FIDO2 and WebAuthn for Phishing-Resistant Organizational Authentication: A Systematic Review
Article Sidebar
Main Article Content
Abstract
The vulnerability of passwords and temporary codes to phishing drives the adoption of FIDO2/WebAuthn, yet evidence regarding their organizational implementation in Latin America is scarce. This study aimed to synthesize the benefits, limitations, and necessary controls for implementing FIDO2, WebAuthn, and passkeys in organizations, based on evidence published between January 2020 and July 2026. A systematic review following PRISMA 2020 guidelines was conducted across six bibliographic sources; out of 32 identified records and 24 full-text articles evaluated, 21 studies were included. Results indicate that origin-bound credentials reduce phishing based on credential capture or relay attacks, although risks associated with weak recovery, compromised clients, session hijacking, synchronization, and misconfigurations persist. Platform authenticators and passkeys fostered user acceptance following an initial learning curve, yet barriers related to activation, loss, migration, and interoperability remained. The evidence suggests that FIDO2/WebAuthn should be implemented as part of a comprehensive identity program that includes high-assurance recovery, client and session protection, and continuous operational controls. Given the heterogeneity of the studies and their concentration in Europe and North America, these findings require validation within Latin American organizations.
Article Details
This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License.
When an author creates an article and publishes it in a journal, the copyright passes to the journal as part of the publishing agreement. Therefore, the journal becomes the owner of the rights to reproduce, distribute and sell the article. The author retains some rights, such as the right to be recognized as the creator of the article and the right to use the article for his or her own scholarly or research purposes, unless otherwise agreed in the publication agreement.
How to Cite
References
[1] World Wide Web Consortium, "Web Authentication: An API for Accessing Public Key Credentials - Level 3," W3C Candidate Recommendation Snapshot, May 2026. https://www.w3.org/TR/webauthn-3/
[2] D. Temoshok, Y.-Y. Choong, A. Regenscheid, R. Galluzzo, J. L. Fenton, J. Richer, and N. Lefkovitz, Digital Identity Guidelines: Authentication and Authenticator Management, NIST SP 800-63B-4, Jul. 2025. https://doi.org/10.6028/NIST.SP.800-63B-4
[3] J. Kunke, S. Wiefling, M. Ullmann, and L. Lo Iacono, "Evaluation of Account Recovery Strategies with FIDO2-based Passwordless Authentication," in Proc. Open Identity Summit 2021, Lecture Notes in Informatics, pp. 59-70, 2021. https://doi.org/10.48550/arXiv.2105.12477
[4] M. Kepkowski, M. Machulak, I. Wood, and D. Kaafar, "Challenges with Passwordless FIDO2 in an Enterprise Setting: A Usability Study," in Proc. IEEE SecDev 2023, pp. 37-48, 2023. https://doi.org/10.1109/SecDev56634.2023.00017
[5] L. Lassak, E. Pan, B. Ur, and M. Golla, "Why Aren’t We Using Passkeys? Obstacles Companies Face Deploying FIDO2 Passwordless Authentication," in Proc. 33rd USENIX Security Symp., pp. 7231-7248, 2024. https://www.usenix.org/conference/usenixsecurity24/presentation/lassak
[6] T. Reittinger and G. Pernul, "No Password, No Problem? A Large-Scale Field Study of Passkey Adoption and Usage," in Proc. 2026 IEEE Symp. Security and Privacy, pp. 3607-3626, 2026. https://doi.org/10.1109/SP63933.2026.00022
[7] E. Ulqinaku, H. Assal, A. Abdou, S. Chiasson, and S. Capkun, "Is Real-time Phishing Eliminated with FIDO? Social Engineering Downgrade Attacks against FIDO Protocols," in Proc. 30th USENIX Security Symp., pp. 3811-3828, 2021. https://www.usenix.org/conference/usenixsecurity21/presentation/ulqinaku
[8] T. K. Yadav and K. E. Seamons, "A Security and Usability Analysis of Local Attacks Against FIDO2," in Proc. 31st Network and Distributed System Security Symp. (NDSS), 2024. https://doi.org/10.14722/ndss.2024.24327
[9] C. Catalano, A. Chezzi, V. S. Barletta, and F. Tommasi, "Defeating FIDO2/CTAP2/WebAuthn Using Browser in the Middle and Reflected Cross Site Scripting," Journal of Computer Virology and Hacking Techniques, vol. 21, art. 11, 2025. https://doi.org/10.1007/s11416-025-00556-2
[10] J. L. Hernández Carrión, M. Porrúa, M. Urtasun, D. Ros Rooney, and S. Cabello, Desarrollo e implementación de procesos de identificación digital en los países de América Latina, Inter-American Development Bank, 2026. https://doi.org/10.18235/0013931
[11] M. Porrúa et al., 2025 Cybersecurity Report: Vulnerability and Maturity Challenges to Bridging the Gaps in Latin America and the Caribbean, Inter-American Development Bank, in collaboration with the Organization of American States and the Global Cyber Security Capacity Centre (University of Oxford), Dec. 2025. https://doi.org/10.18235/0013872
