SMBs with email and cloud applications
One compromised email account opens everything else: start with the accounts that can cause the most damage.
SMARTLEDGE · digital identity
FIDO2 and passkeys: passwordless authentication
FIDO2 is the standard that lets people sign in without a password, using passkeys or security keys that cannot be handed over on a fake site. SMARTLEDGE assesses, designs and deploys passwordless authentication for companies, SMBs and public bodies in Argentina: we survey which applications are compatible, define how access is recovered and roll out in stages, with policies and training.
A password can be guessed, reused or typed into the wrong page. So can an SMS code. A FIDO2 credential only responds to the site it was created for.
SL / 01What it is
What are FIDO2 and passkeys, and why do they stop phishing?
FIDO2 replaces the password with a pair of cryptographic keys: the private key never leaves the device or the security key, and the service stores only the public one. A passkey is the most common way to use that standard. Because each credential is bound to the service's domain, a fake site has nothing to steal.
| Password + code | Synced passkey | Physical security key | |
|---|---|---|---|
| What the person uses | Password + codeSomething they remember and an SMS or app code | Synced passkeyFingerprint, face or PIN on their device | Physical security keyA USB or NFC key, with PIN or touch |
| Against phishing | Password + codeCan be handed over on a fake site | Synced passkeyResistant: bound to the service's domain | Physical security keyResistant: bound to the service's domain |
| Where the secret lives | Password + codeIn the person's memory and at the service | Synced passkeyOn the device, synced through the account | Physical security keyInside the key; it never leaves it |
| If it is lost | Password + codePassword reset | Synced passkeyRecovered through the sync account | Physical security keyUse a second registered key and revoke the lost one |
| Typical use | Password + codeSystems that do not yet support anything else | Synced passkeyGeneral staff use and fast adoption | Physical security keyAdministrators, critical access, shared workstations |
SL / 02What it includes
What we solve in a passwordless project
- Application survey: which systems support FIDO2 directly, which through your identity provider and which need a transition solution.
- User groups: who needs passkeys, who needs physical keys and who has particular needs (staff without a corporate phone, shared workstations).
- Account recovery: how a person's identity is verified before a new authenticator is enabled.
- Onboarding, changes and offboarding: the lifecycle of each credential: issuance, replacement and revocation, so nobody keeps access they should no longer have.
- Policies: which methods are accepted on each system, when FIDO2 is required and when the password is disabled.
- Keys and devices: selection of security keys and models according to ports, usage and other credentials that must coexist.
- Coexistence with other methods: PKI, certificates and one-time codes during the transition, or permanently where appropriate.
- Training: materials and support so people know how to use their credential and who to turn to.
We select manufacturers and equipment according to the project, its integration and its support. Scope, equipment and implementation are defined in writing in each proposal.
SL / 03Experience
Our experience in identity and credentials
Digital identity is not solved just by issuing credentials: you have to decide what each process trusts and be able to prove it afterwards. That is the approach we bring from identity, credential and access projects in Argentina, such as the multi-use credential issuance for the Buenos Aires City Government (52 issuance points), the multi-application credentials at the Port of Buenos Aires and the biometric identity at ARSAT. These are identity and credential projects, not FIDO2 deployments.
SL / 04Who it is for
Who should stop using passwords first?
Administrators and critical access
People who administer systems, finance or sensitive data are the first target, and the first group to protect.
Organizations exposed to phishing
When training is not enough and SMS or app codes can still be handed over.
Public bodies and companies with identity requirements
When you must prove who accessed what, with which method, and what happened to credentials after a role change.
SL / 05How we work
What a project with SMARTLEDGE looks like
- Process first: who accesses what, what risk each group carries and what must be provable; the technology is chosen from there.
- Limited pilot: a small group, with real applications, to find problems before expanding.
- Phased rollout: by group and by risk, keeping an alternative method until everything is confirmed to work.
- Tested recovery: the procedure is rehearsed before passwords are removed.
- Support: with scope and response times agreed according to the operation.
One (1) day at your company. An assessment with no professional fees.
If you are not sure where to start, we start there: we review your operations and leave you written feedback with the best possible path in your technology context.
SMARTLEDGE covers the professional fees for the assessment and the written feedback. Travel expenses are covered by the prospect/customer. Offer available for Argentina, Chile, Paraguay and Uruguay.
Request a one-day assessment, no professional feesSL / 06Questions
Frequently asked questions
What are passkeys?
They are sign-in credentials based on the FIDO standard that replace the password. They use a pair of cryptographic keys: the private key stays on the device or on a security key, and the service stores only the public key. The person confirms with a fingerprint, face or PIN, and that check happens on the device itself.
How do you remove passwords in a company?
In stages. First survey the applications and which ones support FIDO2 directly or through the identity provider; then define account recovery and run a pilot with a small group, starting with administrators and people with critical access. Then expand and, only once everything works, disable the password where possible. Applications that are not compatible need a transition solution.
How is FIDO2 different from an SMS code or an authenticator app?
A code can be typed into a fake site and the attacker can reuse it on the real one. With FIDO2 the credential is bound to the service's domain: on a fake site, the browser does not offer it and there is nothing to copy. That is why it is considered phishing-resistant.
Synced passkeys or physical security keys?
Synced passkeys are easier to adopt because they follow the person across devices through their account. Physical keys keep the key on a dedicated device it never leaves, and are usually preferred for administrators, critical access and shared workstations. Many organizations combine both according to each group's risk.
What happens if someone loses their key or changes phone?
It is solved by prior design: registering more than one authenticator per person, and having a recovery procedure that verifies identity before enabling a new one. Recovery is the most delicate point of the project, because if it is weak it becomes the door an attacker will try to use.
Are the fingerprint or face sent to the service?
No. In FIDO2, biometrics only unlocks the key on the person's device; the service receives a cryptographic signature, not the biometric data. This differs from physical biometric access control, where the system stores and compares people's data.
Does FIDO2 replace digital signatures or PKI certificates?
No, they solve different problems. FIDO2 authenticates a person at sign-in. Digital signatures with certificates, regulated in Argentina by Law 25,506, are used to sign documents with legal value. They can coexist, and a single key can support both uses if the model allows it.
How much does it cost to implement FIDO2 or passkeys?
It depends on the number of people, whether platform passkeys or physical keys are used, how many applications must be adapted and the training required. We quote after surveying the environment.
SL / 10
Contact
Let's talk about your challenge
Tell us which process you want to improve, what happens today and what outcome you need. That gives us a starting point to define the scope and next step.
Thank you. We received your message and will get back to you shortly.