FIDO2 is the single most impressive piece of technology that can have an impact on human behavior and cybersecurity. Let’s get that out of the way. It’s a bold statement, but we’re going to tell you why. While multi-factor and two-factor authentication have tried their hands at creating a more secure internet experience for users, they just aren’t effective and frankly, are buzz words. The fact of the matter is hackers have little trouble moving around things like codes sent by text message or account-recovery emails. MFA and 2FA have proven to just add extra user steps to a flawed and outdated system: passwords.
While FIDO2 is yet another system to adopt, it is by far the most secure option on the market and has been for years. Here are some facts that might be helpful in understanding what makes FIDO2 the best option for a secure future:
1) FIDO2 is the first protocol that allows users to register multiple, unique cryptographic key pairs associated with an account. For over half a century, people have been accustomed to associating an account with a single authentication credential, whether it is a single password or a single digital certificate + private key, etc.
FIDO shatters that paradigm and allows you to register dozens of public keys with a website if you so choose. When I demonstrate FIDO2, I show people that I have at least eight public keys registered from different devices to the demoaccount: a USB key, an NFC key, TouchID, Android resident key, Windows Hello on the TPM, etc. While this isn’t necessary for every user, I carry three different brands of security keys (on my keyring), and can authenticate to the sameaccount with all these devices.
It’s not about affordability, or because we happen to be a FOSS FIDO2 server manufacturer (and must consequently test with dozens of FIDO2 Authenticators); it’s about changing people's misconceptions that things have to be a certain way to be successfully adopted. That there has to be one, universal FIDO2 authenticator for the world to adopt it. Once you step back from that notion, life becomes easier.
2) Depending on the secure element on a device, a key pair does NOT have to be locked down to a specific device. They can be ported if the secure element design supports a secure way of transporting keys from one device to another. In our experience, keys registered on a TPM can be ported to another TPM securely—through a process called "key migration." This has existed on TPMs since 1.2 (more than 12 years ago). I know this, because our appliances that provide key management security have been using this same capability to migrate encrypted keys from one appliance to another to establish key management clusters for HA/DR.
You can migrate signing keys and encryption keys (storage keys in TPM terminology) very securely and conveniently with this TCG-defined process. However, you must have the tools to do this. The TCG spec tells you how to do this securely. Ultimately, it’s more efficient to buy a $10 security key and use it as your own "migration tool" to create FIDO2 credentials on multiple devices to the same account.
Closing Thoughts: I would encourage technologists to not get too hung up on trying to shield backup and recovery procedures from end users. The more you dumb them down, the more headaches you create for the industry becausesomewhere along the way, someone is going to make a mistake and FIDO2/WebAuthn could get compromised because of implementation flaws. Better to let every authenticator manufacturer create the most secure compartment they can key manage, and users just learn to spend $10 on an external security key as a backup/recovery device. Perhaps, we need to start calling security keys another name like backup keys or recovery keys to get consumers educated that this is not to be shunned, but rather to be embraced.
