How WebAuthn works in Shopify?
All FIDO authenticators use public-key cryptography. During authentication, the user verifies
his identity by displaying his Shopify store's private key. The Shopify Store administrator may
also use attestation to ensure the authenticity of the authenticator used to generate the
private key.
The private key of the authenticator is securely stored on the computer and cannot be stolen. In
contrast, the public key is sent to the Shopify store. If the user wants to check his identity
using the challenge-response protocol, he must prove to the server that he has the private key.
Replacing the Password with WebAuthn
Passwords are vulnerable because they are shared secrets. The idea behind FIDO2 and WebAuthn is to replace passwords with public-key cryptography. If the database containing user credentials is compromised, attackers will only have access to the public keys, which are useless without the corresponding private keys. The private key is kept safe on the computer, while the server monitors the public key and challenges the authenticator.
