The FIDO Alliance expects to see more high-profile cyberattacks targeting cloud service providers that bypass traditional multifactor authentication (MFA), which will push more major brands to adopt the "passkey" password replacement in 2023.

“Cloud service providers are growing in size, data, and influence, making them prime targets for cyberattacks,” FIDO Alliance Executive Director and CMO Andrew Shikiar predicts. “In 2023, we’ll see a lot more high-profile, sophisticated attacks that bypass legacy MFA.”

Shikiar noted Cloudflare and Twilio suffered attacks in 2022 as part of the 0ktapus hack where their employees were targeted via text message and attackers circumvented one-time password codes. Due to the use of FIDO security keys, Cloudflare was protected from data compromise, while Twilio later shifted to use FIDO authentication internally, he claims.

“I guess the good news for FIDO authentication is that we'll see more adoption but I'd much rather see people do it on their own rather than getting pushed or shamed into,” Shikiar told SDxCentral, adding that he hopes more companies will learn from those attacks and move to FIDO MFA.

MFA should be one of the first steps of an organizations’ zero-trust journey, “because zero trust is predicated on a high level of security assurance so you need to be able to quickly and effectively authenticate users and devices,” he said.

“MFA is the best way to do that, [and] literally is the only off-the-shelf, unphishable user authentication standard that's out there,” Shikiar added. “So I think FIDO should be at the core of any zero-trust architecture.”

FIDO: Passkey rollout to surge in 2023

As part of the association’s passwordless and MFA push, the FIDO Alliance and its partners, including Apple, Google, and Microsoft, introduced the term passkey to replace passwords.

Passkey is a cross-platform, general-use term referring to a password replacement that simplifies and secures sign-ins and account registration for websites and apps across all of a user’s devices. Phone or computer operating systems manage the passkeys and automatically sync between the user’s devices via a cloud service, which also stores an encrypted copy of the FIDO credential, according to FIDO Alliance.

“Passkey at a broader level is now FIDO’s terminology for any passwordless sign in,” Shikiar explained. It “allows private keys basically to be seen so that within the ecosystem all devices automatically have your private key. ”

Apple introduced its passkey feature at its WWDC 2022 event. Google's Android and Chrome, and Microsoft's Windows platforms are anticipated to fully support passkey early this year.

Passkey “was widely welcomed as a more secure replacement for passwords and is already being utilized by PayPal and other service providers,” Shikiar noted. “We will see more major brands adopting passkeys in 2023, which will lead to broader consumer awareness and demand.”

The FIDO Alliance and its partners will release common user experience guidelines to help ensure consistent passkey terminology, branding, and messaging, he added.