Introducing WebAuthn support for secure Dropbox sign in

Dropbox adds WebAuthn to two-step verification

Passwords have a fundamental flaw: every sign-in requires you to reveal the secret to the service you're accessing. That constant exposure creates opportunities for theft, which is why Dropbox has long pushed users toward two-step verification. Today the company is extending that protection by adding support for WebAuthn, the W3C standard for strong web authentication, to its two-step verification flow.

Why security keys beat one-time codes

Traditional two-step verification asks for a one-time code after you submit your username and password. It's easy to adopt, but it doesn't stop phishing. A fake sign-in page can simply request your password and the code, and many users will comply. Dropbox addressed that gap in 2015 by adopting Universal 2nd Factor (U2F) for security keys. With U2F, the key gives Dropbox cryptographic proof that you possess the key and that you're using it on https://www.dropbox.com — not on a lookalike phishing page.

That proof makes security keys a strong second factor, but U2F's reach has been limited by browser and hardware support. WebAuthn, developed jointly by the W3C and FIDO Alliance, standardizes and extends U2F's core ideas. Chrome was for years the only browser supporting U2F; now Firefox and Edge have committed to WebAuthn as well. The new standard also opens the door for built-in authenticators on laptops and phones, which could prompt for a fingerprint or PIN instead of requiring a dedicated key.

What changes for Dropbox users

WebAuthn support means more security key types on more browsers. Firefox 60, releasing May 9th, is the first to work with Dropbox's WebAuthn implementation. Users can both use keys previously registered with U2F and register new keys via WebAuthn. Chrome and Edge support will follow, and Chrome continues to work with U2F keys in the meantime.

The security benefits are significant. WebAuthn secrets never leave the security key, unlike passwords that are transmitted with every sign-in. Before authenticating to Dropbox, the key verifies that you're actually communicating with Dropbox's domain. That mutual check means users can be confident they're signing into the real service, and Dropbox can be confident it's the legitimate account holder.

Passwords aren't going away yet

WebAuthn could theoretically replace passwords entirely: credentials could live on a device, and sign-in would require only a fingerprint scan or PIN. But Dropbox says there are unresolved security and usability questions in that scenario. Enabling WebAuthn as a second factor is the right middle ground for most users right now.

Dropbox points to its Help Center article for instructions on using WebAuthn security keys. Technical readers may want to consult the W3C specification, MDN's Web Authentication documentation, and the joint W3C and FIDO announcement.