Skip to content

Update: Authentication Cheat Sheet #1915

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
KadirArslan wants to merge 2 commits into
base: master
Choose a base branch
from
+2 −0
Open

Update: Authentication Cheat Sheet #1915

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3899afe
Update FIDO section to include FIDO2, WebAuthn, and Passkeys
KadirArslan Dec 5, 2025
074a48e
Update Authentication_Cheat_Sheet.md
KadirArslan Dec 7, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions cheatsheets/Authentication_Cheat_Sheet.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -341,6 +341,8 @@ UAF takes advantage of existing security technologies present on devices for aut

U2F augments password-based authentication using a hardware token (typically USB) that stores cryptographic authentication keys and uses them for signing. The user can use the same token as a second factor for multiple applications. U2F works with web applications. It provides **protection against phishing** by using the URL of the website to look up the stored authentication key.

**FIDO2**: FIDO2 and WebAuthn, encompassing previous standards (UAF/U2F), form the foundation of modern **Passkeys** technology. Passkeys enable users to securely log in using their biometric data or device locks, synchronizing across devices, password-free, and phishing-resistant. This technology is widely supported by major platforms.
Copy link
Collaborator

@szh szh Dec 7, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"biometric data or device locks" - biometric isn't always included, and I'm not sure what device locks mean. Can this be clarified please?
Also "synchronizing across devices" is not always present IIRC.

Copy link
Contributor Author

@KadirArslan KadirArslan Dec 7, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@szh

Instead of "biometric data or device locks," I changed the term "local user verification," the general security mechanism required by FIDO. This term could be, as you mentioned, face/touch id (biometrics) or your phone or computers PIN (device lock).

"Synchronizing across devices" is not mandatory, but it is a very popular feature. Therefore, I simply say that this feature is generally supported. (Cloud-based credential managers like Apple Keychain provide this synchronization.)

Changed the text to be more clear and understandable.

Thank you! :)


## Password Managers

Password managers are programs, browser plugins, or web services that automate the management of a large quantity of different credentials. Most password managers have functionality to allow users to easily use them on websites, either:
Expand Down