Master thesis : FIDOLOGY : A Measurement Study of FIDO2 Adoption Across the Web

Abstract

The FIDO2 standard enables passwordless user authentication using security tokens and combines the Web Authentication specification (WebAuthn) with the new Client-to-Authenticator Protocol (Ctap2) protocol. Since its launch in 2018, websites have gradually begun to adopt it, but to date, the real state of adoption of FIDO2 in the wild is not known. This work aims to fill this gap by creating Fidology, a tool that categorizes the authentication mechanisms implemented by websites into five categories, by implementing, in a non-intrusive and deterministic way, an automated pipeline using headless browser and multi-layered signals inference. First applied to a manually crafted groundtruth and then evaluated against a much larger dataset, this tool has shown that classical password-based mechanisms continue to dominate the world of authentication, whilst FIDO2 clues are detected on a small but non-negligible proportion of websites. In addition to this state of FIDO2 deployment, authentication flows are captured to analyse cryptographic challenges and other metrics, with the aim to evaluate the security level of websites previously identified as belonging to the FIDO2-Native category. While most of them meet, and and in some cases even exceed, the expected Fido requirements, critical issues like challenge reuse across sessions are discovered.