Articles

Modern web applications must protect user accounts from password theft, phishing, and credential-stuffing attacks. Two-factor authentication adds a second verification step beyond passwords, while passkeys offer passwordless login via FIDO2/WebAuthn public-key cryptography. This article explains why 2FA matters, how ASP.NET Core Identity supports email, SMS, and authenticator app TOTP flows, setting up recovery codes, comparing 2FA versus passkeys, implementing passkey registration and login with Fido2.AspNet, and security best practices for production authentication systems.

Passwords are the first line of defense in any application, yet storing them incorrectly can lead to devastating breaches. ASP.NET Core Identity handles the heavy lifting with PBKDF2 hashing, per-user salts, and the IdentityV3 format — but only if you use it correctly. This article covers how Identity stores passwords, why plain text and naive encryption fail, how salting and optional peppering work, configuring strength policies, preventing reuse, enforcing periodic changes, email confirmation, and HTTPS — with practical code examples throughout.