What if a person loses their authentication device?
2FA works when a person has the authentication device with him or her in the moment of authentication. If that device is lost or damaged it can cause the loss of access forever. That is it is important to plan well and mix authentication methods or in case of choosing FIDO2 authentication standard register more FIDO2 keys and keep them in a safe place in case the main key is lost or physically damaged.
Mixing methods (like FIDO2 and TOTP) is a good way to prevent the permanent loss of data. Let’s say that the person had only one FIDO2 device registered and this device got damaged or lost. In such a case a person can still take advantage of another 2FA method that he or she registered. In our case TOTP and an authentication app. The best authentication policy should be chosen by a security manager inside the company as that person knows best the company culture, company security awareness and can adjust authentication security requirements to that specific company’s environment.