Phishing-Resistant MFA: Passkeys vs FIDO2 vs Smart Cards

Phishing-resistant MFA is the strongest form of multi-factor authentication, and it comes in three main forms: passkeys, FIDO2 security keys, and smart cards. All three use public-key cryptography to prevent credentials from being stolen or replayed, but they differ in hardware, user experience, and deployment. This article explains how each works, compares their strengths and weaknesses, and helps you choose the right approach for your needs.

Background: Why Phishing-Resistant MFA Exists

Traditional MFA—like SMS codes, TOTP apps, or push notifications—adds a second factor, but it is still vulnerable to phishing. An attacker can trick you into entering a one-time code on a fake login page, or intercept a push notification and approve it. Phishing-resistant MFA eliminates this by using a cryptographic challenge that is bound to the website’s domain. The authentication protocol only sends a signed response to the exact site you are trying to log into, so a fake site cannot reuse that response anywhere else.

The industry standard for phishing-resistant MFA is FIDO2, a specification developed by the FIDO Alliance. It includes the WebAuthn API, which lets browsers and operating systems talk to authenticators. Passkeys and security keys are both implementations of FIDO2, while smart cards use a different but related standard called PIV (Personal Identity Verification) or CAC (Common Access Card) in government and military contexts.

How FIDO2 Security Keys Work

A FIDO2 security key is a small USB, NFC, or Bluetooth device that stores a private key and performs the cryptographic signing. When you log in, the website sends a challenge, your browser asks the key to sign it, and you touch a button or enter a PIN to approve. The key never reveals the private key—it only outputs a signed challenge that the server verifies with your public key.

Security keys are the most mature form of FIDO2. They are available from multiple vendors, support both USB-A and USB-C, and work with most modern browsers and operating systems. They can also support FIDO U2F, an older protocol that many enterprise systems still use, making them a good choice for legacy compatibility.

Common examples include YubiKey, Google Titan, and Feitian. These are physical devices you carry, which means you can lose them, but they are also extremely difficult to compromise remotely.

Passkeys: The Newer, More Convenient Option

Passkeys are a newer implementation of FIDO2 that uses the device you already own—your phone, laptop, or tablet—as the authenticator. Instead of a separate hardware key, the private key is stored in your device’s secure enclave (like Apple’s Secure Enclave or Android’s StrongBox) and protected by your device’s biometrics (fingerprint or face) or PIN.

When you create a passkey, it is synced across your devices via your platform’s cloud (iCloud Keychain, Google Password Manager, or Microsoft). This means you can log in on a new device by scanning a QR code and using your phone’s biometrics. Passkeys are designed to be more user-friendly than security keys—no separate hardware to carry, and the login flow is often just a face scan or fingerprint tap.

However, passkeys are tied to a specific ecosystem. If you use Apple devices, your passkeys sync through iCloud; if you switch to Android, you will need to re-create them. Some services allow passkeys to be used across platforms via QR codes, but the experience is not as seamless as a universal security key.

Smart Cards: The Enterprise and Government Standard

Smart cards are physical cards with an embedded microchip that stores a private key. They are widely used in government (CAC, PIV), banking, and large enterprises. To authenticate, you insert the card into a reader and enter a PIN. The card never exports the private key; it performs the signature internally.

Smart cards are extremely secure because the chip is tamper-resistant and the PIN adds a second factor (something you have + something you know). They are also highly portable and familiar to users. However, they require specialized hardware: a card reader (often built into laptops for government use) and middleware software to interface with the card. This makes them more expensive to deploy and maintain than FIDO2 keys or passkeys.

Unlike FIDO2, smart cards use the PIV/CAC standard, which includes multiple certificates for signing, encryption, and authentication. This makes them suitable for more than just login—they can also sign emails and encrypt documents. But that complexity also means they are harder to integrate with modern web applications, which typically speak WebAuthn rather than PIV.

