FIDO2: Why Phishing Emails Don't Work Anymore (Even When Your Team Clicks the Link)
TL;DR:
FIDO2 is what happens when your login no longer involves a password. You tap your finger, look at your camera, or touch a security key -- and you're in.
Think of it like a bank vault key that reshapes every time you touch it. Nobody can copy it. And it only works on this one specific vault -- try it at a fake bank built to look identical, and it just won't fit.
On a good day, your team logs in by face or fingerprint and never sees a password. On a bad day -- the bad day passwords have given us for 30 years -- somebody types theirs into a phishing page that looks legit, and the attacker walks away with everything. FIDO2 makes that bad day stop working, because the credential never leaves your device.
Beyond the Basics:
Here's what's actually happening when you tap your finger or look at your camera.
FIDO2 is two specifications working together: WebAuthn (a W3C standard your browser implements) and CTAP (the protocol that lets the browser talk to your authenticator -- your phone, security key, or laptop's biometric chip). When you set up FIDO2 on a website, three things happen.
- Your device generates a unique key pair just for that site. The private half stays locked on your device, protected by your biometric or PIN. The public half gets registered with the website's identity service (Entra ID, Okta, etc.).
- The website stores only the public half. It can't impersonate you, can't log in as you, and can't leak a useful password if it gets breached. There is no shared secret to steal.
- The key pair is bound to that site's origin. This is the part that kills phishing. If you click a link to fake-microsoft.com instead of microsoft.com, your authenticator simply refuses to respond -- the cryptographic handshake won't even start with the wrong domain.
When you log in, the website sends a random challenge. Your device asks for your fingerprint, face, or PIN, then signs the challenge with the private key for that specific site. Send the signature back. You're in. Three seconds, no codes from your phone, no SMS to intercept.
What runs FIDO2: Windows Hello for Business, Touch ID and Face ID on Apple devices, Android biometrics, hardware security keys (YubiKey, Feitian, Google Titan), and -- most importantly for usability -- passkeys, which are FIDO2 credentials that sync across your Apple, Google, or Microsoft account so you don't lose them when you replace your phone.
Microsoft pushes this hard inside Entra ID. You can enforce phishing-resistant MFA via Conditional Access, require FIDO2-only sign-in for privileged accounts, and start retiring passwords for low-risk users.
The catch: every site you use has to support it, your devices have to support it, and someone in IT has to roll it out. It's not magic, it's not free, and it's not retroactive. But once it's in place, your team can click the phishing link and the phishing link can't do anything with it.