FIDO Communication & Client Relations 3 — Questions and Answers
Question 1: A financial services client asks how FIDO addresses regulatory requirements for strong customer authentication (SCA). What is the best response?
- FIDO satisfies SCA by requiring two separate passwords
- FIDO satisfies SCA by combining possession of the authenticator device with user verification such as a PIN or biometric (Correct answer)
- FIDO satisfies SCA only when combined with an SMS OTP
- FIDO satisfies SCA through server-side certificate pinning
Correct answer: FIDO satisfies SCA by combining possession of the authenticator device with user verification such as a PIN or biometric
FIDO meets SCA requirements by combining something-you-have (the authenticator) with something-you-know or something-you-are (PIN or biometric), satisfying multi-factor authentication mandates.
Question 2: A client asks whether passkeys and FIDO2 credentials are the same thing. How should you clarify?
- They are completely different technologies with no overlap
- Passkeys are a specific implementation of FIDO2 credentials that support multi-device sync via cloud backup (Correct answer)
- Passkeys are legacy FIDO U2F credentials rebranded for modern browsers
- Passkeys are FIDO2 credentials that only work on mobile devices
Correct answer: Passkeys are a specific implementation of FIDO2 credentials that support multi-device sync via cloud backup
Passkeys are FIDO2 discoverable credentials (resident keys) that can optionally be synced across devices using platform cloud services, making them a user-friendly evolution of FIDO2.
Question 3: When explaining FIDO to a non-technical client audience, which analogy best describes how a FIDO security key works?
- It works like a password manager that stores and types your passwords for you
- It works like a unique digital seal: the key signs a server challenge, proving identity without sending any secret (Correct answer)
- It works like a VPN that encrypts all traffic between user and server
- It works like a one-time password generator that refreshes every 30 seconds
Correct answer: It works like a unique digital seal: the key signs a server challenge, proving identity without sending any secret
A FIDO key signs a server-generated challenge with a private key, proving possession without ever transmitting the secret — analogous to signing a document with a unique seal.
Question 4: A client reports that some employees are reluctant to use biometric authenticators due to privacy concerns. What is the most accurate and reassuring explanation?
- Biometric data is stored on the FIDO server for fast verification
- Biometric data never leaves the device; the authenticator only sends a cryptographic signature after local verification (Correct answer)
- Biometric templates are shared with the FIDO Alliance for compliance auditing
- Employees must accept biometric storage on the cloud to use FIDO
Correct answer: Biometric data never leaves the device; the authenticator only sends a cryptographic signature after local verification
In FIDO, biometric matching happens entirely on the device; no biometric data is transmitted to or stored on the server, which directly addresses user privacy concerns.
Question 5: A client asks how FIDO handles the scenario where an employee's registered device is stolen. What is the correct guidance?
- The thief can authenticate using the stolen device without any additional factor
- The credential requires user verification (PIN or biometric), so a stolen device alone is insufficient to authenticate (Correct answer)
- FIDO automatically deactivates credentials on stolen devices via the FIDO server
- The private key is transmitted to the server upon device theft detection
Correct answer: The credential requires user verification (PIN or biometric), so a stolen device alone is insufficient to authenticate
FIDO credentials requiring user verification mean a stolen device cannot be used to authenticate unless the attacker also defeats the local PIN or biometric check.
Question 6: During a sales call, a prospect asks what 'FIDO Certified' means for a product. What is the most accurate explanation?
- The product was reviewed by FIDO Alliance members and approved for marketing use
- The product has been independently tested and verified to meet FIDO Alliance interoperability and security specifications (Correct answer)
- The product uses AES-256 encryption as mandated by the FIDO Alliance
- The product passed an internal vendor self-assessment against FIDO guidelines
Correct answer: The product has been independently tested and verified to meet FIDO Alliance interoperability and security specifications
FIDO Certified means the product has been tested by an accredited laboratory and verified to conform to FIDO Alliance technical specifications for security and interoperability.
Question 7: A client managing a large enterprise asks about the risk of a single compromised authenticator exposing all user accounts. How should you respond?
- One compromised authenticator exposes all accounts because FIDO uses shared keys
- FIDO generates a unique key pair per relying party, so a compromised authenticator only affects credentials registered on that device (Correct answer)
- FIDO uses a master key, so all relying parties must be notified immediately
- A compromised authenticator automatically revokes credentials on all registered sites
Correct answer: FIDO generates a unique key pair per relying party, so a compromised authenticator only affects credentials registered on that device
FIDO creates a distinct public-private key pair for each relying party during registration, so compromising one authenticator cannot expose credentials at other services.
FIDO Communication & Client Relations 3
A financial services client asks how FIDO addresses regulatory requirements for strong customer authentication (SCA).
What is the best response?