Hardware Security Keys: FIDO2 and WebAuthn

Hardware keys provide phishing-resistant authentication.

How They Work

- Public/private key cryptography
- Domain binding (anti-phishing)
- User presence verification
- No shared secrets

Popular Keys

- YubiKey 5 series
- Google Titan
- Feitian keys
- SoloKeys (open source)

Deployment Tips

- Require for privileged accounts
- Provide backup keys
- Support multiple protocols
- User training essential
- Plan for lost keys