https://lesitedefrancois.be/en/tags/mfa/Recent content in Mfa on Le Site de FrançoisHugo -- gohugo.ioen© 2026 Françoishttps://lesitedefrancois.be/en/security/fido/Mon, 01 Jan 0001 00:00:00 +0000https://lesitedefrancois.be/en/security/fido/<p><strong>FIDO2</strong> is the current generation of authentication standards produced jointly by the <strong>FIDO Alliance</strong> and the <strong>W3C</strong>, combining two specifications: <strong>WebAuthn</strong> (Web Authentication API, W3C Level 3, 2025) and <strong>CTAP2</strong> (Client to Authenticator Protocol 2, FIDO Alliance). Its defining security property is <strong>origin binding</strong>: every FIDO2 credential is generated and used with a cryptographic binding to the specific Relying Party ID (RP ID — typically the registering domain&rsquo;s origin) encoded into every authentication assertion. An authenticator will refuse to produce an assertion for <code>evil.com</code> using a credential registered with <code>bank.com</code>, even if the phishing site presents an identical login page and intercepts the WebAuthn call — the origin check is enforced inside the authenticator, not in JavaScript, and cannot be bypassed by a man-in-the-middle who controls the network or the browser DOM. This property is what makes FIDO2 <strong>phishing-resistant</strong> by construction, whereas TOTP, SMS OTP, and push-notification MFA are all interceptable by a real-time phishing proxy. FIDO2 is the direct successor to FIDO U2F (Universal 2nd Factor), which provided phishing resistance as a second factor only; FIDO2 extends the model to full passwordless primary authentication.</p>