What is a Discoverable Credential in WebAuthn?

What is a Discoverable Credential?#

A Discoverable Credential is a type of credential in WebAuthn, often used for passkeys, that is stored directly on the authenticator (e.g., security key like YubiKey, smartphone's secure enclave).

Key Characteristics#

• Stored Locally: Unlike non-resident keys, discoverable credentials are stored on the authenticator itself.
• Easy Identification: They can be identified by the client without requiring user input of credential ID, as they're discoverable by the authenticator for a specific Relying Party ID.
• User Experience Benefits: They offer a streamlined login process, often supporting features like Conditional UI for autofill, enhancing user experience by reducing the need to remember or input user handles,
• Security and Device-Specific Authentication: Tying authentication to a specific device adds an extra security layer.

Limitations#

• Storage Capacity: Authenticators have a finite storage capacity for these keys.
• Risk with Loss of Authenticator: If the authenticator is lost or damaged, all resident keys on that device are also lost.
• Security Risks: Although minimal, there's a risk of key extraction if the authenticator is stolen.

Key Takeaways#

---

Understanding Discoverable Credentials#

• Role in WebAuthn Ecosystem: They are integral to the WebAuthn framework, ensuring secure and user-friendly authentication processes.
• Technical Aspects: They utilize public-private key cryptography, stored directly on the device, offering a more secure form of authentication compared to traditional methods like passwords.
• Usage Scenarios: Ideal for personal devices like smartphones or laptops where frequent authentication is common.

Comparison with Non-Resident Keys#

• Storage: Non-resident keys are not stored on the device but are re-derived each time authentication is needed.
• User Experience: Non-resident keys generally require the user to input a user handle, unlike discoverable credentials.
• Scalability: Non-resident keys offer more scalability as they are not limited by device storage.

Best Practices for Implementing Discoverable Credentials#

• Consider User Base: Ideal for services where users primarily access from personal devices.
• Balance Security and Convenience: While offering enhanced security, be mindful of the potential risks and limitations.
• Educate Users: Inform users about the functionality and benefits of using discoverable credentials.

---

Discoverable Credential FAQs#

What are Discoverable Credentials in WebAuthn?#

• Discoverable Credentials in WebAuthn are types of credentials stored directly on the authenticator, allowing for more secure and user-friendly authentication processes.

How do Discoverable Credentials enhance user experience?#

• They streamline the login process by supporting features like Conditional UI, reducing the need for users to remember or input user handles.

What are the limitations of Discoverable Credentials?#

• Their main limitations include the finite storage capacity of authenticators and the risk of losing access to credentials if the authenticator is lost or compromised.

Are Discoverable Credentials more secure than traditional authentication methods?#

• Yes, they offer enhanced security by storing credentials directly on the device and using public-private key cryptography, making them more secure than traditional password-based methods.

About Corbado

Corbado is the Authentication Intelligence Platform for CIAM teams running consumer authentication at scale. We help you see what IDP logs and generic analytics tools can't: where passkeys, passwords, OTP, social login and fallback journeys succeed, stall or fail, which devices and browsers create friction, and when an OS update silently breaks login. Two products: Corbado Observe layers process mining and observability across authentication journeys. Corbado Connect adds managed passkeys with analytics built in alongside your IDP. VicRoads runs passkeys for 5M+ users with Corbado (+80% passkey activation). Talk to a Passkey Expert →