Not really, webauthn/fido and SSO are orthogonal (you an have one without the other, and you can have both). FIDO was originally about ending phishing. With SM

Not really, webauthn/fido and SSO are orthogonal (you an have one without the other, and you can have both). FIDO was originally about ending phishing. With SMS or TOTP, if you give the SMS/TOTP code to a phishing site it can forward it to log in. FIDO is bound to a specific site, making it non-forwardable. Security no longer relies on users correctly identifying that they're on a invalid site. Perhaps you are talking about the more recent push for passwordless FIDO [1]? Indeed the security argument for this is a lot more murky, and the cross-device portability tied to your browser-sync vendor looks a lot like Single Sign On. However it's still not the same as SSO. SSO provides a single identity, but FIDO passwordless just shares a login credential, not the identity. You can log into two different sites with FIDO passwordless with different email addresses, with no way for the sites to know you are the same person. There's no "organization" that has the power to revoke your login (I mean perhaps Google can, but not your employer/school/whatever like in SSO). [1] https://fidoalliance.org/apple-google-and-microsoft-commit-to-expanded-support-for-fido-standard-to-accelerate-availability-of-passwordless-sign-ins/ https://fidoalliance.org/apple-google-and-microsoft-commit-t...