Achieving User-Friendly and Secure Account Recovery with WebAuthn

Session Details

WebAuthn promises strong, phishing-resistant and easy-to-use multi-factor authentication (MFA) using built-in biometrics or security keys. But one question remains: “What if I lose my key and get locked out of my account?”

Existing recommendations aren’t ideal from a user experience perspective. We go over the current state, some alternative proposals, and lastly we propose an extension to introduce a user-friendly solution for backup authenticators, without sharing secrets or private keys.