FIDO2 security can be bypassed without cracking any cryptographic code.

Many systems use FIDO2 and physical security keys to stop phishing. People often assume this setup is completely safe as long as the math behind the digital keys works. The problem is that logins do not happen in isolation. The researchers re-examined what can actually go wrong in real-world use. They tested eight ways an attacker could strike outside the core math, including infected browsers, malicious software, and rogue USB hardware. Even if the cryptographic keys stay secure, bad actors can break the system if they compromise the web browser, the computer's operating system, or connected hardware devices. Attackers can also chain separate attacks across these layers to bypass intended defenses, or track users with device timing and identity codes. Ultimately, the researchers found that the biggest security danger is not the cryptography itself, but the surrounding software and hardware that users trust.

Why it matters

People using FIDO2 for secure logins, like with security keys, might be at risk because attackers can target the device or software instead of the keys themselves. This means that even strong authentication can fail in real-world setups.

Questions answered