What Happens If You Lose Your Passkey in a Passwordless System?
Asked by
TechSavvy58
We're transitioning to a completely passwordless setup using FIDO2, which sounds promising, but I have concerns about what happens if a user loses their passkey. For example, if someone loses their hardware key or their phone dies while traveling, the usual recovery process seems to involve creating a password-equivalent secret again, which seems counterproductive. Microsoft suggests having multiple passkeys per user, but that's a stretch considering our team often struggles to manage even one. Are we just setting ourselves up for chaos where losing a device becomes a call to the help desk for identity verification? Or is there a better recovery solution that doesn't compromise security? What strategies are out there for handling this risk?
Answers
We've been through this too! After rolling out FIDO2 keys, we implemented a policy where users can get one key replaced for free, but they'll need to buy a new one after that. For lost keys, HR verifies the identity via an outbound phone call before IT helps set up a replacement key. We also have spare keys available at physical locations for easier access. It’s a bit of a process, but it keeps everything secure.
Reply to this answer
You hit the nail on the head! Recovery is often the weak point with these passwordless systems. It's all about acknowledging the trade-offs. You can either enforce strict security which makes losing a device a painful recovery process, or opt for a smoother recovery process which might lower security a notch. I’ve seen teams mitigate this by issuing multiple passkeys and having fallback options like verified emails or helpdesk checks. It’s not 'pure' FIDO anymore, but it’s more practical.
Reply to this answer
You’re not alone in this worry! Just last week, I lost access to my email because of a similar situation. In enterprise setups, they usually create break-glass accounts for these disaster scenarios. That way, if something goes wrong, there’s a safety net in place.
Reply to this answer
Yeah, the recovery aspect is a real challenge! I believe having solid identity verification is key. Some teams are pre-provisioning SMS as a backup or requiring passkeys for certain roles, which seems to help if people ever lose their devices. Plus, using something like Windows Hello can be safer since it uses hardware devices as well.
Reply to this answer
Great question! Right now, when users lose their phone, recovery often becomes quite a task. It might help to have a solid reset or re-enablement process in place. Some colleagues of mine use a mix of syncable passkeys, a backup authenticator app, and even trusted devices that can temporarily create a passkey. We ended up going with a human verification approach for recovery – it can be a bit of a hassle but it suits our risk tolerance better. Just remember, there's no perfect solution – you’re always balancing between security and user experience!
Reply to this answer
Add your answer
Answers are reviewed before publication.
Related Discussions