FIDO2

Authentication sits at the center of identity management, yet legacy username/password systems remain both insecure and frustrating to use, with password resets adding significant operational cost. Password compromises are linked to roughly 70–80% of data breaches, while more than three-quarters of users want alternatives. Attempts to “harden” passwords via length, complexity rules, or passphrases have struggled to keep pace with advancing cracking techniques, including machine-learning approaches such as PassGAN. Knowledge-based authentication (security questions), often used for password resets, is highlighted as even weaker than passwords.

Stronger authentication is framed as using at least two factors across “something you have, know, or are.” Traditional cryptographic second-factor devices (smartcards, hardware tokens) can improve security but introduce usability and recovery friction, occasional cryptographic dependency risk, and higher cost—especially problematic for consumer use cases. Smartphones change the feasibility landscape: they are ubiquitous, have sufficient computing power for cryptographic operations, and commonly include built-in biometrics. Mobile biometrics reduce reliance on memory but bring usability tradeoffs and can be attacked with spoofed samples; well-designed systems mitigate this with on-device template matching and Presentation Attack Detection (liveness).

The FIDO Alliance, founded in 2013, addresses interoperability and password overreliance with open standards built on public key cryptography without centralized certificate authorities, generating new key pairs per relying party to improve privacy. Its specifications include passwordless FIDO UAF, second-factor FIDO U2F, and FIDO2 (CTAP2 + W3C WebAuthn), which aligns authentication into the web platform and bridges mobile–web use cases. A structured certification program, including authenticator security levels and biometric component metrics (FAR/FRR and PAD), supports interoperable, security- and privacy-oriented deployments, though migration from UAF/U2F to FIDO2 remains a challenge.

• Password compromises are associated with 70–80% of data breaches.
• User surveys consistently show more than 75% of users want non-password alternatives.
• PassGAN uses Generative Adversarial Network algorithms to target user passwords.
• Knowledge-based authentication is used especially for password reset operations.
• Strong authentication is defined as a combination of at least two factors: something you have, something you know, or something you are.
• The FIDO Alliance launched in February 2013 as a non-profit organization.
• The FIDO Alliance board is made up of 40 organizations.
• Governments listed as members include the US, UK, and Germany.
• FIDO Certified products total 594, including 383 certified for UAF 1.0 and 60 certified for FIDO2.
• FIDO Biometric Component certification measures and publishes False Acceptance Rates (FAR) and False Rejection Rates (FRR) and sets standards for Presentation Attack Detection.

• “Authentication is a core component of identity management.”
• “Legacy username/password-based authentication systems are inherently insecure and suffer from usability issues.”
• “Password resets are expensive, too.”
• “Rainbow tables are yesterday’s news compared to new machine-learning enhanced tools such as PassGAN.”
• “KBA is even less secure than password authentication.”
• “Smartphones have become nearly ubiquitous.”
• “Mobile biometrics represent an interesting alternative in the market.”
• “FIDO’s use of public key cryptography is a bit like PKI without the ‘I’.”
• “New key pairs are generated per-RP, which enhances privacy since data for one RP is not visible to others.”
• “FIDO2 has a lot of momentum in the authentication marketplace.”