Passkey authentication replaces traditional passwords with a pair of cryptographic keys—public and private. The private key stays on the user’s device, while the public key sits on the server. During login, the server issues a challenge that only the private key can solve, and the response gets verified using the public key. No passwords are transmitted or stored, which reduces the attack surface significantly. Password leaks and brute-force attempts become non-issues because there is no static secret to steal or guess.

FIDO2 is a joint initiative by the FIDO Alliance and the World Wide Web Consortium (W3C) aimed at delivering streamlined, strong authentication without relying on passwords. It defines a set of technical components: WebAuthn and CTAP2 (Client to Authenticator Protocol). WebAuthn standardizes how a web application interacts with an authenticator—often a platform feature like a secure enclave on a phone or a hardware security key. CTAP2 governs how that authenticator communicates with the client device, such as a laptop or smartphone.


More

Biometric Update: FIDO Alliance and India PKI Forum to collaborate on spreading digital security

Biometric Update reports that the FIDO Alliance has established a partnership with India PKI Forum to…

Read More →

Gizmodo: Everything You Need to Know About the Plan to Kill Internet Passwords

In this feature story, Gizmodo’s David Neild highlights FIDO’s WebAuthn standard, the latest push to…

Read More →

ZDNet: ​Windows 10: We’re going to kill off passwords and here’s how, says Microsoft

As part of Microsoft’s efforts to banish ‘​inconvenient, insecure, and expensive’ passwords, ZDNet reports on…

Read More →