FIDO2 y WebAuthn para autenticación organizacional resistente al phishing: revisión sistemática
Barra lateral del artículo
Contenido principal del artículo
Resumen
La vulnerabilidad de contraseñas y códigos temporales ante el phishing impulsa la adopción de FIDO2/WebAuthn, pero la evidencia sobre su implantación organizacional es escasa en Latinoamérica. El objetivo fue sintetizar los beneficios, limitaciones y controles necesarios para implantar FIDO2, WebAuthn y passkeys en organizaciones, a partir de la evidencia publicada entre enero de 2020 y julio de 2026. Se realizó una revisión sistemática conforme a PRISMA 2020 en seis fuentes bibliográficas, de 32 registros identificados y 24 textos completos evaluados, se incluyeron 21 estudios. Los resultados muestran que las credenciales vinculadas al origen reducen el phishing basado en captura o retransmisión, aunque persisten riesgos asociados con recuperación débil, clientes comprometidos, secuestro de sesión, sincronización y configuraciones defectuosas. Los autenticadores de plataforma y las passkeys favorecieron la aceptación tras el aprendizaje, pero permanecieron barreras de activación, pérdida, migración e interoperabilidad. La evidencia sugiere que FIDO2/WebAuthn debe implantarse como parte de un programa integral de identidad que incluya recuperación de alta garantía, protección del cliente y la sesión y controles operativos continuos. Debido a la heterogeneidad de los estudios y su concentración en Europa y América del Norte, estos hallazgos deben validarse en organizaciones latinoamericanas.
Detalles del artículo
Esta obra está bajo una licencia internacional Creative Commons Atribución-NoComercial-SinDerivadas 4.0.
Cuando un autor crea un artículo y lo publica en una revista, los derechos de autor pasan a la revista como parte del acuerdo de publicación. Por lo tanto, la revista se convierte en la dueña de los derechos de reproducción, distribución y venta del artículo. El autor conserva algunos derechos, como el derecho a ser reconocido como el creador del artículo y el derecho a utilizarlo para sus propios fines académicos o de investigación, a menos que se acuerde lo contrario en el contrato de publicación.
Cómo citar
Referencias
[1] World Wide Web Consortium, "Web Authentication: An API for Accessing Public Key Credentials - Level 3," W3C Candidate Recommendation Snapshot, May 2026. https://www.w3.org/TR/webauthn-3/
[2] D. Temoshok, Y.-Y. Choong, A. Regenscheid, R. Galluzzo, J. L. Fenton, J. Richer, and N. Lefkovitz, Digital Identity Guidelines: Authentication and Authenticator Management, NIST SP 800-63B-4, Jul. 2025. https://doi.org/10.6028/NIST.SP.800-63B-4
[3] J. Kunke, S. Wiefling, M. Ullmann, and L. Lo Iacono, "Evaluation of Account Recovery Strategies with FIDO2-based Passwordless Authentication," in Proc. Open Identity Summit 2021, Lecture Notes in Informatics, pp. 59-70, 2021. https://doi.org/10.48550/arXiv.2105.12477
[4] M. Kepkowski, M. Machulak, I. Wood, and D. Kaafar, "Challenges with Passwordless FIDO2 in an Enterprise Setting: A Usability Study," in Proc. IEEE SecDev 2023, pp. 37-48, 2023. https://doi.org/10.1109/SecDev56634.2023.00017
[5] L. Lassak, E. Pan, B. Ur, and M. Golla, "Why Aren’t We Using Passkeys? Obstacles Companies Face Deploying FIDO2 Passwordless Authentication," in Proc. 33rd USENIX Security Symp., pp. 7231-7248, 2024. https://www.usenix.org/conference/usenixsecurity24/presentation/lassak
