Most multi-factor authentication can be phished. Push prompts get fatigued into approval, SMS gets intercepted or socially engineered, and one-time codes get relayed through fake login pages in real time. FIDO2 is the standards answer to that entire attack class, and it is the machinery behind both hardware security keys and the passkeys now shipping on every major platform.
How it works, in one paragraph
FIDO2 pairs two specifications: WebAuthn, the W3C browser API, and CTAP, the protocol between the browser and an authenticator (a USB or NFC security key, or the phone and laptop platform authenticators behind passkeys). At registration, the authenticator generates a key pair scoped to the site’s origin; at login, it signs a challenge, unlocked locally by a PIN or biometric. Nothing shared ever leaves the device, and because the credential is bound to the real origin, a convincing fake login page gets nothing to steal. The phishing resistance is structural, not a matter of user vigilance.
Security keys or passkeys?
Same standard, different operational trade-offs. Hardware keys, the category Yubico defined, offer the strongest story for admin accounts, shared workstations, and regulated environments: a physical, attestable authenticator that never syncs anywhere. Synced passkeys offer the adoption story: no hardware to buy or lose, which is why consumer platforms lead with them, at the cost of anchoring trust to the user’s platform account and its recovery paths. A sensible enterprise pattern is tiered: hardware keys for administrators, privileged access, and the accounts that unlock everything else; passkeys for the broad workforce; and platforms like Duo to orchestrate policy across both alongside legacy MFA during the transition.
Why the security trade should care
Directly: integrators and monitoring providers hold remote access to client sites, and their own accounts are exactly the high-value, phishable targets FIDO2 exists for; cyber insurers have started asking the phishing-resistant question explicitly. Commercially: MFA hardening keeps appearing in assessments, and phishing-resistant is the defensible recommendation. And on the horizon, convergence: the same phone increasingly holds the passkey for the VPN and the mobile credential for the door, and identity teams buying access control increasingly expect the two worlds to be planned together.
What trips people up
Deploying FIDO2 and leaving phishable fallbacks active, which attackers simply downgrade to; the rollout is finished when SMS and OTP are retired for the protected tier, not when keys are handed out. Ignoring account recovery, the honest hard problem: unphishable login with a phishable reset achieves little. And skipping the lost-key drill: hardware key programs need enrolment of a backup authenticator from day one.
How it fits
FIDO2 secures the logical front door the way OSDP secures the reader-to-controller hop: both replace legacy, interceptable exchanges with authenticated cryptography, and both reward deployments that turn the secure mode fully on.
Related guides
- SIA OSDP (IEC 60839-11-5): OSDP: Open Supervised Device Protocol
- PIPEDA: PIPEDA: Privacy Law for Security Systems
References
Last updated 2026-07-24.