What is WebAuthn?
WebAuthn (Web Authentication) is an open authentication standard developed by the FIDO Alliance and W3C. It’s supported natively by Apple, Google, Microsoft, and all major browsers. SocketFi builds on WebAuthn because it provides cryptographic-grade authentication without any password or seed phrase that could be stolen, guessed, or lost. WebAuthn uses asymmetric key cryptography: a key pair is generated on the user’s device during registration. The private key stays on the device, protected by the device’s secure hardware. The public key is registered with SocketFi. Future authentications work by signing a server-issued challenge with the private key — only the holder of the private key can produce a valid signature, and the private key never has to leave the device to prove this.Why the private key never leaving the device matters
In traditional password-based systems, authentication requires transmitting a shared secret (the password) to a server, which then verifies it. This creates multiple attack surfaces: the server can be breached, the transmission can be intercepted, and the password can be phished. With passkeys, the private key never moves:Device security hardware
Modern devices protect passkey private keys using dedicated secure hardware:
The operating system enforces that private key material cannot be exported from this hardware, even by malicious software running on the device. To authenticate, the user must physically possess the device and pass its biometric or PIN verification — proving both possession and identity simultaneously.
Registration and authentication flows
Registration creates the passkey credential and binds it to the user’s SocketFi wallet:Security properties
Phishing resistance
Passkey credentials are origin-bound — they are registered to a specific domain (e.g.,app.yourapp.com) and will only respond to authentication requests from that exact origin. A fake phishing site at app-yourapp.com cannot invoke the user’s passkey for app.yourapp.com, because the credential is cryptographically tied to the legitimate origin.
Compare this to passwords, which users can type into any website that asks for them.
Credential theft resistance
Because the private key never leaves the device, there is nothing to steal from a server-side breach. An attacker who compromises SocketFi’s backend gains only public keys — the private keys required to authenticate remain locked in secure hardware on users’ devices.Replay attack protection
Every authentication challenge is unique and single-use. If an attacker intercepts a signed challenge response, they cannot reuse it for a second authentication — the next challenge will be different, and the old signature won’t verify against it. This is combined with SocketFi’s transaction-level nonce system for double-layered replay protection.Passkeys vs. passwords
Passkey wallets vs. seed phrase wallets
SocketFi’s passkey model doesn’t eliminate the need for recovery planning — device loss is still a scenario users need to prepare for. However, recovery replaces the passkey credential without changing the wallet address, meaning users never lose their on-chain identity or assets even if a device is lost.
What SocketFi stores
SocketFi stores only the public key associated with each passkey credential. SocketFi has no access to:- The user’s private key (stored in device secure hardware)
- The user’s biometric data (processed locally by the device)
- The user’s device PIN