[6] T. Reittinger and G. Pernul, "No Password, No Problem? A Large-Scale Field Study of Passkey Adoption and Usage," in Proc. 2026 IEEE Symp. Security and Privacy, pp. 3607-3626, 2026. https://doi.org/10.1109/SP63933.2026.00022
[7] E. Ulqinaku, H. Assal, A. Abdou, S. Chiasson, and S. Capkun, "Is Real-time Phishing Eliminated with FIDO? Social Engineering Downgrade Attacks against FIDO Protocols," in Proc. 30th USENIX Security Symp., pp. 3811-3828, 2021. https://www.usenix.org/conference/usenixsecurity21/presentation/ulqinaku
[8] T. K. Yadav and K. E. Seamons, "A Security and Usability Analysis of Local Attacks Against FIDO2," in Proc. 31st Network and Distributed System Security Symp. (NDSS), 2024. https://doi.org/10.14722/ndss.2024.24327
[9] C. Catalano, A. Chezzi, V. S. Barletta, and F. Tommasi, "Defeating FIDO2/CTAP2/WebAuthn Using Browser in the Middle and Reflected Cross Site Scripting," Journal of Computer Virology and Hacking Techniques, vol. 21, art. 11, 2025. https://doi.org/10.1007/s11416-025-00556-2
[10] J. L. Hernández Carrión, M. Porrúa, M. Urtasun, D. Ros Rooney, and S. Cabello, Desarrollo e implementación de procesos de identificación digital en los países de América Latina, Inter-American Development Bank, 2026. https://doi.org/10.18235/0013931
[11] M. Porrúa et al., 2025 Cybersecurity Report: Vulnerability and Maturity Challenges to Bridging the Gaps in Latin America and the Caribbean, Inter-American Development Bank, in collaboration with the Organization of American States and the Global Cyber Security Capacity Centre (University of Oxford), Dec. 2025. https://doi.org/10.18235/0013872
[12] Presidencia del Consejo de Ministros, Centro Nacional de Seguridad Digital, "Cómo identificar ataques de Ingeniería Social," Guía, 11 Mar. 2025. https://www.gob.pe/institucion/pcm/informes-publicaciones/6554886-como-identificar-ataques-de-ingenieria-social
[13] FIDO Alliance, "Launching the FIDO Americas Adoption Forum," 26 Feb. 2026. https://fidoalliance.org/launching-the-fido-americas-adoption-forum/
[14] H. S. Lallie, L. A. Shepherd, J. R. C. Nurse, A. Erola, G. Epiphaniou, C. Maple y X. Bellekens, "Cyber security in the age of COVID-19: A timeline and analysis of cyber-crime and cyber-attacks during the pandemic," Computers & Security, vol. 105, art. 102248, 2021. https://doi.org/10.1016/j.cose.2021.102248
[15] F. Carroll, J. A. Adejobi y R. Montasari, "How good are we at detecting a phishing attack? Investigating the evolving phishing attack email and why it continues to successfully deceive society," SN Computer Science, vol. 3, art. 170, 2022. https://doi.org/10.1007/s42979-022-01069-1
[16] D. Kuchhal, M. Saad, A. Oest, and F. Li, "Evaluating the Security Posture of Real-World FIDO2 Deployments," in Proc. ACM CCS 2023, pp. 2381-2395, 2023. https://doi.org/10.1145/3576915.3623063
[17] M. J. Page et al., "The PRISMA 2020 statement: an updated guideline for reporting systematic reviews," BMJ, vol. 372, art. n71, 2021. https://doi.org/10.1136/bmj.n71
[18] P. Xu, R. Sun, W. Wang, T. Chen, Y. Zheng, and H. Jin, "SDD: A Trusted Display of FIDO2 Transaction Confirmation without Trusted Execution Environment," Future Generation Computer Systems, vol. 125, pp. 32-40, 2021. https://doi.org/10.1016/j.future.2021.06.034
