Will using WebAuthn for an application make it two factor? I am specifically interested in using Ondevice biometrics and achieve passwordless authentication.
For a true two factor authentication you need one to use two of the three forms of authentication: "something you know", "something you have" and "something you are".
When using WebAuthn using on-device biometrics, can we call the device that I am using to access the portal as "something you have" and the biometric as "something you are"?