密碼再見！互聯網聯盟推新式在線身份認證

A new web standard is expected to kill passwords, meaning users will no longer have to remember difficult logins for each and every website or service they use.
一種新的網絡標準或將終結密碼的使用，用戶不再需要記住登錄每個網站和個人設備的賬號信息。

The Web Authentication (WebAuthn) standard is designed to replace the password with biometrics and devices that users already own, such as a security key, a smartphone, a fingerprint scanner or webcam.
這種“網絡認證”標準旨在使用生物識別和用戶已有的設備替代密碼，比如安全密鑰、智能手機、指紋掃描儀和網絡攝像頭。

Instead of having to remember an increasingly long string of characters, users can authenticate their login with their body or something they have in their possession, communicating directly with the website via Bluetooth, USB or NFC.
用戶無需再記憶越來越冗長的密碼，而可以使用身體特徵或者已有設備認證其登錄信息，通過藍牙、USB接口或近場通信技術直接完成在線身份認證。

“WebAuthn will change the way that people access the Web,” said Jeff Jaffe, chief executive of the World Wide Web Consortium (W3C), the body that controls web standards.
網絡標準機構萬維網聯盟的董事長傑夫-賈福爾說：“網絡認證能改變人們的上網方式。”

One example of how WebAuthn will work is that when a user visits a site they want to log into, they input a user name and then get an alert on their smartphone. Tapping on the alert on their phone then logs them into the website without the need for a password.
舉個例子，如果一名用戶想用電腦登錄訪問一家網站，他們可以輸入用戶名，之後就會在智能手機上收到提示。點擊手機上的提示信息就可以順利登錄網站，無需輸入密碼。

WebAuthn promises to protect users against phishing attacks and the use of stolen credentials as there will be nothing to steal, the authentication token is generated and used once by their specific device each time the user logs in.
“網絡認證”標準將使用戶無需擔心受到網絡釣魚攻擊，也不用擔心認證信息被盜用，因爲本身就沒什麼可偷的。每次用戶登錄網站，都會生成特定設備纔可使用的一次性身份認證指令。

“After years of increasingly severe data breaches and password credential theft, now is the time for service providers to end their dependency on vulnerable passwords and one-time-passcodes and adopt phishing-resistant FIDO Authentication for all websites and applications,” said Brett McDowell, executive director of the FIDO Alliance, one of the bodies pushing the new standard.
推動新標準實行的機構之一FIDO聯盟（線上快速身份認證聯盟）的執行董事佈雷特-麥克道爾說：“這些年來數據泄露和密碼信息被盜的情況越來越嚴重，現在服務提供商是時候結束他們對易受攻擊的密碼和一次性密碼的依賴，並在所有網站和應用中使用可防止網絡釣魚的線上快速身份認證了。”

WebAuthn should also help people use unique login details for each and every service they use, instead of using the same login and password for every site, which many people still do leaving them vulnerable to further attacks if one site is hacked.
“網絡認證”標準還幫助人們爲每個設備使用獨一無二的登錄信息，而不是針對每個網站都使用相同的登錄名和密碼。如果其中一個網站被黑，很多用戶的登錄名和密碼都可能遭到進一步攻擊。

The W3C has moved WebAuthn to what’s called the “candidate recommendation” stage – the penultimate step before it becomes an approved web standard – inviting sites and services to begin implementing it. The web standards body announced that Google, Microsoft and Mozilla had committed to supporting WebAuthn, meaning that all major web browsers short of Apple’s Safari will implement the new standard.
萬維網聯盟已將“網絡認證”標準列入“候選推薦”階段，這是互聯網標準最終獲得認可、邀請網站和設備開始應用之前的倒數第二個階段。萬維網聯盟宣佈，谷歌、微軟和摩斯拉（火狐）已決心致力於支持這一標準，這意味着除了蘋果公司的Safari瀏覽器外，所有的主流瀏覽器都將實施這一新標準。

“While there are many web security problems and we can’t fix them all, relying on passwords is one of the weakest links. With WebAuthn’s multi-factor solutions we are eliminating this weak link,” said Jaffe.
賈福爾說：“儘管互聯網安全存在諸多問題，我們也無法全部解決，但依賴密碼是其中最薄弱的環節。通過網絡認證標準的多因素解決方案，我們將消除這一薄弱環節。”

Several sites and services already use similar methods to log in, including Google and Facebook, which can both be logged into using a USB security key. But a single cross-platform, cross-service standard ratified by the W3C will mean that many more sites and services will be able to kill the password as the defacto login method.
已有數家網站和多種設備使用類似的登錄方式，谷歌和臉書等網站用戶可以選擇使用USB安全密鑰登錄。但互聯網聯盟批准的單一跨平臺、跨設備標準意味着將有越來越多的網站和設備取消密碼這種實際登錄辦法。

WebAuthn is the culmination of many years of work and the change will not happen overnight. But as it increasingly seems inevitable that our email or other online services will get hacked into, removing the password is an important step in improving online security and making using sites and services easier.
“網絡認證”標準是數年成就積累的頂峯，這種改變並非一蹴而就。但隨着電子郵件和其他網絡服務被黑客入侵越發不可避免，消除密碼是提升網絡安全、讓網站和設備使用更加便捷的重要一步。