What it means
FIDO2 is an authentication ecosystem built around public-key cryptography. WebAuthn is the web standard that lets browsers and applications request and use public-key credentials. Authenticators may be hardware security keys, platform authenticators built into devices, or synchronized passkey providers.
How it works
During registration, the authenticator creates a unique key pair for the service. The private key remains protected by the authenticator, while the service stores the public key. During sign-in, the authenticator signs a challenge tied to the service's origin, helping prevent credential replay and phishing at an imitation site.
A security key registered to an organization's real domain will not produce a valid assertion for a look-alike phishing domain. The user may still be deceived in other ways, but the authenticator resists sending a reusable shared secret to the wrong site.
Practical focus
- Verify relying-party identifiers and origin handling
- Plan enrollment, recovery, replacement, and lost-device procedures
- Support multiple authenticators for high-value accounts
- Prefer user-verifying, phishing-resistant authenticators for privileged access
Common mistakes
- Assuming every passwordless method is phishing-resistant
- Deploying strong sign-in while leaving weak recovery channels
- Failing to test browser, device, and accessibility requirements
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: