Will using WebAuthn for an application make it two factor? I am specifically interested in using Ondevice biometrics and achieve passwordless authentication.

For a true two factor authentication you need one to use two of the three forms of authentication: "something you know", "something you have" and "something you are".

When using WebAuthn using on-device biometrics, can we call the device that I am using to access the portal as "something you have" and the biometric as "something you are"?


I think it depends if you are limiting access to your service by devices by some reasonable method.

If you have to use a domain joined laptop then probably yes. If you are using an app on a mobile device, then using the native biometrics capability to encrypt a secret then probably yes.

  • Thanks @ste-fu .That helps. Also, in order to compromise my access a bad actor will need to possess both my device (since I had enrolled my biometrics only on that device) and my biometric (e.,g fingerprint) - thus making it a two factor authentication. – Nataraj Rao Dec 13 '18 at 12:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.