Will using WebAuthn for an application make it two factor? I am specifically interested in using Ondevice biometrics and achieve passwordless authentication.

For a true two factor authentication you need one to use two of the three forms of authentication: "something you know", "something you have" and "something you are".

When using WebAuthn using on-device biometrics, can we call the device that I am using to access the portal as "something you have" and the biometric as "something you are"?


2 Answers 2


WebAuthn by itself, no. WebAuthn is simply a public-key-based authentication method with some requirements for how the proof of ownership occurs. You can, for example, use WebAuthn with a hardware token such as a Yubikey and get only single-factor auth (assuming no passphrase is required on the hardware token). Apple's recent innovation of roaming your WebAuthn private keys through iCloud means that an attacker with only a user's password could also do WebAuthn as only a single factor (password, no need for a device the victim actually owns).

WebAuthn where you require that the private key be protected by some other factor such as a fingerprint is... sort of 1.5 factor? In the case of a compliant client, it's going to require multiple factors. However, the server has no way to know. The client could be somebody furiously typing into ncat, copy-pasting the signed data out of the openssl command-line tool, for all you know. In practice, people don't usually worry about this - if some user wants to go well out of their way to use a client that fraudulently claims to be requiring multiple factors, that's on the user's head and not your problem - but it does become an issue if there's a risk that the key could be stolen. For example, consider the biometric case. The server has no idea what the user's fingerprint looks like; that's never transmitted to them. Instead, the client captures the fingerprint, checks it against the stored fingerprint data, and uses the private key if there's a match. If an attacker can steal that private key out of your client, the attacker can simply pretend that there's still a fingerprint involved, but really there isn't. The only credential that the server actually checks is whether the client has the right private key.

Now, in practice, most devices these days store the private key in a secure enclave, a hardware-protected region of modern CPUs and HSMs where the key can't be exfiltrated, and where code that can't be tampered with by other code can run (such as fingerprint-comparison code). Stealing keys out of a secure enclave, or fooling the secure enclave into thinking that you're the legitimate user of that key when you're not, is as-close-as-they-can-make-it-to impossible. As such, you're probably not at risk of a user's key being extracted from a stolen device and used without the user's fingerprint, or at least without some other credential of the user's (such as a device unlock PIN/swipe pattern, which in many cases can be used as an alternative to fingerprints to unlock WebAuthn platform credentials); given that, it's almost as good as true MFA.


I think it depends if you are limiting access to your service by devices by some reasonable method.

If you have to use a domain joined laptop then probably yes. If you are using an app on a mobile device, then using the native biometrics capability to encrypt a secret then probably yes.

  • Thanks @ste-fu .That helps. Also, in order to compromise my access a bad actor will need to possess both my device (since I had enrolled my biometrics only on that device) and my biometric (e.,g fingerprint) - thus making it a two factor authentication. Commented Dec 13, 2018 at 12:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .