In order to connect to any platform, it is necessary to have a good password that protects us from intruders. But access codes by themselves are not going to avoid some methods of attacks that can steal them, such as Phishing or brute force. To prevent someone from entering an online service if you find out the password, two-step authentication is a good option. But different authentication standards have also emerged. In this article we are going to talk about what is FIDO2 and why it is so interesting.

What does FIDO2 consist of

The usual thing is to have a username and put a password. For example to enter social networks such as Facebook, access mail or start a device. What allows the FIDO2 standard is to be able to put aside this traditional method, but without putting security at risk. It is based on two-factor authentication and uses security keys.

FIDO's name comes from Fast Identity Online and it is made up of an alliance of some of the best-known platforms worldwide: Google, Amazon, Facebook or Mozilla, among others. In addition, the standard is also part WebAuthn and the protocol CTAP. It is based on the previous U2F and UAF standard, both made by FIDO.

Now how exactly does it work? Your goal is to allow us let's authenticate on the Internet, for example when using an application or entering a website, without having to put a password. For this we can use a small security key that is connected by USB and NFC connection. But you can also use the mobile phone to authenticate yourself.

Basically it will allow you to use your mobile, for example, to authenticate yourself on the Internet and carry out transactions, log in, etc. Instead of having to put a password, you identify yourself by this means. For this you can use the fingerprint on the phone, for example. The main change from FIDO2 was that this authentication can also be enabled in web environments.

How it works

The first thing necessary is create a record on a FIDO2 compatible platform or application. For example, the program to enter the bank or Facebook. This will generate a key pair: one private and one public FIDO2. The first is going to be stored on the device and the second, the public one, is going to be stored in the database of that service to which we registered. The private one will only be available on the client side.

The first time you enter In that application, you will have to put the traditional credentials. That is, you will have to put your username and password that you have created. With that key you will always be able to enter. But once you enter, the program will give you the option to enable access through biometric data. It is at this point that cryptographic keys are exchanged.

From there, once you have configured the option to access with biometric data, you can already log in simply by putting your fingerprint or facial recognition. You enter the browser or application and the process to put the fingerprint will automatically come out and the cryptographic data will be exchanged to authenticate the user based on FIDO2.

Logically, in case you are going to enter that application from another device you will have to put the traditional password or configure another authentication method there. The same would happen if you reset that mobile to the factory values or uninstall the program and reinstall it, since you would have to configure it again with these same steps.

Where it is used

You may use FIDO2 on your day to day or at least have ever used it. Every time you use the mobile phone to enter a social network or bank account and you put your mark, it is based on this protocol. Also when using facial recognition or if you have an external token. It is based on biometric data that is stored on the mobile, computer or any compatible device. When you register your fingerprint, that is stored in the system for later use.

Also used to perform online payments, buy or recharge virtual cards. In these cases you will also have to authenticate yourself, so that the process takes place, and you can do it with these methods without having to put a traditional password.

This is useful since it is not necessary to put the password every time we enter online platforms. Authentication is done locally, with the information stored, and also with that second authentication factor, which would be the fingerprint or facial recognition, for example. It is a safe process and it is present in more and more services.

Keep in mind that it is not available in all types of applications, but its use is increasing. Surely you can see it in your bank's program, in some social network that you use and the like.

What advantages does it have

You may be wondering what advantages this type of authentication has over traditional passwords. The truth is that there are several interesting points that make the FIDO2 protocol very useful today, but that it will be more as more services come together and support this functionality to authenticate.

The first clear advantage is the comfort and speed. Think about having to put the password every time you access Facebook, the bank account or any application of this type. You are going to waste time and you are also going to have to remember what the password is. Instead, thanks to FIDO2 you simply have to put your fingerprint or facial recognition, in addition to being able to use a security key, and thus log in quickly.

Another positive point is the security. On the one hand, we are going to avoid having to expose passwords so much by not having to constantly log in with them. This will make you less risk of having a Phishing attack or being the victim of a keylogger that can record access codes. Thanks to this protocol, those keys will only be unlocked on that specific device.

Although in relation to the two previous advantages, a third would be to be able to use the same authentication to many applications. That is, for example you could have five bank accounts and each of them have a different password ( which would be the right thing ). You would have to put each of those keys to enter. Instead, thanks to this protocol, simply put your fingerprint or use facial recognition and you can enter all of them in the same way.

Conclusions

As you have seen, FIDO2 is an authentication protocol that serves to put aside traditional passwords and to be able to authenticate ourselves in web applications with total security, comfort and speed. It serves to authenticate us on a device simply by using fingerprint or facial recognition, among others.

Although it is already widely used, its use will surely be extended even more in a few years. We will have more compatible applications and therefore we will be able to use more the different alternatives to traditional passwords that we can use on mobile devices or on the computer to enter online accounts.