FIDO2 y WebAuthn para autenticación organizacional resistente al phishing: revisión sistemática

The vulnerability of passwords and temporary codes to phishing drives the adoption of FIDO2/WebAuthn, yet evidence regarding their organizational implementation in Latin America is scarce. This study aimed to synthesize the benefits, limitations, and necessary controls for implementing FIDO2, WebAuthn, and passkeys in organizations, based on evidence published between January 2020 and July 2026. A systematic review following PRISMA 2020 guidelines was conducted across six bibliographic sources; out of 32 identified records and 24 full-text articles evaluated, 21 studies were included.

Results indicate that origin-bound credentials reduce phishing based on credential capture or relay attacks, although risks associated with weak recovery, compromised clients, session hijacking, synchronization, and misconfigurations persist. Platform authenticators and passkeys fostered user acceptance following an initial learning curve, yet barriers related to activation, loss, migration, and interoperability remained. The evidence suggests that FIDO2/WebAuthn should be implemented as part of a comprehensive identity program that includes high-assurance recovery, client and session protection, and continuous operational controls.

Given the heterogeneity of the studies and their concentration in Europe and North America, these findings require validation within Latin American organizations.