Topic Technology
Passkeys
FIDO2 credentials bound to a website's domain. The private key stays on the user's device or in their sync provider, so there is nothing to phish or read out.
Also called: FIDO2, WebAuthn, synced passkeys, security keys
- Official site
- fidoalliance.org
Questions (3) #
- Are synced passkeys phishing-resistant?Identity
Yes.
- How can banks defend against SIM swap fraud?Identity
Stop treating an SMS code as proof of identity for high-risk actions such as password resets, new payees and contact-detail changes.
- What is phishing-resistant MFA?Identity
Phishing-resistant MFA is authentication that a fake website or man-in-the-middle cannot capture and replay, because the credential is cryptographically bound to the real site.
Comparisons (2) #
Checklists (2) #
Glossary #
- FIDO2
- The FIDO Alliance's set of specifications, made up of the W3C's WebAuthn API and FIDO's CTAP protocol, that lets people sign in with public-key cryptography instead of passwords. Passkeys and hardware security keys are both FIDO2 credentials.
- Passkey
- A FIDO2 credential: a key pair where the private key stays on the user's device or in their password manager, and the public key is stored by the website. Because it is bound to the site's domain, it cannot be used on a look-alike phishing site.