[19] A. T. Mahdad, M. Jubur, and N. Saxena, "Breaching Security Keys without Root: FIDO2 Deception Attacks via Overlays Exploiting Limited Display Authenticators," in Proc. ACM CCS 2024, pp. 1686-1700, 2024. https://doi.org/10.1145/3658644.3690286
[20] M. Islam, S. S. Arora, R. Chatterjee, and K. C. Wang, "Detecting Compromise of Passkey Storage on the Cloud," in Proc. 34th USENIX Security Symp., pp. 7743-7762, 2025. https://www.usenix.org/conference/usenixsecurity25/presentation/islam
[21] M. Kepkowski, L. Hanzlik, I. D. Wood, and M. A. Kaafar, "How Not to Handle Keys: Timing Attacks on FIDO Authenticator Privacy," Proceedings on Privacy Enhancing Technologies, vol. 2022, no. 4, pp. 705-726, 2022. https://doi.org/10.56553/popets-2022-0129
[22] S. G. Lyastani, M. Schilling, M. Neumayr, M. Backes, and S. Bugiel, "Is FIDO2 the Kingslayer of User Authentication? A Comparative Usability Study of FIDO2 Passwordless Authentication," in Proc. 2020 IEEE Symp. Security and Privacy, pp. 268-285, 2020. https://doi.org/10.1109/SP40000.2020.00047
[23] F. M. Farke, L. Lorenz, T. Schnitzler, P. Markert, and M. Dürmuth, "You Still Use the Password After All - Exploring FIDO2 Security Keys in a Small Company," in Proc. SOUPS 2020, pp. 19-35, 2020. https://www.usenix.org/conference/soups2020/presentation/farke
[24] L. Lassak, A. Hildebrandt, M. Golla, and B. Ur, "It’s Stored, Hopefully, on an Encrypted Server: Mitigating Users’ Misconceptions About FIDO2 Biometric WebAuthn," in Proc. 30th USENIX Security Symp., pp. 91-108, 2021. https://www.usenix.org/conference/usenixsecurity21/presentation/lassak
[25] K. Owens, O. Anise, A. Krauss, and B. Ur, "User Perceptions of the Usability and Security of Smartphones as FIDO2 Roaming Authenticators," in Proc. SOUPS 2021, pp. 57-76, 2021. https://www.usenix.org/conference/soups2021/presentation/owens
[26] L. Würsching, F. Putz, S. Haesler, and M. Hollick, "FIDO2 the Rescue? Platform vs. Roaming Authentication on Smartphones," in Proc. CHI 2023, art. 68, pp. 1-16, 2023. https://doi.org/10.1145/3544548.3580993
[27] L. Lassak, N. Lindemann, and M. Kowalewski, "From TOTPs to Security Keys: Studying the Reality of Passwordless FIDO2 Authentication With PIN and Biometrics in a Corporate Environment," in Proc. SOUPS 2025, pp. 371-389, 2025. https://www.usenix.org/conference/soups2025/presentation/lassak
[28] E. Klieme, J. Wilke, N. van Dornick, and C. Meinel, "FIDOnuous: A FIDO2/WebAuthn Extension to Support Continuous Web Authentication," in Proc. IEEE TrustCom, pp. 1857-1867, 2020. https://doi.org/10.1109/TrustCom50675.2020.00254
[29] M. Rivera-Dourado, M. Gestal, A. Pazos, and J. Vázquez-Naya, "A Novel Protocol Using Captive Portals for FIDO2 Network Authentication," Applied Sciences, vol. 14, no. 9, art. 3610, 2024. https://doi.org/10.3390/app14093610
[30] A. Angelogianni, I. Politis, and C. Xenakis, "How Many FIDO Protocols Are Needed? Analysing the Technology, Security and Compliance," ACM Computing Surveys, vol. 56, no. 8, art. 214, pp. 214:1-214:51, 2024. https://doi.org/10.1145/3654661
[31] International Organization for Standardization, ISO/IEC 27002:2022, Information security, cybersecurity and privacy protection - Information security controls, 2022. https://www.iso.org/standard/75652.html