Topic starter
22/06/2026 4:56 pm
TL;DR: FIDO2 combines WebAuthn and CTAP to deliver phishing-resistant, public-key authentication with hardware-protected private keys, supporting both platform authenticators and roaming security keys, according to Scramble ID. The architectural shift matters because authentication no longer depends on shared secrets, but recovery, proofing, and authorization still remain separate governance problems.
Editorial analysis by NHI Mgmt Group, based on content published by Scramble ID: “What Is FIDO2? The Open Standard Behind Passkeys, WebAuthn, and Phishing-Resistant Authentication”.
Key questions
Q: How should IAM teams implement FIDO2 without weakening account proofing?
A: Treat FIDO2 as the authentication layer, not the identity proofing layer.
Q: Why do passwordless logins still need recovery and fallback controls?
A: Because losing an authenticator does not remove the need to regain access.
Q: What breaks when organisations treat FIDO2 as a complete access-control solution?
A: Authentication becomes stronger, but authorization and lifecycle governance remain unresolved.
Practitioner guidance
- Define registration proofing rules Require explicit identity proofing before the first FIDO2 credential is bound to an account, and separate proofing decisions from the authentication ceremony itself.
- Set authenticator policy by assurance level Specify where platform authenticators are acceptable and where roaming security keys are mandatory, based on the sensitivity of the application and the recovery model.
- Design recovery before rollout Create lost-device, replacement, and fallback workflows that preserve assurance without reintroducing shared secrets or weak recovery paths.
Bottom line: FIDO2 replaces password-style shared secrets with origin-bound public-key authentication, which materially reduces phishing exposure.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/06/2026 5:07 pm
Passwordless authentication removes shared-secret exposure, but it does not remove identity governance. FIDO2 shifts the risk boundary from password theft to credential issuance, recovery, and policy enforcement. The useful insight for IAM teams is that stronger authentication and stronger identity governance are not the same control.
A few things that frame the scale:
- The IBM/Ponemon 2025 Cost of a Data Breach Report found that phishing-initiated breaches cost an average of $4.8M each.
A question worth separating out:
Q: What is the difference between platform authenticators and roaming authenticators for passkeys?
A: Platform authenticators are built into a device or operating system, while roaming authenticators are removable devices such as hardware keys. Platform authenticators are more likely to support cloud syncing and resident key behaviour, which improves discoverability and cross device use. Roaming authenticators can be more portable, but support varies and may limit the seamless experience users expect.
👉 Read our full editorial: FIDO2 and passwordless authentication: what IAM teams need to know