A W3C and FIDO published authentication standards which doesn't rely on storing passwords on servers. The W3C's WebAuthn API and FIDO Alliance's Client-to-Authenticator Protocol (CTAP) is endorsed by Google, Microsoft and Mozilla. Is this the beginning of the end for user passwords?

W3C said WebAuthn is, "an API enabling the creation and use of strong, attested, scoped, public key-based credentials by web applications, for the purpose of strongly authenticating users." It stores the users credential on the users own device and WebAuthn transmits to the web app that the user is authenticated without sending the users credential to the server.

The standardisation effort is also an important part of FIDO's goal of getting rid of passwords, since Web applications get a standard way to interact with biometric authentication in the same way as they would interact with a security key – and without passing the credentials upwards to the Web application.

As the FIDO announcement stated: “User credentials and biometric templates never leave the user’s device and are never stored on servers”. New API Login Standards: WebAuthn and CTAP Published [theregister.co.uk]