Grammarly edit

astro/src/content/blog/webauthn.mdx

@@ -23,7 +23,7 @@ I added passkeys to a handful of online services — while registration had some
 
 If anything seems too good to be true, it probably is. The first issue came up when I later tried to log in to GitHub from my Android phone. This is how I learned that a passkey generated and saved with iCloud Keychain via Safari (obviously, in hindsight) does not work on Android.
 
-In this case, the solution was easy: I logged in to GitHub on Android using my trusty old password, and generated a new passkey, this time using my Google account's password manager. Surely, this would allow me to log in using my Google profile in Chrome on Linux too. Turns out that didn't work.
+In this case, the solution was easy: I logged in to GitHub on Android using my trusty old password and generated a new passkey, this time using my Google account's password manager. Surely, this would allow me to log in using my Google profile in Chrome on Linux too. Turns out that didn't work.
 
 I've since found a solution to cross-platform passwordless authentication in the form of a password manager, but I'll discuss that later on in strategies to deal with WebAuthn as a user.
 
@@ -59,7 +59,7 @@ WebAuthn aims to decrease our reliance on passwords, streamline authentication p
 
 ## What is WebAuthn?
 
-WebAuthn, short for Web Authentication, is a web standard that enables online users to perform authentication through cryptographic proof, using credentials generated by their devices. This authentication process doesn't require a password, and instead verifies the user through biometrics.
+WebAuthn, short for Web Authentication, is a web standard that enables online users to perform authentication through cryptographic proof, using credentials generated by their devices. This authentication process doesn't require a password and instead verifies the user through biometrics.
 
 ### The FIDO Alliance
 
@@ -73,11 +73,11 @@ Changes to the WebAuthn specification happen through an established process that
 
 ### How browsers implement the API
 
-Just as with HTML and CSS, each web browser may choose to support WebAuthn features at their own pace, but there's a strong incentive to stay current: users and developers demand the balanced diet of convenience and security afforded by WebAuthn. Modern browsers are typically quick to implement updates, to make sure users get the latest while the specification evolves.
+Just as with HTML and CSS, each web browser may choose to support WebAuthn features at its own pace, but there's a strong incentive to stay current: users and developers demand the balanced diet of convenience and security afforded by WebAuthn. Modern browsers are typically quick to implement updates, to make sure users get the latest while the specification evolves.
 
 ![Screenshot of Caniuse showing WebAuthn support at 96.36%](/img/blogs/webauthn/webauthn-caniuse.png)
 
-As of early 2024, WebAuthn is supported by browsers of 96.36% of all users.
+As of early 2024, WebAuthn is supported by browsers for 96.36% of all users.
 
 ## The core components of WebAuthn and FIDO2
 
@@ -101,7 +101,7 @@ Even if malicious actors get their hands on your public key, without the corresp
 
 ### The role of web browsers
 
-Web browsers act as the facilitators for the WebAuthn process, but they don't store any of the user's credentials. Instead, they act as the middleman between the authenticator and the relying party. The browser's role is to pass messages between the two, and to ensure that the user is aware of what's happening.
+Web browsers act as the facilitators for the WebAuthn process, but they don't store any of the user's credentials. Instead, they act as the middleman between the authenticator and the relying party. The browser's role is to pass messages between the two and to ensure that the user is aware of what's happening.
 
 ## The processes of WebAuthn
 
@@ -121,7 +121,7 @@ We start by visiting a website that supports WebAuthn. Let's say we're registeri
 
 After you click the **add passkey** button, the relying party asks you to initiate the registration process.
 
-This kicks off a process that ultimately calls the `navigator.credentials.create()` method, which is part of the WebAuthn API. This method is responsible for initiating the registration ceremony.
+This kicks off a process that ultimately calls the `navigator.credentials.create()` method that's part of the WebAuthn API. This method is responsible for initiating the registration ceremony.
 
