2

One of the main things that surprises me about the new WebAuthn standard is the fact that these biometrics or U2F keys replace passwords instead of complementing them. Why is this done, and is it secure?

2

Whether WebAuthN can work as the only factor for authentication or only as a second factor depends, among other things, on the authenticator's capabilities.

The specification's section on taxonomies of authenticators explains this very well: Only authenticators listed as Multi-factor in the Authentication Factor Capability can replace an existing combination of a password and second factor (for example, Password and Yubikey).

Of course, it is ultimately up to the Relying Party, i.e. the site or service allowing WebAuthN-based authentication, to decide whether it is willing to accept a single factor only for authentication (e.g. password only; Yubikey only), a multi-factor capable authenticator (e.g. a CTAP2-capable Yubikey together with PIN entry) or any combination thereof (e.g. password and Yubikey without PIN entry, password and platform authenticator with biometric authentication).

For example, you could imagine a site allowing initial logins using a Yubikey only, but subsequently requiring Yubikey + PIN entry for sensitive operations (e.g. money transfers, registering additional authenticators etc.)

1

WebAuthn does not replace passwords, it's up to you to decide if you want to use only WebAuthn or password + WebAuthn.

WebAuthn just standardizes the protocols and APIs for using various hardware based (mostly) authenticators.

Its just a side effect that using WebAuthn authenticator (token) may remove the need for passwords. That's why it's sometimes advertised as "password killer".

Also, WebAuthn is not limited to one factor, this depends on the authenticator used. Almost always authenticator provides "possession" factor, but it's not limited to that and can also be combined with "knowledge" and/or "inherence".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.