Key Differences: Security, Usability, and Cost

Here is a side-by-side comparison of the three approaches:

• Security: All three are phishing-resistant. Smart cards have the longest track record and are often required for high-security government systems. FIDO2 keys and passkeys are equally secure in practice, but passkeys rely on the security of your device’s secure enclave and cloud sync, which introduces a small risk if your cloud account is compromised.
• Usability: Passkeys are easiest for end users—no extra hardware, just biometrics. FIDO2 keys are easy but require carrying a device. Smart cards are the least convenient due to readers and PIN entry, but they are familiar to many enterprise users.
• Cost: Passkeys are free (you use your existing device). FIDO2 keys cost $20–$70 per key, and you need at least two for backup. Smart cards cost $5–$20 per card, but readers, middleware, and issuance infrastructure add significant overhead.
• Portability: Smart cards are the most portable across systems—you can insert them into any reader. FIDO2 keys are portable but need a USB/NFC port. Passkeys are tied to your device ecosystem, though QR-code login helps.
• Legacy compatibility: FIDO2 keys support U2F, which works with many older systems. Smart cards have been around for decades and integrate with legacy enterprise apps. Passkeys are new and may not work with older software.

How to Choose: Which One Is Right for You?

The choice depends on your context:

• Individual users: Passkeys are the best choice for most people. They are free, easy to use, and supported by major platforms (Apple, Google, Microsoft). If you want extra security for high-value accounts (like email or financial), a FIDO2 security key is a good backup.
• Small businesses: FIDO2 security keys are a solid middle ground. They are relatively inexpensive, easy to deploy, and work with most identity providers (Okta, Microsoft Entra, Google Workspace). Passkeys are also viable, but you need to ensure your identity provider supports them.
• Large enterprises and government: Smart cards are often required by regulation or policy (e.g., US federal agencies use PIV). They offer the highest assurance and integrate with existing PKI infrastructure. However, if you are starting fresh, FIDO2 keys can meet most requirements and are cheaper to manage.

A common misconception is that passkeys are less secure than security keys because they are stored in the cloud. In reality, the private key is encrypted and never leaves your device’s secure enclave; the cloud sync only transfers the encrypted key, which cannot be used without your device’s biometrics. The main risk is if someone gains physical access to your unlocked device, but that is true for any authentication method.

Common Problems and Misconceptions

One frequent issue is losing a security key or smart card. Unlike passwords, you cannot reset a key without a backup method. Always register at least two keys or enable a recovery code. For passkeys, the risk is being locked out of your cloud account—if you lose access to your Apple or Google account, you may lose your passkeys. Most platforms offer recovery codes or account recovery processes, but you should set those up in advance.

Another misconception is that phishing-resistant MFA is only for tech-savvy users. In reality, passkeys are designed to be easier than passwords—no typing, no remembering. The main barrier is adoption: not all websites support passkeys yet, so you may still need a password for some accounts.

Finally, some people worry about privacy. FIDO2 and passkeys use a different public key for each website, so sites cannot track you across the web. Smart cards, however, use a single certificate, which could theoretically be used to link activities if the certificate is shared across applications.

Frequently Asked Questions

Are passkeys really phishing-resistant?

Yes. Passkeys use the same WebAuthn protocol as security keys. The browser verifies the website’s domain before sending the challenge, and the private key never leaves your device. A phishing site cannot trick your passkey into signing a challenge for a different domain.

Can I use a security key with my phone?

Yes, if the key supports NFC or USB-C. Most modern security keys support NFC, which works with iPhones and Android phones. Some also support Bluetooth, though NFC is more common and more secure.

Do smart cards work with websites?

Not directly. Smart cards use PIV/CAC, which is not natively supported by browsers. You need middleware (like ActivClient) and often a browser extension. Some organizations use a bridge that translates PIV to WebAuthn, but it is not a standard feature.

Can I use passkeys on multiple devices?

Yes, if you use the same platform ecosystem (e.g., all Apple devices). Passkeys sync via iCloud Keychain or Google Password Manager. If you use different platforms, you can create a passkey on each device, or use a QR-code login to authenticate from one device to another.

What happens if I lose my security key?

You need a backup key or a recovery code. Most services allow you to register multiple keys, so you should always have at least one spare. If you lose all keys, you may have to go through an account recovery process, which can take days.

Are smart cards more secure than FIDO2 keys?

Both are highly secure. Smart cards have a longer track record and are often required for classified or high-security systems. FIDO2 keys use modern cryptography and are considered equally secure for most purposes. The main difference is deployment and cost, not raw security.

Related

• Restore Closed Tabs? How to Reopen in Any Browser
• Kodi vs Plex: Which Media Server Is Right?
• Email vs Fax: How Each Works, Compared