FIDO Communication & Client Relations 2

Question 1

A client asks why FIDO2 is more secure than SMS-based OTP. What is the most accurate explanation to provide?

Accepted Answer

FIDO2 uses public-key cryptography so credentials never leave the device

Answer

FIDO2 relies on asymmetric cryptography where the private key stays on the user's device and is never transmitted, eliminating interception risks that affect SMS OTP.

Question 2

When a relying party client asks about user verification requirements, which FIDO term best describes the process where the authenticator confirms the user's identity locally?

Accepted Answer

User Verification (UV)

Answer

User Verification (UV) is the FIDO concept where the authenticator confirms the user's identity through PIN, biometric, or similar method before releasing the credential.

Question 3

A client is concerned about vendor lock-in with FIDO authenticators. How should you address this concern?

Accepted Answer

FIDO is an open standard ensuring interoperability across compliant vendors and platforms

Answer

FIDO is an open industry standard; any FIDO-certified authenticator works with any FIDO-compliant relying party, ensuring broad interoperability without vendor dependency.

Question 4

A client asks whether FIDO credentials can be phished. What is the correct response?

Accepted Answer

FIDO credentials are phishing-resistant because they are cryptographically bound to the origin

Answer

FIDO credentials are bound to the specific origin (domain) registered during enrollment, so they will not work on a fraudulent site, making them inherently phishing-resistant.

Question 5

During a client briefing, they ask what 'attestation' means in the context of FIDO. Which explanation is most accurate?

Accepted Answer

A certificate proving the authenticator model and its security properties to the relying party

Answer

Attestation is a cryptographic mechanism that allows an authenticator to prove its model and security characteristics to a relying party during registration.

(FIDO) FIDO Certified Authenticator Practice Test

(FIDO) FIDO Certified Authenticator Practice Test

FIDO Communication & Client Relations 2