FIDO2, WebAuthn and CTAP2
All AmbiSecure engineering content tagged FIDO, newest first. Newer entries reflect current thinking; earlier entries come from the engineering archive.
FIDO (Fast IDentity Online) is the open standards family — U2F, FIDO2, and the WebAuthn/CTAP2 pair — that replaces passwords with public-key credentials bound to a hardware authenticator. Its defining property is phishing resistance: the credential is scoped to a relying-party origin and signs a challenge with a key that never leaves the device.
This category collects AmbiSecure engineering writing on FIDO2, WebAuthn ceremonies, CTAP2, attestation, passkeys, and platform-versus-roaming authenticators. The recurring theme is that FIDO moves the authentication secret into tamper-resistant hardware and binds it to the origin, which removes phishing and credential-replay as attack classes.
Articles tagged FIDO
Implementing FIDO2 Authentication — A Complete Developer Guide
Designing Enterprise Passwordless Systems
Passkeys vs Traditional MFA
Platform vs Roaming Authenticators
Understanding WebAuthn Attestation Objects
Why Hardware-Backed Identity Matters
What is Passwordless Authentication?
Fast Identity Online (FIDO)
Frequently asked questions
What is the difference between FIDO2, WebAuthn, and CTAP2?
FIDO2 is the umbrella. WebAuthn is the browser/server API for creating and using credentials; CTAP2 is the protocol between the platform and an external authenticator (like a security key). Together they deliver phishing-resistant public-key login.
Are passkeys the same as FIDO2 credentials?
Passkeys are FIDO2/WebAuthn credentials, often synced across a user's devices by a platform. Hardware-bound (device-resident) passkeys on a security key or smart card offer the strongest, non-exportable variant.
What does attestation prove?
Attestation lets a relying party verify the make/model and security properties of the authenticator that created a credential, so an enterprise can require certified hardware.
What is an AAGUID and why would an administrator care?
It identifies the authenticator model rather than the individual device. Enterprises use it to allow only approved authenticator models and to report on what is deployed across an estate.
What happens if a user loses their only FIDO authenticator?
They fall back to whatever recovery path was designed in advance — a second registered authenticator being the cleanest. Recovery is a design decision in FIDO deployments, not an afterthought.