Is using WebAuthn alone considered as two factor authentication?

Question

Will using WebAuthn for an application make it two factor? I am specifically interested in using Ondevice biometrics and achieve passwordless authentication.

For a true two factor authentication you need one to use two of the three forms of authentication: "something you know", "something you have" and "something you are".

When using WebAuthn using on-device biometrics, can we call the device that I am using to access the portal as "something you have" and the biometric as "something you are"?

Answer 1

I think it depends if you are limiting access to your service by devices by some reasonable method.

If you have to use a domain joined laptop then probably yes. If you are using an app on a mobile device, then using the native biometrics capability to encrypt a secret then probably yes.