FIDO Communication & Client Relations 2 — Questions and Answers
Question 1: A client asks why FIDO2 is more secure than SMS-based OTP. What is the most accurate explanation to provide?
- FIDO2 uses longer numeric codes that are harder to guess
- FIDO2 uses public-key cryptography so credentials never leave the device (Correct answer)
- FIDO2 requires a second device to complete authentication
- FIDO2 encrypts SMS messages before delivery
Correct answer: FIDO2 uses public-key cryptography so credentials never leave the device
FIDO2 relies on asymmetric cryptography where the private key stays on the user's device and is never transmitted, eliminating interception risks that affect SMS OTP.
Question 2: When a relying party client asks about user verification requirements, which FIDO term best describes the process where the authenticator confirms the user's identity locally?
- User Presence (UP)
- User Verification (UV) (Correct answer)
- Attestation
- Binding
Correct answer: User Verification (UV)
User Verification (UV) is the FIDO concept where the authenticator confirms the user's identity through PIN, biometric, or similar method before releasing the credential.
Question 3: A client is concerned about vendor lock-in with FIDO authenticators. How should you address this concern?
- FIDO authenticators are proprietary, so some lock-in is unavoidable
- FIDO is an open standard ensuring interoperability across compliant vendors and platforms (Correct answer)
- Clients should purchase authenticators only from FIDO Alliance members to avoid lock-in
- Lock-in is eliminated because FIDO uses cloud-synced credentials
Correct answer: FIDO is an open standard ensuring interoperability across compliant vendors and platforms
FIDO is an open industry standard; any FIDO-certified authenticator works with any FIDO-compliant relying party, ensuring broad interoperability without vendor dependency.
Question 4: A client asks whether FIDO credentials can be phished. What is the correct response?
- FIDO credentials can be phished if the user is tricked into entering their PIN on a fake site
- FIDO credentials are phishing-resistant because they are cryptographically bound to the origin (Correct answer)
- FIDO credentials are phishing-resistant only when biometrics are used
- FIDO credentials can be phished via man-in-the-middle attacks on the server
Correct answer: FIDO credentials are phishing-resistant because they are cryptographically bound to the origin
FIDO credentials are bound to the specific origin (domain) registered during enrollment, so they will not work on a fraudulent site, making them inherently phishing-resistant.
Question 5: During a client briefing, they ask what 'attestation' means in the context of FIDO. Which explanation is most accurate?
- A mechanism that encrypts user biometric data before storage
- A certificate proving the authenticator model and its security properties to the relying party (Correct answer)
- The process of linking a user account to their authenticator
- A protocol for syncing passkeys across devices
Correct answer: A certificate proving the authenticator model and its security properties to the relying party
Attestation is a cryptographic mechanism that allows an authenticator to prove its model and security characteristics to a relying party during registration.
Question 6: A client wants to deploy FIDO for employees but is worried about account recovery if a user loses their authenticator. What is the best guidance?
- FIDO does not support account recovery, so users must re-register from scratch
- Organizations should implement account recovery processes outside of FIDO, such as backup codes or administrator-assisted re-enrollment (Correct answer)
- FIDO automatically backs up private keys to a recovery server
- Users can transfer their private key to a new device using their password
Correct answer: Organizations should implement account recovery processes outside of FIDO, such as backup codes or administrator-assisted re-enrollment
FIDO does not define an account recovery mechanism; organizations must establish complementary recovery workflows like backup authenticators or admin re-enrollment processes.
Question 7: A client asks about the difference between platform and roaming authenticators. Which statement accurately distinguishes them?
- Platform authenticators are cloud-based; roaming authenticators are on-premises
- Platform authenticators are built into a device (e.g., TPM, Face ID), while roaming authenticators are external devices like security keys (Correct answer)
- Platform authenticators support only biometrics; roaming authenticators support only PINs
- Platform authenticators require internet connectivity; roaming authenticators work offline only
Correct answer: Platform authenticators are built into a device (e.g., TPM, Face ID), while roaming authenticators are external devices like security keys
Platform authenticators are integrated into the device (using its secure enclave or TPM), while roaming authenticators are portable external devices such as USB security keys that can be used across multiple devices.
FIDO Communication & Client Relations 2
A client asks why FIDO2 is more secure than SMS-based OTP.
What is the most accurate explanation to provide?