domains / families / security / implementing-hardware-security-key-authentication

implementing-hardware-security-key-authentication

separate

'Builds a FIDO2/WebAuthn relying party server with the python-fido2

When to use

• Deploying phishing-resistant multi-factor authentication (MFA) using FIDO2 hardware security keys for high-value accounts (administrators, developers, privileged users)
• Building a WebAuthn relying party server that supports both roaming authenticators (USB/NFC security keys) and platform authenticators (Windows Hello, Touch ID, Android biometrics)
• Migrating an existing password-based authentication system to support passkeys (discoverable credentials) as a primary or secondary authentication factor
• Enrolling YubiKey devices for an organization's workforce, including PIN setup, credential registration, and backup key provisioning
• Implementing passwordless authentication flows that comply with NIST SP 800-63B AAL3 (authenticator assurance level 3) requirements

When not to use

• production environments without HTTPS
• systems where users cannot physically access a USB/NFC port
• use as the sole authentication factor without a recovery mechanism

Skill page

Source