4 ms·
I feel like the security benefit of using FIDO2 isn't really there, since I don't remember when I've actually set up WebAuthn as my two-factor without being pro
by Hamuko 2y ago
I feel like the security benefit of using FIDO2 isn't really there, since I don't remember when I've actually set up WebAuthn as my two-factor without being prompted to have another mechanism like OTP or SMS as a backup solution. Not that many sites even support it in the first place though.
- drhuseynov 2y agoThere are systems supporting WebAuthn as the primary method, such as Gmail or M365. The systems requiring OTP or SMS as a backup are just examples of bad security design. Still, even if you have OTP as a backup, and FIDO2 as primary - it reduced phishing attack surface to a certain extent
- steve1977 2y agoYou should certainly have a backup key. So systems which only allow to enroll one key are a bit of a joke.