Phishing-resistant authentication

FIDO2 / WebAuthn: public keys against phishing

TOTP improves security but leaves the door to phishing open. FIDO2 and its web building block WebAuthn close it, by replacing the shared secret with public-key cryptography.

The idea: no more shared secret

With a password or a TOTP code, the server knows a secret that the user must prove. This secret can leak, be replayed, be phished.

FIDO2 changes the model. When you register on a site, your device (security key, phone, computer) generates an asymmetric key pair specific to that site:

a private key, which never leaves the device, often protected by a hardware component;
a public key, sent to the site and stored in your account.

The server therefore holds no reusable secret: just a public key, useless to a thief.

Logging in: a challenge to sign

At each login, the principle is that of the digital signature.

1. The site sends a CHALLENGE (random number) + its ORIGIN (domain)
        server  ----  challenge, origin  ---->  device

2. The device SIGNS (challenge + origin) with the PRIVATE key
        device : signature = Sign_private(challenge, origin)

3. The site VERIFIES the signature with the stored PUBLIC key
        device  ----  signature  ---->  server (verifies)

Only the genuine private key can produce a signature that the public key validates. Since the private key never leaves, there is nothing to steal on the server side nor to intercept on the network.

The crucial point: the signature is tied to the origin

This is where FIDO2 defeats phishing. The signature encompasses the origin of the request, that is, the domain of the site. The browser supplies this origin; the user does not type it.

Suppose a fake site banqu3.com imitating banque.com. The device signs for the origin banqu3.com. But the registered public key was registered for banque.com, and the real bank expects a signature for its own domain.

Real site   banque.com   : signature tied to "banque.com"   -> accepted
Fake site   banqu3.com   : signature tied to "banqu3.com"   -> REJECTED

The attacker cannot replay the signature elsewhere: it is only valid for the exact domain where it was produced. This is a structural resistance to phishing, not a mere piece of cautious advice.

What the user sees

In practice, the experience is simple: a tap on the security key, a fingerprint or a face on the phone. The gesture unlocks the use of the private key. All the cryptography is invisible.

In summary