FIDO Alliance

FIDO Alliance
Name	FIDO Alliance
Founded	July 2013
Focus	Authentication standards
Key people	Andrew Shikiar, Brett McDowell
Website	https://fidoalliance.org

FIDO Alliance. The FIDO Alliance is an open industry association focused on developing and promoting authentication standards that reduce reliance on passwords. Its core mission is to help reduce the world’s over-dependence on passwords by developing technical specifications for secure, passwordless login experiences. The consortium brings together leading technology companies, financial institutions, and government agencies to create interoperable, phishing-resistant authentication methods. Its work has significantly influenced the broader cybersecurity and digital identity landscape.

Overview

The consortium was formed to address widespread security vulnerabilities associated with traditional password-based authentication, which is susceptible to phishing, credential stuffing, and other attacks. Its specifications enable users to leverage on-device biometrics, security keys, and other forms of possession-based authentication to access online services. This approach aligns with broader industry trends toward zero-trust security architectures and enhanced user privacy. The technical outputs are designed to be interoperable across a wide range of platforms, browsers, and devices from various vendors.

History

The organization was publicly launched in July 2013 by founding members including PayPal, Lenovo, Nok Nok Labs, Infineon Technologies, and Validity Sensors. An early and influential contributor was Google, which joined later and integrated the specifications into its Android platform and Chrome browser. A major milestone was the publication of the first formal specifications, FIDO U2F and FIDO UAF, in December 2014. Subsequent evolution saw the release of the unified FIDO2 project in 2018, which incorporated the World Wide Web Consortium's WebAuthn standard. Recognition from entities like the National Institute of Standards and Technology and the European Telecommunications Standards Institute has further cemented its role in the identity ecosystem.

Standards and specifications

The primary technical standards include the FIDO Universal Authentication Framework (UAF), which enables password-only logins using built-in device authenticators like fingerprint sensors. The FIDO Universal 2nd Factor (U2F) standard strengthened security by providing a simple physical second-factor device, a concept later evolved within FIDO2. The flagship FIDO2 suite consists of the W3C-standardized WebAuthn API and the corresponding Client to Authenticator Protocol (CTAP). These allow for passwordless, multi-factor authentication using devices like YubiKey security keys, Windows Hello, or a smartphone. Ongoing work includes specifications for secure identity document verification and broader enterprise deployment scenarios.

Members and governance

The alliance comprises hundreds of members across various sectors, organized into tiers such as Board, Sponsor, and Associate levels. Prominent board-level members include Apple, Google, Microsoft, Amazon, Meta Platforms, Intel, Visa, and Mastercard. Governance is provided by a board of directors and several working committees focused on technical development, marketing, and certification. The organization collaborates closely with other standards bodies, including the World Wide Web Consortium, Internet Engineering Task Force, and ISO/IEC JTC 1. Its leadership includes Executive Director Andrew Shikiar and Board President Brett McDowell.

Adoption and impact

Adoption of its standards has become widespread across the technology industry. Major operating systems like Microsoft Windows, Apple macOS, Google Android, and iOS have built-in support. Leading web browsers, including Google Chrome, Mozilla Firefox, Apple Safari, and Microsoft Edge, support the WebAuthn standard. Cloud services from Google Cloud Platform, Microsoft Azure, and Amazon Web Services offer FIDO-based authentication. The specifications have been mandated or strongly recommended by government agencies worldwide, such as the United States' Cybersecurity and Infrastructure Security Agency and the United Kingdom's National Cyber Security Centre. This has driven deployment in sectors like online banking, healthcare, and enterprise security.

Security and privacy considerations

The security model is designed to be resistant to phishing, man-in-the-middle attacks, and replay attacks by using public key cryptography where private keys never leave the user's authenticator device. This approach also enhances privacy by preventing tracking across different websites, as a unique key pair is generated for each service. The protocols are engineered to avoid biometric data ever being transmitted to or stored on a remote server, keeping sensitive information locally on the user's device. These principles address key requirements of modern data protection regulations like the General Data Protection Regulation in the European Union and the California Consumer Privacy Act.

Category:Computer security organizations Category:Computer standards Category:Computer-related organizations based in California Category:Organizations established in 2013