Fido

FIDO, short for Fast Identity Online, is an open industry standard and ecosystem aimed at enabling passwordless, phishing-resistant authentication. The FIDO Alliance, formed in 2012 by companies such as PayPal, Lenovo, and Nok Nok Labs, develops specifications and interoperability guidelines to create login experiences that reduce reliance on passwords across devices and services.

The current FIDO2 family consists of Web Authentication (WebAuthn), a W3C standard, and the Client To Authenticator Protocol (CTAP), which connects authenticators to client devices. Older FIDO specifications include Universal Authentication Framework (UAF) and Universal 2nd Factor (U2F). Together, these standards use public-key cryptography to enable credentials stored on authenticators, supporting both platform and roaming devices.

During registration, a new public key credential is created and associated with a service. The private key remains on the authenticator and is used to sign challenges presented by the service during login. The result proves possession of the private key and the origin of the relying party, without transmitting a password. Attestation data may be provided by the authenticator to indicate device characteristics, though privacy controls exist.

Adoption is extensive across major browsers and platforms, with support for USB security keys, built-in biometric sensors, and wireless authenticators. FIDO2 credentials are designed to be phishing-resistant and resistant to credential theft, while loss of an authenticator requires recovery procedures. Ongoing work focuses on interoperability, privacy enhancements, and expanding use cases in consumer and enterprise environments.