One of the main things that surprises me about the new WebAuthn standard is the fact that these biometrics or U2F keys replace passwords instead of complementing them. Why is this done, and is it secure?


Whether WebAuthN can work as the only factor for authentication or only as a second factor depends, among other things, on the authenticator's capabilities.

The specification's section on taxonomies of authenticators explains this very well: Only authenticators listed as Multi-factor in the Authentication Factor Capability can replace an existing combination of a password and second factor (for example, Password and Yubikey).

Of course, it is ultimately up to the Relying Party, i.e. the site or service allowing WebAuthN-based authentication, to decide whether it is willing to accept a single factor only for authentication (e.g. password only; Yubikey only), a multi-factor capable authenticator (e.g. a CTAP2-capable Yubikey together with PIN entry) or any combination thereof (e.g. password and Yubikey without PIN entry, password and platform authenticator with biometric authentication).

For example, you could imagine a site allowing initial logins using a Yubikey only, but subsequently requiring Yubikey + PIN entry for sensitive operations (e.g. money transfers, registering additional authenticators etc.)

  • Testing this out on webauthn.io with a YubiKey and my Android phone using Chrome, and I never get a prompt for a pin. Why is it that Chrome on Android does not require a pin when Chrome on my laptop (MacBook) does? Feels like WebAuthN as a single factor is a bad idea if you can get hold of someone's hardware and never need to know a password? – benjovanic Dec 17 '19 at 19:07
  • So it turns out that Chrome on laptop was using FIDO2 while Chrome on Android was using FIDO U2F. The latter requires no pin. I still have concerns about a passwordless future with hardware devices and single factor auth. – benjovanic Dec 17 '19 at 19:27
  • To avoid this, a site can require the authenticator to perform user verification. Try it here, for example: passwordless.dev/custom – lxgr Dec 18 '19 at 20:07

WebAuthn does not replace passwords, it's up to you to decide if you want to use only WebAuthn or password + WebAuthn.

WebAuthn just standardizes the protocols and APIs for using various hardware based (mostly) authenticators.

Its just a side effect that using WebAuthn authenticator (token) may remove the need for passwords. That's why it's sometimes advertised as "password killer".

Also, WebAuthn is not limited to one factor, this depends on the authenticator used. Almost always authenticator provides "possession" factor, but it's not limited to that and can also be combined with "knowledge" and/or "inherence".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.