hardwareautentifikatorer

Hardwareautentifikatorer are physical devices used to verify a user’s identity when accessing digital services or systems. They store authentication credentials in secure hardware, isolating them from the host device and offering protection against malware and credential theft. They are commonly used for phishing-resistant logins and can support passwordless workflows.

Common types include USB security keys implementing FIDO2/WebAuthn, smart cards (PIV/CAC), and hardware security modules (HSM) used in servers. Many devices also provide built-in secure elements or TPMs in mobile and desktop platforms. These devices often support unlocking with a local PIN or biometric factor.

Functionally, hardwareautentifikatorer rely on public-key cryptography. During registration, a key pair is generated; the private key stays on the device while the public key is stored by the service. At login, a challenge from the server is signed with the private key, proving possession of the credential without transmitting the private key. This model enables strong resistance to phishing and credential theft, and can enable passwordless authentication when integrated with compatible services.

Adoption spans enterprise IAM, cloud services, VPN access, and secure email or document signing. Standards such as FIDO2 and WebAuthn define interoperability, while government and industry frameworks (e.g., eIDAS, NIST guidelines) influence deployment. Providers may offer account provisioning, revocation, and backup options to address loss or device replacement.

Advantages include strong phishing resistance, portability, and reduced reliance on passwords. Limitations involve acquisition cost, logistics of provisioning and revocation, potential loss or damage, and varying service support requiring fallback methods. Notable examples include YubiKey, SoloKeys, Feitian keys, and devices with integrated secure elements from major vendors.