FIDO2 is an open authentication standard developed by the FIDO (Fast Identity Online) Alliance to enable passwordless, phishing-resistant user authentication for online services across both desktop and mobile environments. Its primary goal is to eliminate the need for traditional passwords, which are vulnerable to phishing, credential theft, and other common cyberattacks.

Key Features of FIDO2

  • Passwordless Authentication: Users authenticate using methods such as biometrics (fingerprint, facial recognition), PINs, or physical security keys, rather than passwords.
  • Public-Key Cryptography: When registering with a service, the user’s device creates a unique cryptographic key pair. The private key remains securely stored on the user’s device, while the public key is registered with the online service. During login, the device signs a challenge from the service with the private key, and the service verifies it using the public key. The private key never leaves the device, making it highly resistant to theft and phishing.
  • Two Core Components:
    • Web Authentication API (WebAuthn): A web standard that allows browsers and web applications to use FIDO2 authentication.
    • Client-to-Authenticator Protocol (CTAP): Enables external authenticators (like hardware security keys or smartphones) to communicate with client devices via USB, NFC, or Bluetooth.
  • Phishing Resistance: Because authentication is based on possession of a device and/or biometric verification, FIDO2 is highly resistant to phishing and credential replay attacks.
  • Privacy: Biometric data, if used, never leaves the user’s device. Each website receives a unique public key, preventing cross-site tracking.

How FIDO2 Works (Simplified Flow)

  1. Registration: The user registers with an online service using a FIDO2 authenticator (e.g., security key, phone, or built-in biometric sensor). The device generates a unique key pair and shares only the public key with the service.
  2. Authentication: When logging in, the service sends a challenge to the device. The user verifies their identity (e.g., fingerprint, PIN), and the device signs the challenge with the private key. The service verifies the signature using the stored public key, granting access if it matches.

Benefits

  • Stronger Security: Eliminates risks associated with passwords, such as phishing, credential stuffing, and brute-force attacks.
  • User Convenience: Enables fast, simple logins using devices people already own (phones, laptops, security keys).
  • Scalability and Interoperability: Supported by all major browsers and platforms, making it widely deployable.
  • Cost Reduction: Reduces helpdesk and IT costs related to password resets and account recovery.

Real-World Examples

  • Using a security key (like a YubiKey) to log in to a bank account by inserting it into a USB port and tapping it.
  • Authenticating to a website with a fingerprint scan on a smartphone or laptop, with no password required.