Topic starter
10/07/2026 9:23 pm
TL;DR: Using FIDO2 security keys for attendance tracking can reduce reliance on proprietary badge systems while tying time records to stronger authentication, according to Nitrokey. The bigger issue is not convenience but whether organisations are comfortable repurposing identity controls for physical access workflows without weakening assurance or auditability.
Editorial analysis by NHI Mgmt Group, based on content published by Nitrokey: “Streamline Employee Attendance Tracking With Nitrokey, FIDO2 and Odoo”.
Key questions
Q: How should organisations use FIDO2 keys for attendance tracking without weakening identity controls?
A: Treat the attendance event as a governed business record, not just an authentication side effect.
Q: When does using a login authenticator for attendance create more risk than it removes?
A: Risk rises when the same credential is reused across functions without clear lifecycle controls.
Q: What signs show that attendance data is not well governed?
A: Warning signs include manual corrections with no approval trail, unclear ownership between HR and IAM, inconsistent key replacement handling, and attendance records that cannot be tied back to a current employee identity.
Practitioner guidance
- Define the attendance trust model Document whether a FIDO2 attendance event is treated as presence evidence, access evidence, or both, and align controls to that decision before rollout.
- Separate enrolment from record editing Restrict who can bind a security key to an employee and who can correct attendance entries, so identity proof and HR correction do not collapse into one admin path.
- Align offboarding with attendance access Revoke the attendance function at the same point you revoke login access, and verify that replacement keys do not preserve stale attendance authority.
Bottom line: Using a FIDO2 key for attendance changes the control problem from badge management to identity governance.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:46 pm
Attendance tracking becomes an identity assurance problem once it relies on a login credential. The moment a FIDO2 key is reused outside authentication, the organisation is no longer just collecting timestamps. It is turning an identity proof into an operational record, which raises the bar for lifecycle governance, evidence quality, and dispute handling. The practitioner conclusion is simple: the attendance workflow now inherits the same assurance model as the login workflow.
A question worth separating out:
Q: What is the difference between badge-based attendance and FIDO2-based attendance?
A: Badge-based attendance usually proves device possession, while FIDO2-based attendance proves possession of a cryptographic authenticator tied to an enrolled identity. That raises assurance, but it also makes credential lifecycle, revocation, and audit governance more important because the attendance record is now anchored to an identity system.
👉 Read our full editorial: FIDO2-based attendance tracking changes the identity control model