FIDO2 / WebAuthn

FIDO2 is the joint FIDO Alliance + W3C standard for passwordless + phishing-resistant authentication composed of: (a) W3C WEB AUTHENTICATION (WebAuthn) Level 3 Recommendation - the browser + relying party API for public-key credential creation + authentication; (b) FIDO CLIENT-TO-AUTHENTICATOR PROTOCOL 2.1 (CTAP2.1) - the protocol between client devices + roaming or platform authenticators; (c) FIDO METADATA SERVICE v3 (MDS3) - the trust + attestation metadata for authenticators including AAGUIDs + status reports + transports + algorithms; (d) DISCOVERABLE CREDENTIALS / PASSKEYS - resident-credential storage on authenticators enabling passwordless workflows + cross-device synchronisation via iCloud Keychain + Google Password Manager + Windows Hello + 1Password / Bitwarden / Dashlane. Core security properties: PHISHING RESISTANCE through origin binding + RP ID validation + channel binding; UNPHISHABLE WITHOUT USER INTERVENTION (no shared secrets); BIOMETRICS + PIN VERIFICATION local to the authenticator (never transmitted); REPLAY RESISTANCE through challenge-based protocol + signature counter + anti-replay timestamping; ENTERPRISE ATTESTATION + AAGUID ALLOWLISTING for managed-device deployments.