# A Novel Protocol Using Captive Portals for FIDO2 Network Authentication +
## 7 Discussion and Conclusions  
We propose a novel authentication protocol based on FIDO2 authentication integrated with a captive portal. Moreover, we have developed a functional prototype on the OpenNDS captive portal. The prototype can be installed on a network to authenticate users with FIDO2 security keys. In addition, we have validated the prototype usability, finding use errors that can drive future research on FIDO2 usability with a more extensive experiment.  
Our FIDO2 CAP protocol and the implemented prototype are proof of how FIDO2 authentication can be integrated with other systems and serve as a replacement of passwords and their vulnerabilities. Therefore, security keys and passkeys can now be used with captive portals that authenticate users in real network authentication environments. However, there is some work left in relation to the usability and producing mature software with full compatibility across devices and web browsers. Our implemented prototype depends on custom web browsers that operating systems open when detecting a captive portal, impacting the user experience.  
In conclusion, FIDO2 authentication represents an opportunity to improve security by migrating the existing authentication services to a new authentication paradigm. Considering that central authentication involves different systems, the migration to FIDO2 should be performed in all authentication scenarios of a business. They include not only web authentication but also other systems like network access control.  
Our solution directly involves FIDO2 authentication within an access control system in the network, a novel approach to the best of our knowledge. This differs from previous works such as that of [PERSON] et al. [13]. In this work, they provision temporary password-based credentials after FIDO UAF authentication for a WPA2-Enterprise Wi-Fi network. Then, these provisioned credentials are sent to the device via a TLS channel and added to a RADIUS server. However, their solution requires the user to install a separate Android application to configure the temporary Wi-Fi credentials and the authentication with FIDO UAF. In FIDO2 CAP, authentication is directly performed in the web browser, compatible with the new FIDO2 standards. The user is not required to install any new software. Further, the protocol adapts already existing technology, integrating the new authentication, avoiding the need for temporary password-based credentials. Once the captive portal is detected, the user only needs to perform FIDO2 authentication.  
For validation, we tested both compatibility with the technology and its usability with users. We conducted a pilot usability study with 15 users using external FIDO2 security keys. The results showed that 69,23% of them completed the connection with these hardware tokens and had a high level of user satisfaction. During the execution of the experiment, some concerns were raised when asking about user acceptance. As some previous works discovered [30], users are concerned about losing a physical token. FIDO2 platform authenticators, like the embedded in smartphones, may be a more accepted approach in the following years. FIDO2 CAP compatibility with both scenarios ensures the continuity of the solution.  
However, it is important to highlight that WebAuthn and FIDO CTAP are recent standards that are still under development and under adoption. Although it has already been implemented in web authentication in different operating systems, browsers and devices, their applicability to further scenarios has not yet been studied. This paper proves that there are other applications, like network authentication. Although the underlining  
Figure 14: User answers to “Would you use security keys for connecting to a Wi-Fi network?” after finishing the experiment.  
technology is web-based, the integration with a real captive-portal Enforcement Device demonstrates the potential of security keys in network authentication.