FIDO Case Analysis & Practical Application 3

Question 1

A SaaS company wants to implement FIDO2 but their users span dozens of organizations with different IT policies.
Which FIDO architecture component best addresses federated identity across these organizations?

Accepted Answer

Implementing a shared IdP that federates FIDO assertions to each tenant RP

Answer

Deploying separate Relying Party servers for each organization

Answer

Using a FIDO metadata service to normalize authenticator trust across organizations

Answer

Requiring all organizations to use the same hardware security key model

Question 2

An RP's WebAuthn implementation sets the 'userVerification' parameter to 'required' but many users' authenticators only support user presence (touch). What is the outcome?

Accepted Answer

The ceremony fails for those authenticators because UV is required but unavailable

Answer

Authenticators without UV capability silently skip verification and succeed

Answer

The RP automatically downgrades the requirement to 'preferred' at runtime

Answer

Users are prompted to set a PIN before the authenticator can be used

Question 3

During a penetration test, a tester attempts to replay a captured WebAuthn assertion to a different origin than the original RP. What prevents this attack?

Accepted Answer

The clientDataJSON binding the assertion to the specific origin via rpId

Answer

The signature counter incrementing on every use

Answer

The attestation certificate tying the credential to the original RP

Answer

The challenge nonce expiring after a fixed timeout period

Question 4

A retail website implements FIDO2 passkeys but wants to support account recovery when a user loses all their devices. Which approach is FIDO-compliant and maintains security?

Accepted Answer

Require users to register at least two authenticators (e.g., hardware key + platform authenticator)

Answer

Store a backup copy of the private key on the server during registration

Answer

Fall back to knowledge-based security questions for account recovery

Answer

Generate a one-time recovery code at registration and store it hashed on the server

Question 5

A company uses FIDO UAF for its mobile banking app. After an OS update, some Android users can no longer authenticate. What is the most likely cause?

Accepted Answer

The server-side FIDO UAF facet list was not updated to reflect the new OS version

Answer

The FIDO UAF client was unregistered because the app's signing certificate changed after the OS update

Answer

The biometric authenticator's AAGUID changed after the OS update

Answer

The app's FIDO UAF registration expired due to inactivity

Question 6

An authenticator vendor claims their device achieves FIDO2 Level 2 certification. What assurance does this provide to a Relying Party?

Accepted Answer

The authenticator's firmware has been independently audited and confirmed tamper-resistant

Answer

The authenticator passed FIDO Alliance interoperability testing only

Answer

The authenticator meets basic WebAuthn API compliance but no hardware security requirements

Answer

The authenticator's private keys are generated in a certified hardware security module

Question 7

A developer is building a WebAuthn Relying Party and must choose between storing credentials indexed by user handle vs. username. Which approach aligns with FIDO2 privacy best practices?

Accepted Answer

Index by user handle (opaque byte array) to prevent authenticators from leaking usernames

Answer

Index by username to simplify user management and debugging

Answer

Use email address as both username and user handle for consistency

Answer

Store credentials by AAGUID to group credentials by authenticator type