FIDO2
also: FIDO, WebAuthn, CTAP
FIDO2 is an open authentication standard that enables passwordless login and two-factor authentication using security keys or biometric devices, verified by the FIDO Alliance.
FIDO2 (Fast Identity Online 2) is a set of open standards for secure, passwordless authentication. It combines the CTAP (Client to Authenticator Protocol) specification with the W3C WebAuthn standard, allowing users to authenticate using hardware security keys, biometrics, or platform authenticators without transmitting passwords over the network.
On Linux, FIDO2 support is typically implemented through libraries like libfido2 and pam-fido2, enabling system login, SSH authentication, and sudo access with security keys. For example, you can register a FIDO2 key for passwordless SSH access: ssh-keygen -t ecdsa-sk generates an SSH key backed by a FIDO2 security key.
FIDO2 is more secure than passwords alone because authentication is cryptographic and phishing-resistant—the key only responds to the correct relying party (domain), preventing credential theft even if a user is tricked into entering credentials on a fake website.