FIDO2 token emulation: Use your mobile phone as a security key

Android Guides » Android tutorials » FIDO2 token emulation: Use your mobile phone as a security key

If you're tired of impossible passwords and always relying on apps like Authenticator, you'll be interested to know that FIDO2 token emulation on mobile devices and physical security keys They allow you to use your smartphone as a key and, if you want, distribute small USB tokens as if they were "blister packs" without having to set up a centralized management infrastructure.

In recent years, the FIDO Alliance and major technology companies have promoted standards that make it possible for your mobile phone, your laptop, or a USB drive They act as strong authenticators, resistant to phishing and, in many cases, without requiring a password. Let's see exactly how FIDO2 works, what types of authenticators are available, how to use your phone as a token, and what you should consider when choosing robust PIN security keys without too many administrative complications.

What is FIDO2 and why is everyone talking about it?

The FIDO2 (Fast Identity Online) standard is designed to Users can log in to online services using their own devices such as smartphones with biometrics, laptops with fingerprint readers, security USB keys or NFC tokens, in both mobile and desktop environments.

The initiative was born from the FIDO AllianceA consortium of technology companies, financial institutions, and public bodies set out to eliminate reliance on traditional passwords. The goal is to improve security while simultaneously simplifying the authentication experience on websites and applications.

FIDO2 is the evolution of previous standards such as U2F (focused on physical keys as a second factor) and UAF (focused on mobile biometrics). Today, All these efforts converge in FIDO2which is what makes modern passkeys and passwordless logins possible on most current platforms.

In addition to increasing safety, FIDO2 It greatly reduces the risk of fraud and credential theft.This eliminates the use of static passwords and replaces traditional SMS codes or OTPs with much stronger and more difficult-to-attack cryptographic mechanisms.

How does FIDO2 work on a technical level (without getting too complicated)?

The basis of FIDO2 is the public key cryptographyInstead of a password that is sent to the server, the user's device generates a pair of digital keys: a private key (which never leaves the device) and a public key (which is stored on the online service's server).

When you register with a FIDO2 authenticator on a compatible site, the device creates that unique key pair for the user-service-device combination. The private key remains protected on the user's hardware (in a secure enclave or on the key itself), while the public key is registered on the server along with a random credential identifier.

At each subsequent login, the web service sends a unique crypto challenge to the device. The FIDO2 authenticator asks the user for a local verification gesture (PIN, biometrics, physical touch on the key, etc.), and only if the user performs it correctly does the private key sign that challenge.

The signature result is returned to the server, which validates it using the previously registered public keyIf everything matches up, access is granted. The major advantage is that the private key never leaves the user's device, making it extremely difficult to spoof or intercept.

Protocols that make up FIDO2: WebAuthn and CTAP

The FIDO2 specification is not a single protocol, but a combination of two main pieces perfectly meshed so that the browser, server, and authenticator can understand each other.

On one hand there is WebAuthn, a W3C standard that defines how The browser (or client app) communicates with the server It's the web API that allows a site to authenticate the user. It's the API that enables a site to offer options like "log in with security key" or "use passkey".

On the other hand, there is CTAP (Client-to-Authenticator Protocol), defined by the FIDO Alliance, which describes How do the browser or operating system communicate with the authenticator? that actually stores the keys (whether it's a USB key, a mobile phone, a laptop TPM, etc.).

Within CTAP, different versions and modes coexist: CTAP1 is equivalent to the old U2F (allowing compatibility with U2F keys as a second factor) and CTAP2 enables the full capabilities of FIDO2including passwordless access. A key that supports CTAP2 and CTAP1 can function as both a classic U2F token and a modern FIDO2 authenticator.

Types of FIDO2 authenticators: platform and roaming

Before a device generates a FIDO2 key set for an account, it must verify that The user in front is legitimateThis verification is done by the authenticator, which may request a PIN, a fingerprint, facial recognition, or another gesture.

In the FIDO2 ecosystem we distinguish two main categories: platform authenticators y roaming or cross-platform authenticatorseach with different uses and advantages.

