new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

OWASP Cheat Sheets · all subjects

authentication/fido

3 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

FIDO UAF and U2F protocols overview

The FIDO Alliance has created two protocols: Universal Authentication Framework (UAF) focusing on passwordless authentication, and Universal Second Factor (U2F) allowing addition of second factor to existing password-based authentication. Both protocols are based on public key cryptography challenge-response model. U2F provides protection against phishing by using the website URL to look up the stored authentication key.

FIDO2 and WebAuthn foundation for Passkeys

FIDO2 and WebAuthn, encompassing previous standards (UAF/U2F), form the foundation of modern Passkeys technology. Passkeys enable users to securely log in using local user verification such as biometrics or device PINs, often with credential synchronization across devices.

Hardware-backed key storage for authenticators

For many authenticators including common platform passkeys, the private key is generated and stored by the operating system's secure key manager. Depending on platform and authenticator, keys may be protected using hardware-backed components such as Trusted Platform Module (TPM) on Windows, Secure Enclave on Apple devices, or Android Keystore/StrongBox on Android, or by software-based mechanisms. In typical implementations, the private key is non-exportable and bound to the authenticator, with the platform security module signing the server challenge. However, some authenticators support credential synchronization or backup involving export or server-side storage, and not all implementations are hardware-backed. Relying parties should not assume keys are hardware-backed and non-exportable unless verified via authenticator properties or attestation.

Give your agent this brain