Volodymyr Kolesnykov

<p>This plugin adds support for WebAuthn into the <a href="https://wordpress.org/plugins/two-factor/" rel="ugc">Two Factor</a> plugin.</p>
<p>Because the U2F API <a href="https://groups.google.com/a/chromium.org/g/blink-dev/c/xHC3AtU_65A/m/yg20tsVFBAAJ" rel="nofollow ugc">is deprecated and will be removed in February 2022</a>, the plugin enables <a href="https://user-images.githubusercontent.com/7810770/150708968-3c331612-54ad-4373-9d36-6ec064301755.mp4" rel="nofollow ugc">seamless support</a> for the previously registered U2F security keys so that the users don’t have to re-register their keys and still be able to log in.</p>
<p>Notes:</p>
<ul>
<li>please use <a href="https://github.com/sjinks/wp-two-factor-provider-webauthn/issues" rel="nofollow ugc">GitHub issues</a> to report bugs;</li>
<li>the full source code with all development files is available on <a href="https://github.com/sjinks/wp-two-factor-provider-webauthn" rel="nofollow ugc">GitHub</a>.</li>
</ul>


WebAuthn Provider for Two Factor

Thank you so much for this plugin!!  

In February 2022 Chrome changed things so hardware security keys would no longer work with the "Two Factor" plugin. Installing this add-on gets it working again. 

I had to change the "User Verification Requirement" to "Discouraged" in order to use my existing Yubikey (without re-adding it). Otherwise, it asked for a PIN but then wouldn't recognize my key.

Hopefully it can get merged directly into the Two Factor plugin soon? 😁🙏

Two Factor works with hardware keys again!

Thank you for bridging the gap while we wait for the PR. 
This is what Open Source is all about. 

FIDO U2F WebAuthn for Two Factor


This is helpful for evaluating purposes of the code. As this plugin is part of a security level all the code should be readable easily for auditors.



Besides that, well done.Thank you.


Works well for my use case but please provide unminified JS files.


This is great. You can literally log into WordPress with 2FA using one touch (password manager with auto-login combined with this for 2FA). Beats using an authenticator app any day.


One touch 2FA is a dream

WebAuthn authentication provider for Two Factor plugin.

miniOrange

miniorange

<p>Meet the new global standard of web authentication (WebAuthn). WebAuthn is a core component of FIDO2 Alliance which includes protocols that are based on public key cryptography and are strongly resistant to phishing (to varying degrees).<br />
WebAuthn is a browser-based API by FIDO2 that allows web applications to simplify and secure user authentication by using their registered devices (android phones/ iphones, laptops, etc.) as factors. WebAuthn uses public key cryptography by FIDO2 to protect users from advanced phishing attacks. With WebAuthn’s Passwordless login using Fingerprint, FaceID, Touch ID plugin, you can allow your users to login to your website by just entering their device credentials (Fingerprint, windows hello, face ID, touch ID, etc).</p>
<p>WebAuthn increases the security of your website by providing an additional layer of security and it also enhances the user experience of your website. Webauthn protects your website from many common attacks like phishing, brute force protection, man in the middle attack, malwares, etc.</p>
<p><strong><a href="https://www.miniorange.com/webauthn" rel="nofollow ugc">WebAuthn</a> requires HTTPS connection or <code>localhost</code> for secure authentication</strong></p>
<h4>Passwordless login with webauthn</h4>
<p>FIDO2/WebAuthn implements the concept of passwordless authentication. The users will enter their username and if their device/keys are configured with WebAuthn then they need to verify it for successful login. If the device is not registered for WebAuthn, then users need to enter their password and then they can configure the WebAuthn. This will make the user experience better by removing the password. It will also increase the security as webauthn is based on public key cryptography authentication and it allows the user to login only if the user is authenticated from the trusted device.</p>
<h4>WebAuthn as the [second factor](https://plugins.miniorange.com/2-factor-authentication-for-wordpress)</h4>
<p>WebAuthn is also used as the <a href="https://plugins.miniorange.com/login-to-your-wordpress-site-with-fingerprint-and-faceid-using-webauthn" rel="nofollow ugc">second factor</a> to add an extra layer of security on your website. In this case the users will enter their username and password to verify their first factor and after that they will be prompted with the WebAuthn for verification of the second layer of security. This will protect your website even if the users’ passwords are compromised, because to verify the identity of any user you need to confirm the web authentication with their device.</p>
<h4>Usernameless login with WebAuthn*</h4>
<p>WebAuthn also allows you to provide an option where users can login to your website without entering their username and password. The user will be automatically picked at login via WebAuthn.</p>
<p>As most of the users do not want to maintain too many credentials so in that case you can allow your users to use their device as the credentials and if the device is verified they will be logged into the site.</p>
<h4>Device limitation*</h4>
<p>The WebAuthn plugin provides an option where you can put a limit on the number of devices a user can register with WebAuthn. This will be helpful when you want only a particular device to login to the website.<br />
This will allow you to restrict the number of devices a user can use to access your website.</p>
<h4>Role based WebAuthn*</h4>
<p>With this you can allow WebAuthn to specific user roles. The users who have been allowed to use WebAuthn can login with WebAuthn and others will use their usual wordpress login credentials for access, without getting prompted for the WebAuthn.</p>
<h4>User-specific WebAuthn</h4>
<p>With this you can select the specific users who can login using WebAuthn to your website. Other users have to use their WordPress credentials to login.</p>
<ul>
<li>supported in the Premium version</li>
</ul>


WebAuthn – Passwordless login using Fingerprint, FaceID, Touch ID, Yubikey

WebAuthn is a new way of authenticating your user on the website. WebAuthn by the…

WebAuthn Provider for Two Factor vs WebAuthn – Passwordless login using Fingerprint, FaceID, Touch ID, Yubikey