We're transitioning to a completely passwordless setup using FIDO2, which sounds promising, but I have concerns about what happens if a user loses their passkey. For example, if someone loses their hardware key or their phone dies while traveling, the usual recovery process seems to involve creating a password-equivalent secret again, which seems counterproductive. Microsoft suggests having multiple passkeys per user, but that's a stretch considering our team often struggles to manage even one. Are we just setting ourselves up for chaos where losing a device becomes a call to the help desk for identity verification? Or is there a better recovery solution that doesn't compromise security? What strategies are out there for handling this risk?
5 Answers
Great question! Right now, when users lose their phone, recovery often becomes quite a task. It might help to have a solid reset or re-enablement process in place. Some colleagues of mine use a mix of syncable passkeys, a backup authenticator app, and even trusted devices that can temporarily create a passkey. We ended up going with a human verification approach for recovery – it can be a bit of a hassle but it suits our risk tolerance better. Just remember, there's no perfect solution – you’re always balancing between security and user experience!
Yeah, the recovery aspect is a real challenge! I believe having solid identity verification is key. Some teams are pre-provisioning SMS as a backup or requiring passkeys for certain roles, which seems to help if people ever lose their devices. Plus, using something like Windows Hello can be safer since it uses hardware devices as well.
You’re not alone in this worry! Just last week, I lost access to my email because of a similar situation. In enterprise setups, they usually create break-glass accounts for these disaster scenarios. That way, if something goes wrong, there’s a safety net in place.
You hit the nail on the head! Recovery is often the weak point with these passwordless systems. It's all about acknowledging the trade-offs. You can either enforce strict security which makes losing a device a painful recovery process, or opt for a smoother recovery process which might lower security a notch. I’ve seen teams mitigate this by issuing multiple passkeys and having fallback options like verified emails or helpdesk checks. It’s not 'pure' FIDO anymore, but it’s more practical.
We've been through this too! After rolling out FIDO2 keys, we implemented a policy where users can get one key replaced for free, but they'll need to buy a new one after that. For lost keys, HR verifies the identity via an outbound phone call before IT helps set up a replacement key. We also have spare keys available at physical locations for easier access. It’s a bit of a process, but it keeps everything secure.
Related Questions
How to Build a Custom GPT Journalist That Posts Directly to WordPress
Cloudflare Origin SSL Certificate Setup Guide
How To Effectively Monetize A Site With Ads