Security
What is WebAuthn?
Web Authentication
WebAuthn is a web standard for authenticating with public-key cryptography instead of shared secrets. The private key never leaves the user's device, and signatures are bound to the requesting site's origin, which makes credentials useless to a phishing site even if the user is fully deceived.
The origin binding is the property that matters. A password can be typed into any convincing replica of a login page; a passkey signature is scoped to the origin that requested it, so a look-alike domain receives a signature it cannot use. This closes the attack that causes most account takeovers, rather than making it harder.
For payments, WebAuthn also supports step-up: requiring a fresh signature for an individual action rather than only at sign-in. That is what makes "the model proposes, the human disposes" enforceable rather than aspirational — an agent can prepare a transfer, but the approval is a cryptographic act performed on the owner's hardware.
Related
Definitions are educational and general. Nothing here is financial, legal or tax advice, and regulatory descriptions summarise frameworks that change — check the current rules for your jurisdiction before relying on them.