10% discount on all DF products

[tanjimajuha20]

global alliance for secure and open standards
The path to greater online security is therefore increasingly moving away from passwords and towards password-free procedures. As a non-commercial organisation, the FIDO Alliance provides open standards worldwide, free of charge and without a license. These standards have also become relevant because leading global technology companies are involved in the alliance. The alliance now has over 250 members, including major players from Google and Microsoft to Apple, Lenovo and PayPal. The fact that the Federal Office for Information Security (BSI) has now joined the alliance illustrates the enormous interest in reliable standards for online authentication - including among institutional players.



The FIDO macedonia phone data standards for passwordless online login
The FIDO standards focus on the ownership factor: They use user devices that are registered once with each service in order to securely authenticate their owners during online registrations. The standards are based on a public key procedure with asymmetric encryption, in which locally stored private keys remain secret throughout the entire authorization process. It works like this: If a client wants to log in to a web service using the FIDO procedure, the service server sends it a data packet ( called a challenge ). The client uses its securely stored secret key to calculate a response , which the server can verify using a public key. Unlike traditional access data, the client's secret remains in the protected environment. None of the information relevant to access authorization is sent to or stored on the public server. It remains exclusively in the possession of the user and is protected from hacker attacks.

From two-factor authentication to FIDO2
The FIDO Alliance has already released three open standards for passwordless online authentication:

FIDO U2F (Universal Second Factor) supplements password-based security with device ownership (two-factor authentication) and specifies how hardware and software can be used for this purpose.
FIDO UAF (Universal Authentication Framework), as U2F published in 2014, is used for passwordless authentication for registered user devices.
FIDO2 (2015-2019) combines the W3C standard Web Authentication (WebAuthn for short) for genuine passwordless authentication with a web service with the corresponding Client to Authenticator Protocol (CTAP) for communication with the device. (U2F was retroactively renamed CTAP1 for this purpose, and the protocol for the passwordless variant is called CTAP2.) In combination, both specifications enable authentication in which users can identify themselves to a trusted WebAuthn counterpart on web applications using various cryptographic (biometrics, PINs) or external authenticators (mobile devices, FIDO keys, wearables, etc.).