I've been wondering about this for a while, but couldn't find much on the web, so I hope that someone could point me in the right direction for better understanding about this topic.
Would it be viable / safe to use something like a Fido U2F device as primary authentication method (mostly thinking about web apps here, but possibly not limited to)?
I've been using client-side SSL certificates in the past for this, but of course that requires client configuration; I know the same should be possible using a standard smartcard, but of course most devices nowadays lack a smartcard reader. The Fido keys look like the perfect form factor to carry around a private key pair without need for a reader; for mobile devices you could just use NFC (as newer yubikey do) or a built-in "on the go" adapter.
Now, I understand the problem of the key being stolen, but I imagine that could be solved / mitigated by using some PIN to unlock the key, as with most smartcards. As an additional security measure, websites could ask for a password as "2nd-factor". That would mean of course having to remember a password, but just for those really crytical systems you absolutely want to be well protected.
In my hope, something like this could help greatly improving both on the security point of view and lowering the login friction (for users) and complexity (for implementers) as well.
Now, is there any major issue / roadblock in going this way? It almost sounds like browsers would already be able to use a smartcard for auth, the only thing missing would be to develop an actual device (assuming there is no way to add a PIN to Fido devices)..