Can Web Authentication work across browsers?

Question

Web Authentication relies on asymmetric encryption to do away with passwords and SMS 2-factor authentication.

Can it work across browsers? Must the user use the same browser on the same device where the private key resides? If the user were to clear the browser data or uninstall the browser, will the private key still remain?

Answer 1

Can it work across browsers?

Yes. This API is available for most used browsers.

Must the user use the same browser on the same device where the private key resides?

The private key is stored into the authenticator, not into the browser. For the device, there are 2 cases:

• The authenticator is a roaming one i.e. a device you can have in your pocket/bag and that interacts using USB, NFC or Bluetooth: you can use in on any device that provides the correct interface.

• The authenticator is a platform one i.e. it is embeded onto the device (power button with fingerprint reader, Android device…): you must use that device (no matter which browser you use)

If the user were to clear the browser data or uninstall the browser, will the private key still remain?

As said in the previous answer, nothing is stored in the browser. The private keys are stored into the authenticator.