FCP Security Benefits of FIDO 2 — Questions and Answers
Question 1: How does FIDO authentication protect against credential stuffing attacks?
- By requiring users to change passwords frequently
- By binding credentials to a specific origin so stolen data from one site cannot be used on another (Correct answer)
- By encrypting passwords before storing them
- By limiting login attempts per hour
Correct answer: By binding credentials to a specific origin so stolen data from one site cannot be used on another
FIDO credentials are origin-bound, meaning a credential registered at one site is cryptographically tied to that domain and cannot be replayed at another site even if stolen.
Question 2: Which property of FIDO authenticators prevents a compromised server from revealing users' private keys?
- The private key is stored encrypted on the server
- The private key never leaves the authenticator device (Correct answer)
- The private key is split between the server and the device
- The private key is regenerated on each login
Correct answer: The private key never leaves the authenticator device
FIDO private keys are generated and stored securely within the authenticator and are never transmitted to or stored on the relying party's server.
Question 3: What security advantage does FIDO provide over OTP-based two-factor authentication?
- FIDO requires a separate hardware token for every website
- FIDO OTPs are longer and therefore harder to guess
- FIDO is not susceptible to real-time phishing interception of one-time codes (Correct answer)
- FIDO uses symmetric cryptography instead of asymmetric cryptography
Correct answer: FIDO is not susceptible to real-time phishing interception of one-time codes
OTP codes can be intercepted and relayed in real time by a phishing site, whereas FIDO's challenge-response protocol bound to the origin prevents this attack.
Question 4: In the context of FIDO security, what does 'user verification' specifically protect against?
- Remote attackers intercepting the authentication ceremony
- An unauthorized person using a stolen or found authenticator (Correct answer)
- Server-side database breaches exposing user credentials
- Man-in-the-middle attacks on the TLS channel
Correct answer: An unauthorized person using a stolen or found authenticator
User verification (PIN, biometric, etc.) ensures that physical possession of the authenticator alone is insufficient — the legitimate user must also prove identity locally.
Question 5: Why is FIDO considered resistant to server-side breaches compared to password-based authentication?
- Servers store salted hashes that are impossible to crack
- Servers only store public keys, which are not useful for authentication without the private key (Correct answer)
- Servers store credentials in hardware security modules
- Servers use zero-knowledge proofs to verify passwords
Correct answer: Servers only store public keys, which are not useful for authentication without the private key
A FIDO relying party stores only public keys; even if an attacker obtains the entire credential database, they cannot authenticate as any user without the corresponding private key on the user's device.
Question 6: Which attack vector is specifically eliminated by FIDO's use of origin binding during the authentication ceremony?
- Brute-force password attacks
- Phishing attacks that redirect users to lookalike domains (Correct answer)
- SQL injection on the relying party database
- Replay attacks using captured TLS traffic
Correct answer: Phishing attacks that redirect users to lookalike domains
Because the authenticator checks the origin (domain) of the request and will not sign for a mismatched origin, credentials cannot be used on a lookalike phishing domain.
Question 7: How does the FIDO model address the risk of insider threats at an identity provider?
- By requiring two-person integrity for all authentication decisions
- By ensuring that even privileged server employees never have access to users' private keys (Correct answer)
- By logging all employee access to authentication databases
- By using hardware security modules that require dual authorization
Correct answer: By ensuring that even privileged server employees never have access to users' private keys
Since private keys are stored exclusively on users' authenticator devices and never sent to the server, a malicious insider with full database access still cannot impersonate users.
FCP Security Benefits of FIDO 2
How does FIDO authentication protect against credential stuffing attacks?