🔐

FIDO2 & Passkeys: Passwordless Authentication

Medium

Free preview · 2 of 5 steps

FIDO2: no password, no phishing, no replay

FIDO2 (WebAuthn + CTAP) replaces passwords with public key cryptography. The authenticator (hardware key, phone Face ID, laptop fingerprint) holds the private key — it never leaves the device.

Authentication proves possession of the private key via a challenge-response. Because the key pair is bound to the specific site's origin, FIDO2 is completely phishing-proof — a fake login page can't trick it.

Packets in motion — click to inspect:

1 / 2

Space to play/pause · ← → to step