Hardware Security Keys: FIDO2 and WebAuthn

The strongest form of multi-factor authentication.

Hardware keys provide phishing-resistant authentication.

How They Work

- Public/private key cryptography
- Domain binding (anti-phishing)
- User presence verification
- No shared secrets

- YubiKey 5 series
- Google Titan
- Feitian keys
- SoloKeys (open source)

- Require for privileged accounts
- Provide backup keys
- Support multiple protocols
- User training essential
- Plan for lost keys