FIDO2
FIDO2 is a set of specifications from the FIDO Alliance plus W3C. It combines WebAuthn (the browser API) with CTAP (the client-to-authenticator protocol) to enable phishing-resistant authentication using hardware or platform authenticators.
FIDO2 is the standards base under every passkey. The security property that matters is origin binding: the authenticator will only produce a signature for the site that registered the credential, so a proxy phishing page cannot obtain a usable assertion no matter how convincing it looks. That single property defeats the attacker-in-the-middle kits that relay one-time codes and push approvals at scale.
See also: WebAuthn and FIDO2, passkey, phishing-resistant MFA, add passkeys with WebAuthn recipe
Related on Start with Identity
- GlossaryPasswordless
Authentication without a password as a primary factor. Implementations include magic links, OTP codes, and passkeys. Passkeys are the only passwordless method t
- CVEStrongKey FIDO Server credential-type confusion, passkey bypass
StrongKey FIDO Server 4.10.0-4.15.0 confused discoverable and non-discoverable credentials. An attacker can complete passkey authentication as the victim. High.
- CVEWindows stores WebAuthn assertions in cleartext event logs
The Windows Event Logging Service wrote WebAuthn assertions in the clear, readable by unprivileged or remote users. SpecterOps / Grafnetter chained it at Black
- GlossaryWebAuthn
A W3C standard browser API for public-key authentication. WebAuthn is the protocol used by passkeys and FIDO2 security keys. The relying party server stores the
- GlossaryMFA
Multi-Factor Authentication. Requiring two or more factors from distinct categories: something you know (password), something you have (token), something you ar
- BlogGoogle Workspace puts FIDO2 keys into the Windows login, days after Entra makes passkeys default
Google began rolling out FIDO2 security keys as a second factor at Windows sign-in for all Workspace customers on 13 July. Microsoft is making passkeys the defa