What is User Presence in WebAuthn?

What is User Presence?#

User Presence in WebAuthn is a fundamental component, distinct from User Verification, focusing on establishing that a user is physically engaging with the authentication process. This basic yet crucial feature includes:

• Simple Interaction: Typically involves the user touching the authenticator, without the need for entering a PIN or biometric data.
• Functionality: Aims to confirm that the user is physically present, rather than verifying their specific identity.
• Security Implication: Indicates user engagement in the authentication process, but does not uniquely identify the user, unlike User Verification.

For more details, we recommend taking a look at our recent blog post about WebAuthn User Verification & User Presence for Passkeys.

Key Takeaways#

---

User Presence in WebAuthn plays a pivotal role in establishing the engagement of a user during an authentication ceremony. While it does not ascertain the identity of the user, its requirement for physical interaction serves as a primary check in the authentication flow.

Detailed Insights#

• Process and Modalities: Involves basic gestures like touching the authenticator, which is generally mandatory for authentication.
• Comparison with User Verification: Unlike User Verification, User Presence does not involve authorization gestures like biometrics or PINs. It is a simpler, yet essential, test of physical user engagement.
• Implementation in Authentication Flow: User Presence can be combined with User Verification for stronger security, particularly in passwordless or multi-factor authentication scenarios.

---

User Presence FAQs#

What is the primary function of User Presence in WebAuthn?#

User Presence ensures that the user is physically present and interacting with the authenticator during the authentication process.

How does User Presence differ from User Verification in WebAuthn?#

User Presence confirms physical interaction with the authenticator, while User Verification authenticates the user's identity through methods like PINs or biometrics.

In what scenarios is User Presence particularly important in WebAuthn?#

User Presence is crucial in second-factor authentication (2FA) scenarios to ensure the user's physical interaction with the authenticator, complementing other security measures.

About Corbado

Corbado is the Passkey Intelligence Platform for CIAM teams running consumer authentication at scale. We help you see what IDP logs and generic analytics tools can't: which devices, OS versions, browsers and credential managers support passkeys, why enrollments don't turn into logins, where the WebAuthn flow fails and when an OS / browser update silently breaks login, all without replacing Okta, Auth0, Ping, Cognito or your in-house IDP. Two products: Corbado Observe layers observability for passkeys and any other login method. Corbado Connect adds managed passkeys with analytics built in (alongside your IDP). VicRoads runs passkeys for 5M+ users with Corbado (+80% passkey activation). Talk to a Passkey Expert →