Home › Identity & Access Management
Passkeys (FIDO2 / WebAuthn) Explained
Identity & Access ManagementCISSPSecurity+
Passwords and one-time codes can be phished — passkeys are built so there is nothing to phish. In this video, I'll walk through how passkeys work using the FIDO2 (Fast Identity Online) standard: the key pair behind them, the sign-in flow, why a fake website gets nothing it can use, synced versus device-bound passkeys, and what NIST says about assurance levels.
What you will learn
- What a passkey is, why typed secrets are phishable, and the FIDO2 standard (WebAuthn, short for Web Authentication, plus CTAP)
- The flow — register once, then challenge, unlock and verify at every sign-in
- Why passkeys are phishing-resistant — origin binding, and nothing worth stealing on the server
- Synced vs device-bound passkeys, and cross-device sign-in with a QR code and Bluetooth (CTAP hybrid)
- Assurance — AAL2, AAL3 and attestation under NIST SP 800-63B-4
- Three tip ideas: biometric ≠ sent; fallback ≠ safe; synced ≠ weak