[12] Presidencia del Consejo de Ministros, Centro Nacional de Seguridad Digital, "Cómo identificar ataques de Ingeniería Social," Guía, 11 Mar. 2025. https://www.gob.pe/institucion/pcm/informes-publicaciones/6554886-como-identificar-ataques-de-ingenieria-social
[13] FIDO Alliance, "Launching the FIDO Americas Adoption Forum," 26 Feb. 2026. https://fidoalliance.org/launching-the-fido-americas-adoption-forum/
[14] H. S. Lallie, L. A. Shepherd, J. R. C. Nurse, A. Erola, G. Epiphaniou, C. Maple y X. Bellekens, "Cyber security in the age of COVID-19: A timeline and analysis of cyber-crime and cyber-attacks during the pandemic," Computers & Security, vol. 105, art. 102248, 2021. https://doi.org/10.1016/j.cose.2021.102248
[15] F. Carroll, J. A. Adejobi y R. Montasari, "How good are we at detecting a phishing attack? Investigating the evolving phishing attack email and why it continues to successfully deceive society," SN Computer Science, vol. 3, art. 170, 2022. https://doi.org/10.1007/s42979-022-01069-1
[16] D. Kuchhal, M. Saad, A. Oest, and F. Li, "Evaluating the Security Posture of Real-World FIDO2 Deployments," in Proc. ACM CCS 2023, pp. 2381-2395, 2023. https://doi.org/10.1145/3576915.3623063
[17] M. J. Page et al., "The PRISMA 2020 statement: an updated guideline for reporting systematic reviews," BMJ, vol. 372, art. n71, 2021. https://doi.org/10.1136/bmj.n71
[18] P. Xu, R. Sun, W. Wang, T. Chen, Y. Zheng, and H. Jin, "SDD: A Trusted Display of FIDO2 Transaction Confirmation without Trusted Execution Environment," Future Generation Computer Systems, vol. 125, pp. 32-40, 2021. https://doi.org/10.1016/j.future.2021.06.034
[19] A. T. Mahdad, M. Jubur, and N. Saxena, "Breaching Security Keys without Root: FIDO2 Deception Attacks via Overlays Exploiting Limited Display Authenticators," in Proc. ACM CCS 2024, pp. 1686-1700, 2024. https://doi.org/10.1145/3658644.3690286
[20] M. Islam, S. S. Arora, R. Chatterjee, and K. C. Wang, "Detecting Compromise of Passkey Storage on the Cloud," in Proc. 34th USENIX Security Symp., pp. 7743-7762, 2025. https://www.usenix.org/conference/usenixsecurity25/presentation/islam
[21] M. Kepkowski, L. Hanzlik, I. D. Wood, and M. A. Kaafar, "How Not to Handle Keys: Timing Attacks on FIDO Authenticator Privacy," Proceedings on Privacy Enhancing Technologies, vol. 2022, no. 4, pp. 705-726, 2022. https://doi.org/10.56553/popets-2022-0129
[22] S. G. Lyastani, M. Schilling, M. Neumayr, M. Backes, and S. Bugiel, "Is FIDO2 the Kingslayer of User Authentication? A Comparative Usability Study of FIDO2 Passwordless Authentication," in Proc. 2020 IEEE Symp. Security and Privacy, pp. 268-285, 2020. https://doi.org/10.1109/SP40000.2020.00047
[23] F. M. Farke, L. Lorenz, T. Schnitzler, P. Markert, and M. Dürmuth, "You Still Use the Password After All - Exploring FIDO2 Security Keys in a Small Company," in Proc. SOUPS 2020, pp. 19-35, 2020. https://www.usenix.org/conference/soups2020/presentation/farke
[24] L. Lassak, A. Hildebrandt, M. Golla, and B. Ur, "It’s Stored, Hopefully, on an Encrypted Server: Mitigating Users’ Misconceptions About FIDO2 Biometric WebAuthn," in Proc. 30th USENIX Security Symp., pp. 91-108, 2021. https://www.usenix.org/conference/usenixsecurity21/presentation/lassak
[25] K. Owens, O. Anise, A. Krauss, and B. Ur, "User Perceptions of the Usability and Security of Smartphones as FIDO2 Roaming Authenticators," in Proc. SOUPS 2021, pp. 57-76, 2021. https://www.usenix.org/conference/soups2021/presentation/owens
[26] L. Würsching, F. Putz, S. Haesler, and M. Hollick, "FIDO2 the Rescue? Platform vs. Roaming Authentication on Smartphones," in Proc. CHI 2023, art. 68, pp. 1-16, 2023. https://doi.org/10.1145/3544548.3580993
[27] L. Lassak, N. Lindemann, and M. Kowalewski, "From TOTPs to Security Keys: Studying the Reality of Passwordless FIDO2 Authentication With PIN and Biometrics in a Corporate Environment," in Proc. SOUPS 2025, pp. 371-389, 2025. https://www.usenix.org/conference/soups2025/presentation/lassak
[28] E. Klieme, J. Wilke, N. van Dornick, and C. Meinel, "FIDOnuous: A FIDO2/WebAuthn Extension to Support Continuous Web Authentication," in Proc. IEEE TrustCom, pp. 1857-1867, 2020. https://doi.org/10.1109/TrustCom50675.2020.00254
[29] M. Rivera-Dourado, M. Gestal, A. Pazos, and J. Vázquez-Naya, "A Novel Protocol Using Captive Portals for FIDO2 Network Authentication," Applied Sciences, vol. 14, no. 9, art. 3610, 2024. https://doi.org/10.3390/app14093610
[30] A. Angelogianni, I. Politis, and C. Xenakis, "How Many FIDO Protocols Are Needed? Analysing the Technology, Security and Compliance," ACM Computing Surveys, vol. 56, no. 8, art. 214, pp. 214:1-214:51, 2024. https://doi.org/10.1145/3654661
[31] International Organization for Standardization, ISO/IEC 27002:2022, Information security, cybersecurity and privacy protection - Information security controls, 2022. https://www.iso.org/standard/75652.html