1

I would like to know how this UAF method works when we lose our phone. With Google Authenticator we have to save on a paper some info about the generation of the secret key. But how does this work with UAF?

If you have also some website that implements it and where I can try it thank you for sharing them.

1

According to the documentation, it appears that there is no graceful way to pass registration over to another device. Only deregistration and re-registration.

This makes sense since the keypair is generated on the device.

  • I have read this text and I didn't understand what is "RP". Because in a lot of 2FA, do remove this second factor you have to be logged in (thanks to the second factor). Thanks for your help. – AndoKarim Mar 8 '18 at 16:29
  • "RP" is Relaying Party – schroeder Mar 8 '18 at 16:29
  • Ok so I don't understand yet how we can contact the RP if we lost our phone. Or how the RP can contact the FIDO Authenticator. Because in the first link between a device and the RP, we don't authenticate so the RP only knows that we're the owner of the device, but we don't know if we're the real person behind the identity on the website. So how could you say "YES i'm the real owner of this account and I really lost my device, please remove the link". – AndoKarim Mar 9 '18 at 15:27
  • This requires a parallel authentication process where the user contacts the RP support line to deregister and re-register. This is not automatic. This is where "security questions" etc. come into play. – schroeder Mar 9 '18 at 15:29
  • It means that if we want to implement that, we have to create a process when the user authenticate (and not identify) himself and then he'll be able to prove his identity in case of loss. Thank you for your help! – AndoKarim Mar 9 '18 at 15:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.