The FIDO Alliance has released a major update to its Metadata Service (MDS) that is intended to improve how relying parties vet passkey and FIDO authenticator devices, with a particular focus on compliance, security assurance, and user experience. In a news post announcing the changes, FIDO describes the new MDS v3.1 and v3.1.1 releases, along with a new Convenience Metadata Service, as a critical step in supporting the continued evolution of the FIDO ecosystem.
The Metadata Service acts as a centralized repository of authenticator metadata that allows servers to verify that a given device model is genuine, understand its capabilities, and see its certification and security characteristics. The updated versions introduce stricter rules for how metadata is published and consumed, stronger checks around authenticator attestation and certification status, and improved mechanisms for handling authenticator updates or deprecations. FIDO notes that the changes are meant to help relying parties better distinguish between authenticators that meet current security expectations and those that may be outdated or non-compliant.
Alongside the core MDS update, the new Convenience Metadata Service is intended to simplify integration for service providers that do not need the full flexibility of the main MDS. It offers a curated, easier-to-consume view of authenticator metadata, aimed at improving developer experience and reducing implementation errors that can lead to inconsistent security posture across endpoints and platforms. FIDO is encouraging vendors and relying parties to migrate to the new MDS versions and to review their current usage to ensure they are enforcing appropriate policies for authenticator trust and user verification strength.
The update is a reminder that strong authentication depends not only on using FIDO or passkeys in general, but also on verifying the specific authenticators that users bring. Weak or spoofed device models can erode the benefits of phishing-resistant authentication if they are not properly screened. As organizations scale up passkey deployments, integrating with the latest FIDO MDS and setting clear policies for acceptable authenticators will be essential steps in aligning with emerging regulatory expectations and audit standards around phishing-resistant MFA.
Sources: FIDO Alliance, LinkedIn (FIDO Alliance)
—
By the ID Tech Editorial Team
