FIDO2 is an authentication standard developed by the FIDO Alliance. It is intended to offer a secure and user-friendly alternative to traditional passwords. FIDO2 is based on public key cryptography and enables users to log in to online services without a password. This is done using smartphones, security tokens or biometric data.
The FIDO2 specifications consist of two main components: the Web Authentication (WebAuthn) standard of the World Wide Web Consortium (W3C) and the Client-to-Authenticator Protocol (CTAP) of the FIDO Alliance. WebAuthn enables web applications to add FIDO-based authentication to their platforms. CTAP, on the other hand, regulates communication between devices (such as smartphones or security tokens) and the authentication server.
What advantages does FIDO2 offer?
FIDO2 authentication offers the following advantages over password authentication:
- SecurityFIDO2 login data is unique for each website. They never leave the user's device and are not stored on a server. This eliminates risks such as phishing, password theft and replay attacks.
- ConvenienceUsers use simple, integrated methods such as fingerprint readers or cameras on their devices to log in to a service.
- Data protectionBecause FIDO crypto keys are unique to each website, they cannot be used to track users across different sites. Biometric data never leaves the user's device.
- ScalabilityWebsites can activate FIDO2 with a simple JavaScript API call. Currently, all common browsers such as Chrome, Firefox or Edge support the standard.
How do I integrate FIDO2 into my applications?
Developers who want to integrate FIDO2 authentication into their applications can find resources and implementation instructions on the FIDO Alliance website and can use certified solutions and libraries. Specific implementation examples and open source projects can be found in GitHub repositories, such as the LINE FIDO2 Server-project, which contains a WebAuthn server implementation officially certified by the FIDO Alliance and exemplary relying party applications.
The current status
Google now offers passwordless authentication using passkeys for all its accounts. When logging in with a password and 2-factor authentication, users have been recommended to switch to passkeys since May 2023. On the one hand to simplify login, and on the other to promote the use of passkeys and make them better known:
Alternatively, users can also carry out the changeover themselves at any time. The following four steps are necessary for this:
In August 2023, Google also presented a security-enhanced FIDO2 implementation that is designed to offer greater security against attacks from quantum computers and is therefore well equipped for the future.
WhatsApp has also been able to switch to the passwordless standard since the end of 2023. Apple has supported the standard since iOS version 16 and Microsoft is also increasingly relying on the new passwordless login on Windows 10 and 11 operating systems.
All the requirements have been met and the passwordless future is in the starting blocks. The only thing missing at the moment is the masses who are ready to use this new standard.
https://github.com/line/line-fido2-server
https://www.golem.de/news/google-macht-s-gut-und-danke-fuer-den-phish-2305-173919.html
https://www.heise.de/hintergrund/Bestandsaufnahme-Passwort-Nachfolger-Passkeys-9048722.html
https://blog.google/intl/de-de/unternehmen/technologie/passkeys-101/
https://security.googleblog.com/2023/08/toward-quantum-resilient-security-keys.html
https://www.golem.de/news/meta-whatsapp-fuehrt-passkey-login-ein-2310-178548.html
