https://williamresearch.com/tags/fido2/Recent content in FIDO2 on Research LogsHugoen-USFri, 18 Sep 2026 10:00:00 +0700https://williamresearch.com/posts/ai-account-security-physical-keys/Fri, 18 Sep 2026 10:00:00 +0700https://williamresearch.com/posts/ai-account-security-physical-keys/<h2 id="the-problem-starts-after-the-successful-login">The problem starts after the successful login</h2> <p>Imagine opening an AI account on a laptop, touching a security key, and passing the sign-in check. The account is now ready to search files, use connected applications, retain memory, and let an agent act on the user&rsquo;s behalf. The login was correct. That still does not answer whether the next action should run.</p> <p>This is the practical gap behind the current interest in physical security keys. A key can make it much harder for a phishing site to impersonate the account owner at sign-in. It cannot tell whether the device is healthy, whether a session was stolen later, whether a connected application is trustworthy, or whether an agent&rsquo;s requested action is appropriate for the resource.</p>