Push and Hardware Keys
FIDO2 and security keys.
Push and Hardware Keys is a free Cyber Security Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Beyond Typed Codes
Typed OTP codes work but are clumsy and phishable. Two stronger possession factors improve the experience and security: push approvals and hardware security keys.
Push Notifications
Push-based MFA sends a prompt to your phone. You tap Approve or Deny instead of typing a code.
It is convenient and the server confirms the response cryptographically.
MFA Fatigue
Push prompts are vulnerable to MFA fatigue (push bombing): attackers spam approvals hoping the user taps Approve out of annoyance.
Defense: number matching, where the user must enter a number shown on the login screen.
Hardware Security Keys
A hardware security key is a small physical device (USB, NFC, or Bluetooth) that performs cryptographic authentication.
The private key never leaves the device, making it extremely resistant to theft.
FIDO2 and WebAuthn
FIDO2 is the open standard behind modern security keys. Its web side is the WebAuthn browser API.
Together they let a site authenticate users with public-key cryptography instead of shared secrets.
How FIDO2 Works
At registration, the key generates a unique key pair per site and gives the site the public key.
At login, the server sends a challenge; the key signs it with the private key. The signature proves possession without revealing any secret.
Origin Binding Stops Phishing
FIDO2 ties each credential to the site's exact origin (domain).
A phishing site at a look-alike domain gets no valid signature, because the key refuses to authenticate to the wrong origin. This is what makes it phishing-resistant.
Passkeys
Passkeys are FIDO2 credentials that can sync across your devices via the platform (phone, laptop).
They aim to replace passwords entirely while keeping the phishing resistance of FIDO2.
User Verification
Security keys can add a local check, called user verification: a PIN or biometric on the device itself.
This combines something you have with something you know or are in one tap.
Choosing a Method
Roughly from weakest to strongest:
- SMS codes (avoid where possible)
- TOTP apps
- Push with number matching
- FIDO2 / passkeys (phishing-resistant)
Deployment Tips
When rolling out hardware keys:
- Register at least two keys per user (one as backup).
- Provide a recovery path that is still phishing-resistant.
- Prefer FIDO2 for high-value accounts.
Quick Check
Why are FIDO2 security keys considered phishing-resistant?
Recap
You learned about stronger possession factors.
- Push is convenient but needs number matching to resist fatigue attacks.
- FIDO2 / passkeys use per-site key pairs and origin binding for phishing resistance.
- Register backup keys.
Next, we look at how MFA can still be bypassed and how to harden it.
Frequently asked questions
Is the “Push and Hardware Keys” lesson free?
Yes — the full text of “Push and Hardware Keys” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.
What will I learn in “Push and Hardware Keys”?
FIDO2 and security keys. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cyber Security Academy?
No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Push and Hardware Keys” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cyber Security Academy lesson?
Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Authentication Factors
- TOTP and HOTP
- Push and Hardware Keys
- MFA Bypass Risks