Understanding FIDO2 Authentication Protections
FIDO2 is an open authentication standard that enables passwordless authentication by giving users options such as biometrics, USB tokens, and passkeys to log into servers and websites, explains Jai Vijayan.
FIDO2 is considered a robust protocol for protecting against phishing, man-in-the-middle (MITM), and session-hijacking attacks, Vijayan says, but this protection can be undermined, according to research from Silverfort.
"We're concerned that organizations will have a false sense of security that they are completely protected from a MITM attack if they use FIDO2," says Silverfort’s Dor Segal. “While the authentication itself is protected, the session it enables is not.”
In this article, Segal outlines a WebAuthn authentication flow and explains the protections of FIDO2, noting mitigation techniques you can use.
Learn more at Dark Reading.
Related content
-
Multifactor authentication from FIDO
The FIDO Alliance is working to build open solutions for the future of authentication. -
Secure authentication with FIDO2
The FIDO and FIDO2 standard supports passwordless authentication. We discuss the requirements for the use of FIDO2 and show a sample implementation for a web service. -
Secure passwordless logins with FIDO2 and LDAP
Log in to your account securely without a password with LDAP and a schema to establish the objects and attributes required for FIDO2 authentication. -
Portable home directory with state-of-the-art security
The systemd Homed service makes it easy to move your home directory, and FIDO2 or PKCS#11 can secure the stored files. -
Passkeys eliminate the need for password-based authentication
Passwords are becoming a thing of the past. We look into the basic weaknesses of passwords, explain what passkeys are all about, and assess their practicality.