WebAuthn / FIDO2

WebAuthn is the W3C browser API through which websites create and verify public-key credentials; FIDO2 is the umbrella standard pairing WebAuthn with CTAP, the protocol browsers use to talk to authenticators like security keys and platform biometrics. Together they are the standards machinery underneath passkeys.

The property that matters for account takeover is origin binding. A WebAuthn credential is scoped to the relying party that created it, and the browser refuses to use it anywhere else, so a convincing replica of a login page cannot collect anything reusable. That removes the phishing step most takeover chains depend on.

What it does not remove is the recovery path. An account with a passkey and an SMS reset still has an SMS-strength floor.

Attestation in the WebAuthn sense is a separate and frequently misread feature. It lets a relying party learn what kind of authenticator produced a credential, which matters for enterprises that must require certified hardware, and it is not on by default. Most consumer deployments neither request nor verify it, so assumptions about authenticator provenance are usually unfounded unless someone explicitly built for them.

User verification is the other flag that carries more meaning than it appears to. A ceremony can prove possession of the authenticator alone, or possession plus a local biometric or PIN, and the difference decides whether a stolen unlocked device is enough. The requirement is set by the relying party per ceremony, which means it is a policy decision that quietly defaults to whatever the first integration chose.

None of this addresses the channels attached to the account. A correctly implemented WebAuthn login is strong evidence about a credential and a device, and it is silent on whether the phone number on the account changed hands this morning, which is the gap carrier signals are read to close.

Enterprises requiring certified authenticators rely on attestation to learn what produced a credential.