This lesson's interactive features are locked, please to keep using them
Hardware Tokens
A hardware token is a physical authenticator that proves possession of a secret stored on the device. Some display one-time codes. FIDO security keys instead connect to a computer or phone and use public-key cryptography to sign a challenge.
A FIDO (Fast IDentity Online) security key is a specific type of hardware token that works with the WebAuthn standard.
Asymmetric Cryptography
Unlike TOTP, where the authenticator and server share a secret, a security key uses asymmetric cryptography, meaning the server never sees the private key. With FIDO/WebAuthn, the flow looks like this:
The credential's private key stays on the security key. The key receives the challenge, signs it, and returns the signature to the server. The server can verify the signature with the public key it has on file, but it can't derive the private key from that signature.
Phishing Resistance
FIDO is phishing-resistant, which means a malicious site called faceb0ok.com might trick your grandma into typing in her facebook.com password, but it can't trick her hardware token into signing a challenge for the wrong domain.