Cloudflare Adds WebAuthn Security Key Support for Account Login
Cloudflare has announced support for security keys as a second factor authentication (2FA) method across its user accounts. Customers using WebAuthn-enabled browsers can now register hardware keys—such as YubiKeys—or platform biometrics like Apple Touch ID to log into the Cloudflare dashboard. The company recommends registering multiple keys and alternative 2FA methods to maintain access across different devices and browsers.
What WebAuthn Brings to Authentication
WebAuthn is a standardized authentication protocol based on public key cryptography, developed under the FIDO2 Project and backwards compatible with FIDO U2F. During registration, an authenticator (the security key or biometric device) generates a public/private keypair that stays scoped to a specific relying party domain and user account. The public key is shared with the relying party—in this case, Cloudflare—for storage, while the private key never leaves the device.
At login, the relying party sends a randomly generated challenge to the authenticator. The user must perform a physical interaction—a tap, touch, or PIN entry—to authorize signing the challenge with the private key. The relying party then verifies the signed challenge against the stored public key to complete authentication.
Why Security Keys Outperform Other 2FA Methods
Security keys offer a fundamentally different threat model compared to app-based or SMS-based verification. Because authentication depends on a physical token, remote attackers cannot easily impersonate a victim without possessing the hardware. This eliminates attack vectors like SIM swapping that target phone-number-based verification.
The user experience is also improved. Security keys avoid the common friction of retrieving a phone, opening an authentication app, and copying a time-sensitive passcode—replacing those steps with a single tap on hardware that may already be attached to the device.
WebAuthn's strongest advantage, however, is its built-in phishing resistance. Credentials are bound to a specific domain during creation. If an attacker builds a convincing lookalike site—say, cloudfare[.]com instead of cloudflare[.]com—the authenticator will search for credentials scoped to that fraudulent domain, fail to find any, and refuse to sign the challenge. This blocks both straightforward credential theft and more sophisticated on-path proxy attacks used by tools like evilginx. Google's research has classified hardware security keys among the most effective authentication methods available for this reason.
Privacy and Storage Benefits
WebAuthn provides strict privacy guarantees. When a user authenticates with a biometric key such as Touch ID or Windows Hello, the relying party never receives biometric data; the communication between the authenticator and browser remains isolated from the browser's connection to the site. Credentials are also scoped to individual relying parties, preventing a malicious site from tracking a user's activity across other domains or enumerating which services they use.
For service providers, the storage burden is minimal. Relying parties only need to keep the user's public key, which is useless to an attacker without the corresponding private key. This is notably safer than TOTP implementations, which require careful handling of secret seeds that generate all subsequent passcodes.
Cloudflare notes that accounts using Single Sign-On (SSO) will not see the 2FA option, since the SSO provider manages those authentication methods.
