and an attacker may obtain the user's password for another website (e.g. via a data breach). Also, text passwords are much easier to brute-force than a [[Digital Signature]
+* Invulnerable to password attacks: Some users might reuse passwords, and an attacker may obtain the user's password for another website (e.g. via a data breach). Also, text passwords are much easier to brute-force than a [[Digital Signature]]
 ==W3C API==
 The W3C Credential Management API is a standardized web API that streamlines the process of handling user credentials in a secure, user-friendly, and programmatically accessible way. It provides a common interface between a website and a browser’s built-in credential manager, making authentication—whether it’s signing in, saving new credentials, or even handling federated identities—much smoother for both developers and users.

@@ Line 1: / Line 1: @@
 ==Full Title==
 * This page is about the W3C CredentialManagement API which is often abbreviated as CredMan..
-* This also is support by [[Web Authentication]] and [[WebAuthn 2]].
+* This also is supported by [[Web Authentication]] and [[WebAuthn 2]].
 ==Context==

@@ Line 26: / Line 26: @@
    - **store():** Saves a newly created or updated credential locally in the browser’s secure store, so it can be retrieved later.
    - **get():** Retrieves existing credentials from the browser, which can then be used to sign the user in automatically without them having to re-enter their details.
 ===2. Security and Privacy Considerations===
@@ Line 39: / Line 37: @@
 - **Cross-Device Synchronization:**
    Many browsers allow these stored credentials to be synchronized across devices (when the user is signed in with the browser account), thus maintaining a seamless experience even if the user switches devices.
 ===3. Benefits and Use Cases===
@@ Line 55: / Line 51: @@
 - **Streamlined Credential Updates:**
    It offers a programmatic way to update or replace stored credentials, ensuring that changes (like a password update) are reflected in the browser's credential manager.
 ===4. Developer Integration===
@@ Line 82: / Line 76: @@
 - **Improving Sign-In Flow:**
    The API is continuously evolving; by adhering to the W3C Credential Management Level 1 spec and keeping an eye on updates, developers can leverage this standardized approach to improve the security and usability of authentication on the web.
 ===5. Standards and Specifications===

@@ Line 8: / Line 8: @@
 * Protection against phishing: An attacker who creates a fake login website can't login as the user because the signature changes with the origin of the website.
 *Reduced impact of data breaches: Developers don't need to hash the public key, and if an attacker gets access to the public key used to verify the authentication, it can't authenticate because it needs the private key.
-* Invulnerable to password attacks: Some users might reuse passwords, and an attacker may obtain the user's password for another website (e.g. via a data breach). Also, text passwords are much easier to brute-force than a [[Digital Signature]].
+* Invulnerable to password attacks: Some users might reuse passwords, and an attacker may obtain the user's password for another website (e.g. via a data breach). Also, text passwords are much easier to brute-force than a [[Digital Signature]
 ==Solutions==

@@ Line 16: / Line 16: @@
 * [https://developers.google.com/web/updates/2020/10/webauthn-tab Web AuthN debug tab] from Google
 * [https://condatis.com/news/blog/trust-in-self-sovereign-identity-ssi/ Trust in self-sovereign-ID] Condatus - SIOP and MS Authenticator
 ==References==
 [[Category:Standard]]

@@ Line 14: / Line 14: @@
 * [https://docs.aws.amazon.com/sdk-for-javascript/v2/developer-guide/loading-browser-credentials-federated-id.html Using Web Federated Identity to Authenticate Users] Amazon WS
 * [https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API Web Authentication API] from Mozilla
-* [https://developers.google.com/web/updates/2020/10/webauthn-tab Wub AuthN debug tab] from Google
+* [https://developers.google.com/web/updates/2020/10/webauthn-tab Web AuthN debug tab] from Google
 * [https://condatis.com/news/blog/trust-in-self-sovereign-identity-ssi/ Trust in self-sovereign-ID] Condatus - SIOP and MS Authenticator