Passwordless Auth: WebAuthn and FIDO2

FIDO2 is the umbrella term for the W3C Web Authentication specification (WebAuthn) combined with the FIDO Alliance's Client-to-Authenticator Protocol 2 (CTAP2). Together they define a complete passwordless authentication system using public-key cryptography bound to the relying party origin.

FIDO2 supports two authenticator categories. Platform authenticators are built into the device: Touch ID and Face ID on Apple devices, Windows Hello on Windows. Roaming authenticators are external hardware tokens: YubiKey, Google Titan Key, Feitian keys. All use public-key cryptography and generate attestation statements.

During WebAuthn registration, the authenticator generates a new asymmetric key pair for the relying party. The public key is sent to the server and stored. The private key never leaves the authenticator. An attestation statement proves the authenticator's type and that the key was generated inside the authenticator hardware.

During WebAuthn authentication, the server sends a challenge to the client. The authenticator signs the challenge along with the relying party ID and client data using the stored private key. The server verifies the signature with the stored public key. No shared secret is transmitted at any point.

The relying party ID in a WebAuthn assertion is cryptographically bound to the origin (domain) of the requesting page. An authenticator will refuse to sign an assertion for a different origin than the one it was registered with. This makes WebAuthn phishing-resistant by construction: a fake phishing site cannot complete the authentication.

Discoverable credentials (formerly resident keys) are stored on the authenticator itself and indexed by the relying party ID. This enables true passwordless flows: the user presents their authenticator, selects their account from credentials stored on the device, and authenticates without entering a username or password.

WebAuthn distinguishes between user verification (UV) and user presence (UP). User presence requires only that the user touch or tap the authenticator. User verification additionally requires a PIN or biometric check, proving the specific person is present. High-security applications should require UV for authentication.

CTAP2 defines the protocol between the client (browser or OS) and an external roaming authenticator over USB, NFC, or BLE. It specifies the commands for credential creation, assertion generation, and authenticator management. CTAP2.1 adds features like credential management and always-UV policies.

Passkeys are discoverable WebAuthn credentials that synchronize across a user's devices via the platform vendor's encrypted cloud (iCloud Keychain for Apple, Google Password Manager, Windows Hello for Business). Passkeys provide passwordless authentication with cross-device availability, combining security with the convenience users expect from passwords.

A typical passkey authentication flow: the user visits a website and clicks "Sign in with passkey." The browser shows available passkeys for the site. The user authenticates with biometrics (Face ID, Touch ID, Windows Hello). The browser signs the challenge and sends the assertion. The entire flow takes seconds with no password entry.

Traditional passwords: phishable, reusable, crackable from database breaches. OTP codes (TOTP): phishable in real-time. SMS codes: SIM-swappable, phishable. WebAuthn/passkeys: phishing-resistant via origin binding, no server-side secret to steal, unique per site, hardware-protected private keys. WebAuthn is the strongest widely-deployed authentication mechanism available today.

Which WebAuthn property makes it fundamentally resistant to phishing attacks, unlike passwords or TOTP codes?

FIDO2 combines WebAuthn (W3C) and CTAP2 (FIDO Alliance) for phishing-resistant passwordless authentication. Platform authenticators (Touch ID, Face ID) and roaming authenticators (YubiKey) use public-key cryptography bound to the relying party origin. Passkeys extend this with cross-device sync. WebAuthn provides the strongest widely-available authentication security today.