Physical security keys: a practical guide to FIDO2

The problem with passwords and phishing

A password is a shared secret. When you authenticate to a service, you prove you know the secret. The service checks the secret against a stored value. The problem is that this exchange requires you to send the secret — or a derivation of it — over a connection you initiate.

Phishing exploits this by intercepting the exchange. An attacker creates a convincing replica of a login page, hosts it on a domain like paypa1-secure.com, and directs victims there via email, SMS, or search results. When the victim types their password, the attacker receives it in real time and can immediately replay it against the real service — often before the victim has finished logging in to the fake one.

No password strength helps here. A 128-bit random password, typed into a phishing page, is as useless as password123. The secret has been disclosed regardless of its entropy.

Software-based second factors (TOTP codes from an authenticator app, SMS codes) reduce but do not eliminate this risk, because a sophisticated attacker can relay the code in real time. The gap between receiving the code and using it is seconds — often enough for automation.

How FIDO2 closes this gap

FIDO2 (Fast Identity Online 2) is an open standard built on WebAuthn and CTAP2. Its critical innovation is that the protocol cryptographically binds the authentication to the origin — the exact domain of the relying party.

The mechanism:

1. During registration, the key generates a unique asymmetric key pair for the specific origin. The private key never leaves the hardware. The public key is registered with the service.
2. During login, the service sends a challenge. The challenge is combined with the origin by the browser.
3. The key signs the challenge+origin payload with the private key. This signature is sent to the service.
4. The service verifies the signature with the stored public key. Authentication succeeds.

The origin is in the signed payload. If a phishing page tries to relay this exchange, the origin in the challenge is the phishing domain, not the real one. The real service will reject the signature — it was made for a different origin. The attacker gains nothing usable.

This is not a policy or configuration — it is a mathematical property of the protocol. No configuration mistake can make a FIDO2 exchange vulnerable to classic phishing. It is structurally impossible.

Passkeys: FIDO2 without the password

Passkeys are discoverable FIDO2 credentials stored on a device (phone, laptop, or hardware key) that enable fully passwordless authentication. Rather than a second factor, they replace the password entirely. The same domain-binding property applies: a passkey cannot be phished for the same reasons a hardware key cannot.

The distinction between passkeys and traditional FIDO2 hardware keys matters operationally:

• Platform passkeys — stored in the OS keychain (iCloud Keychain, Google Password Manager, Windows Hello). Sync across devices; tied to the platform account. If your Apple ID is compromised, your passkeys may be at risk.
• Hardware security keys — the private key never leaves the physical device. No cloud sync means no cloud attack surface. Requires physical possession. Harder to lose-and-recover than a platform passkey.

For the highest-value accounts, a hardware key's air-gapped private key provides a stronger security guarantee than a synced platform passkey.

What to look for in a hardware security key

The market has consolidated around a few categories. Key properties to evaluate:

Interface

• USB-A — compatible with the widest range of older hardware
• USB-C — current standard; required for most modern laptops without an adapter
• NFC — enables authentication on mobile devices without a physical connection; important if you authenticate frequently on a phone
• Lightning — required for iPhone without NFC support (older models)

If you work across multiple device types, look for a key that supports both USB-C and NFC, or carry two keys with different interfaces.

Attestation and certification

FIDO Alliance certification (Level 1, Level 2, Level 3) indicates the device has been independently tested. Level 2 and above involve hardware security component validation. For personal use, any FIDO2-certified key from a reputable manufacturer is adequate.

Resident credentials (discoverable credentials)

Needed for passkey use. Early security keys had limited storage for resident credentials (8-25 slots); current hardware typically supports 100+. If you plan to use the key as a passkey for many accounts, verify the resident credential capacity.

PIN protection

FIDO2 keys support a PIN for additional protection. Without a PIN, physical possession of the key is sufficient to authenticate. With a PIN, an attacker who steals the key also needs the PIN. For shared or travel use, PIN protection is advisable. Keys lock after a configurable number of failed PIN attempts.

Deploying a hardware key

The process is straightforward for most major services:

1. Navigate to the security settings of the account you want to protect.
2. Look for "Security key", "Hardware token", "Passkey", or "2-Step Verification".
3. Follow the prompts to register the key. The browser will ask you to insert or tap the key and, if required, touch the contact point on the key.
4. Register a second key as a backup, or note the recovery codes in a physically secure location. Losing the only registered key without a backup means going through account recovery, which is often slow and sometimes impossible.

Start with your most critical accounts: primary email, cloud storage, bank, and password manager. These are the accounts whose compromise cascades to everything else.

What a security key cannot protect against

A FIDO2 key eliminates one attack vector — credential-based phishing and account takeover through stolen passwords — but not all of them:

• Compromised device — If your computer has malware with kernel-level access, it can potentially hijack the authenticated session after authentication completes. The key proves it was you who authenticated; it cannot prevent what the session does next.
• SIM swapping — Irrelevant once you switch from SMS-based 2FA to a hardware key, but social engineering of your phone carrier can affect recovery flows if they still allow SMS-based account recovery.
• Physical coercion — A key protects against remote attacks, not a scenario where someone forces you to authenticate.
• Misconfigured services — Some services allow fallback to less secure 2FA methods (SMS, email codes). An attacker who can intercept those fallbacks can bypass the key. Disable fallback options where available for maximum protection.

This site's hardware picks section features verified FIDO2 keys, encrypted storage devices, and privacy hardware available through Amazon. Check the hardware section on the home page for current recommendations.