1

I would like to know how this UAF method works when we lose our phone. With Google Authenticator we have to save on a paper some info about the generation of the secret key. But how does this work with UAF?

If you have also some website that implements it and where I can try it thank you for sharing them.

0

1 Answer 1

1

According to the documentation, it appears that there is no graceful way to pass registration over to another device. Only deregistration and re-registration.

This makes sense since the keypair is generated on the device.

6
  • I have read this text and I didn't understand what is "RP". Because in a lot of 2FA, do remove this second factor you have to be logged in (thanks to the second factor). Thanks for your help.
    – AndoKarim
    Commented Mar 8, 2018 at 16:29
  • "RP" is Relaying Party
    – schroeder
    Commented Mar 8, 2018 at 16:29
  • Ok so I don't understand yet how we can contact the RP if we lost our phone. Or how the RP can contact the FIDO Authenticator. Because in the first link between a device and the RP, we don't authenticate so the RP only knows that we're the owner of the device, but we don't know if we're the real person behind the identity on the website. So how could you say "YES i'm the real owner of this account and I really lost my device, please remove the link".
    – AndoKarim
    Commented Mar 9, 2018 at 15:27
  • This requires a parallel authentication process where the user contacts the RP support line to deregister and re-register. This is not automatic. This is where "security questions" etc. come into play.
    – schroeder
    Commented Mar 9, 2018 at 15:29
  • It means that if we want to implement that, we have to create a process when the user authenticate (and not identify) himself and then he'll be able to prove his identity in case of loss. Thank you for your help!
    – AndoKarim
    Commented Mar 9, 2018 at 15:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .