I provide a web application that uses FIDO2 for two-factor authentication. Recently I got reports that Windows users have to enter a PIN each time they use their hardware token. As far as I understand, this is considered a form of user verification.

To me this feels silly because I already asked users for a password. It effectively turns two-factor authentication into three-factor authentication.

Maybe this makes more sense if FIDO2 is used for passwordless authentication. Then again, that could no longer be considered passwordless, would it?

I don't want to remove a relevant security feature. But I already got reports that people switched from a FIDO2 token to TOTP apps on their smart phones, which AFAIU is a downgrade in terms of security.

What are the intended use cases for user verification? Is it reasonable to discourage user verification for two factor authentication in general?

2 Answers 2


Whether you should require a PIN for the security key depends on your goals.

If you want to have maximum security, such as is required in some corporate environments, then the PIN can be helpful. If the PIN is not correct, then the security key simply won't sign, and it's verified on the security key. This will protect against a stolen (or seized, legally or not) security key, which may be a concern that you have to consider, depending on your threat model.

However, if, as you mention, people have alternate factors such as TOTP and they're choosing to use TOTP over a FIDO2 security key, then that's definitely less secure, since you're losing resistance to phishing. You'd be better off skipping the PIN and letting people use their security keys without them. "discouraged" is probably the best option there.


You can have an option asking if you should set the credential to User-Verification required. There is also the option "Preferred" for User Verification.

The password + FIDO2 w/ PIN is NOT three-factor. It is still two-factor, you just use the "something you know" twice, it is more properly called "multi-step".

The PIN is different from a password, since it doesn't log you in and doesn't perform authentication to the service, it authenticates the user to the device and activates the device, for it to perform a log in by signing an authentication request, using Public Key Cryptography. Moreover, a stolen PIN still cannot authenticate, since the actual signing key is on the device itself. "Passwordless" means that a static authentication credential is not sent to the server for verification. Instead, the PIN is used to activate the security key, so it can sign an authentication request. A PIN IS DIFFERENT AND BETTER THAN A PASSWORD!

Many Users prefer TOTP because, to them, it might be easier to user. Also, even the TOTP apps have some kind of User Verification, since the User still has to unlock their device with a PIN or fingerprint (Lock Screen), before they can access the app. I agree that it is still a downgrade, though, because it doesn't prevent phishing or fake URLs (the Users have to verify that themselves).

Use case for User Verification? It obviates the need for a password (ONLY if set to "required", though). Even if a password is asked for logging in, it becomes irrelevant if the security key requires a PIN. Even if that password is know, the account is still safe. User Verification protects from weak passwords (ONLY if set to "required", though). User Verification also protects from someone finding the security key lying around and using it, with the aforementioned weak/guessable password. It, also, makes the authentication process "multi-step".

I advise that User Verification should be used and set to "required" for uniform and universal security.

  • 1
    In my case it is not an option to skip the password. I totally understand that PINs have benefits for passwordless, but that is not what my question was about.
    – tobib
    Apr 29, 2023 at 16:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .