Overcoming the UX Challenges Faced by FIDO Credentials in the Consumer Space

Abstract

Cryptographic authentication using FIDO credentials promises to improve cybersecurity by preventing man-in-the-middle phishing attacks against traditional two-factor authentication. But the FIDO Alliance reported in a March 2022 white paper that FIDO authentication had not yet attained large-scale adoption in the consumer space, citing user experience challenges such as the burden of enrolling a new device to replace a lost or stolen device. Passkey syncing is now being implemented to eliminate the need to enroll a new device with the relying party, but it requires password-based, phishing-vulnerable enrollment with the platform provider. This paper proposes and shows how to implement two alternative user experiences that overcome these challenges. The first proposed UX lets the user log in on any browser, in any device, with on-the-fly device enrollment using an email verification link for authentication. The second UX frees the user from having to set up device locking, by using as a second factor a password submitted to the relying party, instead of a device-unlocking PIN or biometric. The password is protected against reuse at malicious sites and backend database breaches by being used together with an enhanced cryptographic credential in a joint authentication procedure. The same enhanced credential is replicated in all devices, without syncing, by regenerating it from a seed derived in an HSM from a master secret and the email address.