Topic starter
22/06/2026 4:56 pm
TL;DR: FIDO2’s move to origin-bound public-key authentication reduces phishing exposure, with Scramble ID highlighting hardware-protected private keys and support for platform and roaming authenticators. IAM programs still have to govern proofing, recovery, and authorization separately so stronger login ceremonies do not attach to the wrong account.
Editorial analysis by NHI Mgmt Group, based on content published by Scramble ID: “What Is FIDO2? The Open Standard Behind Passkeys, WebAuthn, and Phishing-Resistant Authentication”.
Key questions
Q: Why do passwordless logins still need recovery and fallback controls?
A: Because losing an authenticator does not remove the need to regain access.
Q: What breaks when organisations treat FIDO2 as a complete access-control solution?
A: Authentication becomes stronger, but authorization and lifecycle governance remain unresolved.
Q: How should IAM teams implement FIDO2 without weakening account proofing?
A: Treat FIDO2 as the authentication layer, not the identity proofing layer.
Practitioner guidance
- Define registration proofing rules Require explicit identity proofing before the first FIDO2 credential is bound to an account, and separate proofing decisions from the authentication ceremony itself.
- Set authenticator policy by assurance level Specify where platform authenticators are acceptable and where roaming security keys are mandatory, based on the sensitivity of the application and the recovery model.
- Design recovery before rollout Create lost-device, replacement, and fallback workflows that preserve assurance without reintroducing shared secrets or weak recovery paths.
Bottom line: FIDO2 replaces password-style shared secrets with origin-bound public-key authentication, which materially reduces phishing exposure.
Glossary terms: FIDO2, WebAuthn, CTAP, Passkey
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 21 hours ago by NHI Mgmt Group
22/06/2026 5:07 pm
Passwordless authentication removes shared-secret exposure, but it does not remove identity governance. FIDO2 shifts the risk boundary from password theft to credential issuance, recovery, and policy enforcement. The useful insight for IAM teams is that stronger authentication and stronger identity governance are not the same control.
A few things that frame the scale:
- The IBM/Ponemon 2025 Cost of a Data Breach Report found that phishing-initiated breaches cost an average of $4.8M each.
A question worth separating out:
Q: What is the difference between platform authenticators and roaming authenticators for passkeys?
A: Platform authenticators are built into a device or operating system, while roaming authenticators are removable devices such as hardware keys. Platform authenticators are more likely to support cloud syncing and resident key behaviour, which improves discoverability and cross device use. Roaming authenticators can be more portable, but support varies and may limit the seamless experience users expect.
👉 Read our full editorial: FIDO2 shifts IAM risk from phishing to identity governance
This post was modified 21 hours ago by NHI Mgmt Group