Unlike password-based systems where a shared secret (password) is held by both users and the website, the private key never leaves the user’s possession. This immediately opened the door for a significant number of vendors to go to market with FIDO2 security devices.Ī FIDO2 security device allows the generation of a cryptographic private/public key pair. In 2019 the World Wide Web Consortium (W3C) adopted the FIDO2 core Web Authentication protocol (WebAuthN) as an official web standard. The FIDO Alliance was founded in July 2012 with a mission to work on creating a passwordless authentication protocol. However, if passwords are to be truly eliminated, any solutions must be standards-based and scalable across the internet. It’s long been recognized that passwords are the weakest link in identity ecosystems and various vendors have implemented passwordless authentication.

The majority will require a user to register and create an account, with access to the account secured with just a username and password. Many websites require users to authenticate to allow access to their services.

John Craddock, Microsoft MVP (speaker, consultant, writer and instructor of the Identity Masterclass) explains the principles of FIDO2 ( F ast IDentity Online)

Fido 2 key