[5.0] Rename Login with Web Authentication to Login with Passkeys

[brianteeman]

Pull Request for Issue #41077 .

Summary of Changes

Change verbage and change image used in the admin

• note for b/c this adds a new image instead of replacing an existing one
• this is made against 5.0 as technicaly its a breaking change

Testing Instructions

Code review the text to make sure that it still makes sense

• note that its tricky to know when it should be passkey and when passkeys - I went with my gut

cc @nikosdion

All docs will need updating/reviewing if this PR is accepted

Link to documentations

Please select:

• Documentation link for docs.joomla.org:

• No documentation changes for docs.joomla.org needed

• Pull Request link for manual.joomla.org: <link>

• No documentation changes for manual.joomla.org needed

[HLeithner]

Isn't Passkeys not only a implementation variant of Webauthn used as marketing term by MS, Apple, Google for Synced variant of webauthn ? Not sure if it make sense to rename it, maybe all add it as alternative name?

[brianteeman]

Isn't Passkeys not only a implementation variant of Webauthn used as marketing term by MS, Apple, Google for Synced variant of webauthn ? Not sure if it make sense to rename it, maybe all add it as alternative name?

See original issue for explanation

[nikosdion]

@HLeithner It is, but this is really how people will be expected to use it. In a future Joomla version (maybe 6?) we can modify the passwordless login plugin to request only resident keys from the browser. This will remove the requirement for entering the username.

The reason we had not implemented this yet is that hardware authenticators have a very limited memory for resident keys (Yubico only adds 10 slots in their keys) and back in early 2020 there wasn't even a way to manage them. With the introduction of passkeys this limitation is lifted since the TPM-backed software authenticator in modern browsers and OS can store an unlimited number of keys — and even sync them across devices (and, very soon, across device ecosystems). This will make hardware authenticators largely obsolete for the use cases we have for Joomla.

At the same time, nobody prevents someone from creating an alternative login or MFA plugin which works with generic WebAuthn and hardware authenticators — or, better yet, allow pinning login to specific makes and models of hardware authenticators, something which might be necessary for large organisations with strict regulatory controls.

So, everyone wins in the long run.

[brianteeman]

I have removed the changes to the svg from this PR. Lost motivation to continue with this any further (thanks to the person who sent the abusive message).

This can be merged as is with a later pr for any image change or someone can submit a pr to my branch for the image and I will accept it.

Otherwise I will just close it

[HLeithner]

Based on the style guild "passkey" should be written lowercase (in our case we have some position where we write nouns uppercase even if it's not at the beginning of a sentence), the "passkeys" variant seems to only used if you reference multiple keys. Can you please change to this following the style guide?

[brianteeman]

The style guide says

The word “passkey” is a common noun (think of it the way
you would refer to “password”), and should be written in
lowercase except when beginning a sentence

I have updated the pull request to reflect that. Thanks for pointing it out. Also added it to the style guide joomla/Manual#142

[tecpromotion]

I have tested this item ✅ successfully on 7b4e0c1

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/41085.}

[HLeithner]

I will make 2 changes now and then I would merge it if you are ok with them

[HLeithner]

Hmm created a pr brianteeman#512 but still this image is missing

[brianteeman]

Hmm created a pr brianteeman#512 but still this image is missing !

did you run the build scripts to make sure the image gets moved to the correct folder?

[brianteeman]

you forgot to update plugins\multifactorauth\webauthn\src\Extension\Webauthn.php

98,88:                    
 'image'              => 'media/plg_multifactorauth_webauthn/images/webauthn.svg',

[HLeithner]

you forgot to update plugins\multifactorauth\webauthn\src\Extension\Webauthn.php

98,88:                    
 'image'              => 'media/plg_multifactorauth_webauthn/images/webauthn.svg',

create new images (which is needed for this) image is not my favorite task ;-)

[nikosdion]

@HLeithner Here's the official Passkey logo as an SVG:

<svg viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg" width="1.5em"><circle cx="10.5" cy="6" r="4.5"/><path d="m22.5 10.5a3.5 3.5 0 1 0 -5 3.15v5.35l1.5 1.5 2.5-2.5-1.5-1.5 1.5-1.5-1.24-1.24a3.5 3.5 0 0 0 2.24-3.26zm-3.5 0a1 1 0 1 1 1-1 1 1 0 0 1 -1 1z"/><path d="m14.44 12.52a6 6 0 0 0 -2.44-.52h-3a6 6 0 0 0 -6 6v2h13v-5.51a5.16 5.16 0 0 1 -1.56-1.97z"/></svg>

[HLeithner]

@brianteeman sorry I think pushed to the wrong branch but the images is now included thanks to @crystalenka

[HLeithner]

Thanks