2 ms·
FIDO should only be used as a second factor. U2F keys can and will be lost or stolen. Speaking of which, anyone using U2F keys needs to record which keys were e
by fmajid 4y ago
FIDO should only be used as a second factor. U2F keys can and will be lost or stolen. Speaking of which, anyone using U2F keys needs to record which keys were enrolled for which site, and sites should allow multiple keys as well as giving nicknames to them.
- _8j50 4y agoFIDO can and does get used as the only factor auth when people/orgs go passwordless. There are various ways of recovering and having temporary access when losing a key
- fmajid 4y agoI'm less concerned about loss of access than with what happens if your key is stolen and can be used to log in because no password is required. Just pressing a button is not strong enough. Now, Apple/Google/Microsoft implementing Passkeys with proper device authentication is perfectly fine. Perhaps I should have specified "FIDO U2F" rather than just "FIDO".