Google recently announced support for Universal 2nd Factor (U2F) authentication in Chrome and started allowing that authentication mechanism to be used for 2-factor authentication across their various web services. After reading up on U2F I'm starting to really like the idea, but I also noticed that the Fast IDentity Online (FIDO) Alliance (the same organization which created the U2F standard) seems to have another, very similar authentication standard called the Universal Authentication Framework (UAF). At first glance, these two standards seem very similar:
With both standards, it seems the website requests authentication, the user authenticates with a local device, and the website then accepts this authentication and signs the user in.
The only differences I can see on the surface are that it seems that FIDO is intending for UAF to replace passwords entirely, whereas U2F is only meant to replace the second factor of the authentication process. I'm very unsure as to the reasoning behind this though, given that both authentication mechanisms seem to be so similar from the user's perspective.
How do these standards differ from an implementation and security standpoint?