Platform (or linked) authenticators

Platform authenticators are the ones that are integrated into the client device itselfA laptop, desktop computer, tablet, or smartphone. They are not physically removed or used on other devices; they always work on the same device where the login takes place.

Clear examples of platform authenticators are Windows Hello, Apple's Touch ID and Face ID, or Android's fingerprint sensorIn all these cases, the private keys are stored in a secure component of the device and are unlocked with biometrics or a local PIN.

With this model, the user enters the website or app from their main device and authenticates on the same device using your preferred method. It's convenient, fast, and doesn't require external keys, but it is tied to the specific device on which the credentials are created.

Roaming (or cross-platform) authenticators

Roaming authenticators, also called cross-platform authenticators, are portable hardware devices that can be used on various different devices. This includes USB, NFC, and Bluetooth keys, as well as some mobile phones and wearables.

These authenticators connect to computers, tablets, or mobile phones via USB, NFC or Bluetoothand allow the user to authenticate on multiple devices with the same token. A typical example is a security key that you connect via USB to your office PC, home laptop, or tablet, always with the same tap gesture or PIN.

Registration and authentication in FIDO2-compliant services

To take advantage of FIDO2's enhanced security, it's important to understand the two major operating flows: the initial registration and subsequent authentications. Although each service has slightly different screens, the underlying mechanism is very similar.

FIDO2 Registration Operation

During the registration process, the user accesses the web platform or service from their smartphone or laptop and It is initially identified with the classical method (username and password, or corporate credentials) so that the system knows who you are.

Within the account settings or profile, there is usually an option to Enable FIDO2 login or biometric loginActivating this option on a specific device triggers an exchange of information between the server and the browser to generate the new keys.

At that moment, the authenticator (whether it's a key, a mobile phone, or the laptop itself) Create a key pair: private and publicThese keys are unique to that account and service. The private key remains protected locally, while the public key and a random credential identifier are sent to the server and registered as the new authentication method.

Post-authentication process

When the user returns to the website or app, the login page will display, in addition to the username/password option, an option to log in with FIDO2 or passkeyWhen selected, the server generates a cryptographic challenge and sends it to the user's device.

The browser or app calls the registered authenticator, which may be on the same device (platform) or on a second device (physical key, mobile phone, etc.). The authenticator requests a gesture from the user: PIN, fingerprint, face, or physical touch on the key to confirm that the person is present.

If the gesture is correct, the private key that resides in the authenticator Sign the challenge sent by the server and returns the signed response. The server verifies it with the stored public key; if the signature is valid, access is granted without the need to enter passwords or SMS codes.

Out-of-band authentication with FIDO2

There is also the possibility of out-of-band authentication, where the The access request is completed on the mobile device itself. even if the user is logging in from another computer.

In this scheme, the user receives an authentication request on their smartphone via a link, notification or even via SMSand verifies their identity using biometrics or a local PIN on their mobile device. This allows the typical bank OTP message to be replaced with a FIDO2-based flow, which is much more secure and resistant to phishing and SIM swapping attacks.

Using your smartphone as a FIDO2 security key

One of the most interesting cases is when The Android phone itself acts as a security key to protect, for example, the Google account, without the need for an additional USB token.

From Android 7 onwards, Google allows the mobile phone to function as integrated FIDO2 tokenOnce set up, the user enters their Google username and password on the computer and then receives a notification on their phone asking them to confirm if they are trying to log in.

The flow relies on technologies such as WebAuthn and CTAP, and in a Secure communication via Bluetooth between the computer and the mobile device. This communication, in some scenarios, can be assisted with mechanisms such as caBLE (cloud-assisted Bluetooth Low Energy), a contribution from Google to improve the pairing experience and robustness of the channel.

Requirements to use your Android mobile as a security token

To take advantage of this function, the device must meet a series of basic conditions that guarantee both security and compatibility with the browsers and systems where it will be used.

First of all, you need a Android phone with version 7.xo or higherbecause older versions do not natively incorporate support for FIDO2 and WebAuthn that Google added to the operating system.

Furthermore, it is mandatory that the Bluetooth must be enabled on both your mobile phone and computerBecause proximity verification and authentication between both devices are performed via this wireless channel. As for the computer, it must be running the latest version of Chrome on ChromeOS, macOS, or Windows.

Activate your Android phone as a security key in Google

To activate this feature, you must first enable two-step verification on your Google account and Add your Android phone as a security keyGoogle's own help center details the necessary steps in the account security section.

Once the phone's built-in security key is added, the login process changes slightly: when you enter your credentials on the PC, The device detects that your account has a registered security key. and issues a challenge. Then, a notification appears on your mobile asking if you are trying to log in; confirming the notification completes the login.

In case of loss of phone or inability to use itIt is essential to have backup methods configured: an Authenticator app, another physical security key (such as YubiKey or Titan), or recovery security codes that Google allows you to download and print.

Physical FIDO2 security keys: token selection and PIN complexity

Beyond mobile, many organizations want to use FIDO2 USB tokens to protect access to Microsoft 365 and other servicesThis is especially relevant for users who don't use or don't want to use Authenticator-type apps. Practical details such as PIN complexity and the need (or lack thereof) for centralized management come into play here.

There are very cheap FIDO2 keys on the market that allow configuration Trivial PINs like 1111 or 1234This is not recommended in corporate environments where a minimum level of robustness is required. The common question is which token models impose stricter PIN policies without needing to set up a central administration platform.

Most mid-range and high-end FIDO2 key manufacturers offer Options to strengthen PIN complexity and block the key after several failed attempts. Although each environment is different, it's usually a good idea to opt for FIDO2-certified keys with support for configurable PINs, optional biometrics, and multi-platform compatibility (USB-A, USB-C, NFC, etc.).

For organizations that want something as simple as buy a "blister pack" of keys and distribute them to usersIt is practical to choose devices that do not require complex management software and that allow you to define a strong PIN during initialization, ideally with clear instructions for the user to choose a combination that is difficult to guess.

Initialization and registration of FIDO2 keys in services

Before registering a FIDO2 key to a specific service, it is advisable to perform a Basic initialization where the PIN is set and, if applicable, a spare key is configured for emergencies.

Some manufacturers provide specific utilities, such as SK Manager-type management applicationsThese tools allow you to prepare the keys, assign a PIN, and perform the initial configuration from a computer. It is recommended to initialize both the primary and backup keys in the same session.

Once ready, you access the desired service (for example, a corporate account, an email provider, or a cloud service) and, from the section of Security or multi-factor authentication (2FA/MFA)The option to add FIDO2 security keys is being sought. The specific flow varies from one service to another, but the public key associated with that key is always recorded.

It is good practice to record at least two FIDO2 keys per user (main and spare), so that if one is lost or blocked, access is not lost and the compromised key can be revoked from the service security console.

Using FIDO2 and keys in Google and Microsoft 365

Both Google and Microsoft already allow Use FIDO2 keys as the preferred login methodeven with passkeys that can replace the password when the service is fully prepared for it.

FIDO2 keys with Google accounts

On Google, any security key compatible with FIDO1 or FIDO2 can be used as second verification factor in two-step verificationTo go a step further and create passkeys that allow passwordless logins, the key must fully support the FIDO2 protocol.

If you already had a security key registered in your Google account before certain system updates, you may It may be necessary to remove it from the account and add it again to create a modern passkey linked to that same key. All of this is managed from the account security settings.

The usage flow is simple: you open a compatible browser (Chrome, Firefox, Safari, Edge, Opera, etc.), You log in to your Google account And, when the system detects that there is an associated security key, it asks you to connect it to the USB port (or bring it close if it is NFC/Bluetooth) and activate it with a touch or by pressing its button.

Within the two-step verification settings, Google allows organize several security keysYou can see when keys were added, when they were last used, and rename them for easy identification. You can also delete keys that are no longer in use from there.

FIDO2 keys with Microsoft 365 accounts

In the Microsoft environment, FIDO2 authentication is typically configured through the page dedicated to login methods (for example, in the corporate URL that directs to the Microsoft MFA assistant).

To add a security key, access the portal, choose “Add login method” Then select “Security key,” specifying whether it is a USB or NFC device. The browser's wizard guides the user through the specific steps, which may vary depending on the operating system (Windows, macOS, etc.) and the type of key.

At the end of the process, you are asked to give a identifying name of the key This will allow it to be distinguished from others in the future. Once registered, it can be used in major browsers (Edge, Chrome, Firefox) and even to log in to Windows 10/11 computers managed by the organization, provided that the IT department has enabled this functionality.

The FIDO2 keys that the user has associated with their Microsoft account are listed on the portal. “security information” of identitywhere any of them can be reviewed, renamed, or revoked if necessary.

Advantages of FIDO2 authentication and passkeys

The success of FIDO2 is due to the fact that it is designed to Strengthen security while simplifying the user's lifeavoiding many of the usual hassles associated with traditional passwords and second factors.

From a safety standpoint, FIDO2 is particularly effective against credential-based attacks such as phishingPassword spraying, or the theft of password databases, is another tactic. Since a password cannot be reused across multiple services, there is nothing for an attacker to intercept or guess.

Furthermore, if an attacker were to compromise a provider's server, they would only have access to public keys, which by themselves do not allow you to log in without the physical device that stores the private key. This radically reduces the impact of any data breach.

In terms of user experience, remove passwords and OTP codes It greatly simplifies the login process: a touch of a finger, a glance, or inserting and touching a key is all it takes. Since these mechanisms are phishing-resistant by design, the layer of patches and extra controls previously added to mask security vulnerabilities can also be reduced.

From a regulatory perspective, FIDO2 authentication helps to comply MFA requirements: strong and phishing-resistant These regulations, such as GDPR, HIPAA, PSD2, NIS2, and the recommendations of NIST SP 800-63 and CISA, require it. That's why large organizations and public administrations already include it as part of their zero trust strategies.

Limitations and practical challenges when implementing FIDO2

It's not all advantages, and it's important to recognize the real challenges in adopting FIDO2especially in business environments where modern applications coexist with legacy systems.

One of the main problems is the so-called “technological legacy”: Not all applications support FIDO or modern SSOMany on-premise systems, older VPN clients, or RDP gateways are still tied to usernames/passwords and do not support WebAuthn.

In these hybrid contexts, it is common to have to maintain password-based mechanisms in parallel to the deployment of FIDO2. Some hardware keys mitigate this by also acting as encrypted password managers, storing hundreds of credentials and automatically filling them in according to the context, all controlled and protected by a PIN.

Another somewhat paradoxical aspect is that, in many services, The password doesn't disappear completely When we activate passkeys, they remain as a backup method in case the primary device is lost. This implies that a "weak link" still exists and that the transition must be accompanied by policies to gradually reduce reliance on passwords.

Finally, it's important to understand that not all passkeys work the same way: those synchronized between devices via the cloud (for example, via iCloud or a Google account) are very convenient for the end user, while those strictly linked to a specific device or a physical key They offer more control in high-security environments where it is not desirable for credentials to travel to unmanaged personal devices.

Where you can use FIDO2 today: personal and business

Today, FIDO2 compatibility has been extended to virtually all modern operating systems and leading browserswhich makes it easy to deploy in both personal and corporate environments.

In the private sector, the major providers (Apple, Google, Microsoft) already They allow you to log into your accounts with passkeys without having to think about the password.Social networks, financial services and a large number of online platforms have also started offering login with security keys or biometric authentication based on FIDO.

In the professional environment, where many applications still do not natively support FIDO, a common solution is to use a identity provider (IdP) with FIDO2 and SSO supportIn this way, the user authenticates once with a phishing-resistant method, and the IdP issues the necessary access tokens for the rest of the applications, including many legacy ones.

In any case, it is advisable not to stick with just one device: Configure multiple passkeys or keys per user (mobile, laptop, USB key, etc.) reduces the risk of being locked out due to loss or malfunction, and allows for a smoother transition to a true password-free model.

With all of the above, it is clear that emulating FIDO2 tokens using the smartphone as a security key, combined with well-chosen physical keys (including robust PIN requirements and without overly complex management), offers a practical and very solid way to strengthen authentication for both personal accounts and environments like Microsoft 365, aligning security, usability, and regulatory compliance without forcing everyone to rely on the same Authenticator app. Share this guide so more people can learn about the topic.