SMS to recover is a major liability.Īn example of how NOT to do things on a popular website is Coinbase, which allows one FIDO device and only allows SMS as a recovery mechanism. One time passwords to recover are also nice. If you're going to do Webauthn, please allow users to add multiple instances, much like how Microsoft allows you to have multiple browsers, hardware keys, etc. One interesting observation is that the actual Yubikey authentication is done locally on the client from a Windows Security Popup screenshots attached. Select Webauthn and register the Yubikey and then log in. I use LastPass on my phone (Chrome), Macbook Pro (Chrome, Firefox, Safari), and Windows machine (Firefox). Im already logged in to the server and using Microsoft Edge, navigate to. secure enclave, etc.) Ideally I'd like to be able to configure Webauthn to work from *multiple* browsers on *multiple* computers. Numerous browsers now support Webauthn on phones and computers where the environment has been deemed secure (i.e. There is not one specific Yubikey key, as there are several in the series. Thankfully that is not required for LastPass currently. Webauthn with SMS recovery is basically a huge security risk at this point.

I now view SMS messages as an account recovery option as a liability since it has been shown recently how easy it is to hijack a phone number (Google search for recent accounts of this).

In addition to the security concerns already mentioned, I'll bring up another few points.

Fido2 yubikey