 Parameters passed to the `navigator.credentials.create()` method include the following:
 * `publicKey`: This is a JSON object that contains information about the relying party, such as its name and ID.
@@ -182,7 +182,7 @@ The challenge is a random string that is unique to this authentication attempt,
 Parameters passed to the `navigator.credentials.get()` method include the following:
 * `publicKey`: This is a JSON object that contains information about the relying party, such as its name and ID.
 * `challenge`: A random string generated by the relying party. The authenticator will use this string to generate a digital signature later on.
-* `allowCredentials`: (Optional) A list of credentials that the relying party will accept. This list is typically generated by the relying party when you registered with them, and stored in your account. It's a bit like a list of approved ID cards that the security guard will accept.
+* `allowCredentials`: (Optional) A list of credentials that the relying party will accept. This list is typically generated by the relying party when you register with them, and stored in your account. It's a bit like a list of approved ID cards that the security guard will accept.
 * `userVerification`: (Optional) A string that tells the authenticator whether it should verify the user's identity. It is up to the authenticator to decide whether it will honor this request.
 
 #### Step two: Prompt user for gesture
@@ -259,7 +259,7 @@ Moreover, the tech giant has enabled WebAuthn support for its browser, Microsoft
 
 Equipping your employees with WebAuthn-enabled devices is a great way to ensure that they can use WebAuthn to log in to your company's services. This is especially true if you're using a password manager that supports WebAuthn, such as 1Password.
 
-An alternative strategy is to provide your employees with security keys, such as the YubiKey. These devices can be used to store WebAuthn credentials, and can be used to log in to any service that supports WebAuthn.
+An alternative strategy is to provide your employees with security keys, such as the YubiKey. These devices can be used to store WebAuthn credentials and can be used to log in to any service that supports WebAuthn.
 
 Regardless of which strategy you choose, it's important to educate your employees about the benefits and especially the risks of WebAuthn.
 
@@ -273,7 +273,7 @@ These services benefit from the improved security profile of WebAuthn, and I ben
 
 ### The challenges we'll face
 
-As adoption of WebAuthn grows, so too will the challenges encountered by both users and organizations.
+As the adoption of WebAuthn grows, so too will the challenges encountered by both users and organizations.
 
 A critical issue lurking behind the newfound convenience is the heavy reliance on specific devices: a smartphone, tablet, or security key holds the keys to one's digital life. If devices are lost, damaged, or replaced without a proper backup strategy, users could find themselves locked out of their accounts.
 
@@ -295,8 +295,8 @@ Users might also still be tricked into using phishing sites with their passwords
 
 With the usability and education issues ironed out, WebAuthn has the potential to greatly improve online security for users and organizations alike. It's a promising step towards a passwordless future, but it's not a silver bullet. For now, I'll treat it as a welcome addition to my security arsenal, but I'll keep my password manager close at hand.
 
-If you're curious about the shift towards a passwordless future, why not dip your toes in the water and give WebAuthn a test drive? Experiencing its potential firsthand might just make you a believer in a world less dependent on passwords. A number of demos are available online where you can safely experiment with the registration and authentication processes. One such example is the [WebAuthn.io](https://webauthn.io/) demo developed by Duo Security, which is a user-friendly way to understand the mechanics of WebAuthn in a controlled, educational environment. As with any new technology, there's no substitute for hands-on experience, and I encourage you to explore these demos and consider the possibilities for your own web applications.
+If you're curious about the shift towards a passwordless future, why not dip your toes in the water and give WebAuthn a test drive? Experiencing its potential firsthand might just make you a believer in a world less dependent on passwords. Several demos are available online where you can safely experiment with the registration and authentication processes. One such example is the [WebAuthn.io](https://webauthn.io/) demo developed by Duo Security, which is a user-friendly way to understand the mechanics of WebAuthn in a controlled, educational environment. As with any new technology, there's no substitute for hands-on experience, and I encourage you to explore these demos and consider the possibilities for your web applications.
 
 We've written a lot about WebAuthn and passwordless authentication. If you're interested in learning more, check out our open-source [WebAuthn.wtf](https://webauthn.wtf/) site, where we explore the history, mechanics, and future of WebAuthn.
 
-Finally, I recommend consulting the [WebAuthn specification](https://www.w3.org/TR/webauthn-3/) if you're looking to learn more about specific technical details of WebAuthn. Taken as a whole, the specification is daunting, but it is easy to find specific explanations and examples for each step of the process.
+Finally, I recommend consulting the [WebAuthn specification](https://www.w3.org/TR/webauthn-3/) if you're looking to learn more about specific technical details of WebAuthn. Taken as a whole the specification is daunting, but it is easy to find specific explanations and examples for each step of the process.