A new web standard is expected to kill passwords, meaning users will no longer have to remember difficult logins for each and every website or service they use.\r\nThe Web Authentication (WebAuthn) standard is designed to replace the password with biometrics and devices that users already own, such as a security key, a smartphone, a fingerprint scanner or webcam.\r\nInstead of having to remember an increasingly long string of characters, users can authenticate their login with their body or something they have in their possession, communicating directly with the website via Bluetooth, USB or NFC.\r\n\u201cWebAuthn will change the way that people access the Web,\u201d\u00a0said Jeff Jaffe, chief executive of the World Wide Web Consortium (W3C), the body that controls web standards.\r\nOne example of how WebAuthn will work is that when a user visits a site they want to log into, they input a user name and then get an alert on their smartphone. Tapping on the alert on their phone then logs them into the website without the need for a password.\r\nWebAuthn promises to protect users against phishing attacks and the use of stolen credentials as there will be nothing to steal, the authentication token is generated and used once by their specific device each time the user logs in.\r\n\u201cAfter years of increasingly severe data breaches and password credential theft, now is the time for service providers to end their dependency on vulnerable passwords and one-time-passcodes and adopt phishing-resistant FIDO Authentication for all websites and applications,\u201d said Brett McDowell, executive director of the FIDO Alliance, one of the bodies pushing the new standard.\r\nWebAuthn should also help people use unique login details for each and every service they use, instead of using the same login and password for every site, which many people still do leaving them vulnerable to further attacks if one site is hacked.\r\nThe W3C has moved WebAuthn to what\u2019s called the \u201ccandidate recommendation\u201d stage \u2013 the penultimate step before it becomes an approved web standard \u2013 inviting sites and services to begin implementing it. The web standards body announced that Google,\u00a0Microsoft\u00a0and Mozilla had committed to supporting WebAuthn, meaning that all major web browsers short of Apple\u2019s Safari will implement the new standard.\r\n\u201cWhile there are many web security problems and we can\u2019t fix them all, relying on passwords is one of the weakest links. With WebAuthn\u2019s multi-factor solutions we are eliminating this weak link,\u201d said Jaffe.\r\nSeveral sites and services already use similar methods to log in,\u00a0including Googleand Facebook, which can both be logged into using a USB security key. But a single cross-platform, cross-service standard ratified by the W3C will mean that many more sites and services will be able to kill the password as the defacto login method.\r\nWebAuthn is the culmination of many years of work and the change will not happen overnight. But as it increasingly seems\u00a0inevitable that our email\u00a0or other online services will get hacked into, removing the password is an important step in improving online security and making using sites and services easier.