FIDO Risk Assessment & Mitigation 2 — Questions and Answers
Question 1: Which attack vector is FIDO2 specifically designed to eliminate compared to password-based authentication?
- Brute force dictionary attacks
- Phishing and credential replay attacks (Correct answer)
- Denial-of-service attacks
- SQL injection attacks
Correct answer: Phishing and credential replay attacks
FIDO2 binds credentials to a specific origin, making phishing and replay attacks cryptographically impossible.
Question 2: An enterprise is concerned that employees may clone FIDO hardware authenticator keys. Which FIDO property directly mitigates this risk?
- PIN complexity requirements
- Device-bound private keys that cannot be exported (Correct answer)
- Biometric enrollment thresholds
- Attestation certificate rotation
Correct answer: Device-bound private keys that cannot be exported
FIDO authenticators store private keys in secure hardware that prevents extraction, making cloning infeasible.
Question 3: A threat model identifies a risk of an attacker intercepting authentication traffic. Why does this pose minimal risk in a FIDO deployment?
- FIDO uses end-to-end encryption for all messages
- Each authentication response uses a unique challenge and is bound to the origin (Correct answer)
- FIDO relies on VPN tunnels for transport security
- The relying party rotates keys after each session
Correct answer: Each authentication response uses a unique challenge and is bound to the origin
FIDO signatures are scoped to a unique server challenge and the specific origin, rendering intercepted responses useless for replay.
Question 4: Which FIDO authenticator characteristic reduces the risk of a compromised authenticator affecting multiple relying parties?
- Shared attestation keys across all relying parties
- A unique credential key pair generated per relying party (Correct answer)
- A single master key stored in the cloud
- Universal PIN used across all registered services
Correct answer: A unique credential key pair generated per relying party
FIDO generates a unique key pair for each relying party, so compromise at one site does not expose credentials at others.
Question 5: In a FIDO risk assessment, 'user presence' verification is classified as which level of assurance compared to 'user verification'?
- Higher, because it requires physical touch
- Lower, because it does not confirm the user's identity (Correct answer)
- Equal, because both require biometrics
- Lower, because it is always performed remotely
Correct answer: Lower, because it does not confirm the user's identity
User presence only confirms physical access to the device, while user verification (PIN/biometric) additionally confirms the identity of the person.
Question 6: A FIDO relying party wants to mitigate the risk of a stolen authenticator being used by an unauthorized person. Which control is most effective?
- Requiring attestation certificate validation
- Enforcing user verification (UV) at authentication time (Correct answer)
- Increasing the challenge nonce length
- Enabling cross-origin iframes for authentication
Correct answer: Enforcing user verification (UV) at authentication time
Requiring user verification (PIN or biometric) ensures that possession of the device alone is not sufficient to authenticate.
Question 7: Which risk is introduced when a relying party accepts 'none' attestation from a FIDO authenticator?
- The user's biometric data is exposed to the server
- The server cannot verify the authenticator's hardware provenance or security level (Correct answer)
- The credential is stored in plaintext on the device
- The authentication ceremony becomes synchronous
Correct answer: The server cannot verify the authenticator's hardware provenance or security level
Accepting 'none' attestation means the relying party cannot confirm whether the authenticator meets any certified security standard.
FIDO Risk Assessment & Mitigation 2
Which attack vector is FIDO2 specifically designed to eliminate compared to password-based authentication?