Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Will using WebAuthn for an application make it two factor? I am specifically interested in using Ondevice biometrics and achieve passwordless authentication.
For a true two factor authentication you need one to use two of the three forms of authentication: "something you know", "something you have" and "something you are".
When using WebAuthn using on-device biometrics, can we call the device that I am using to access the portal as "something you have" and the biometric as "something you are"?
I think it depends if you are limiting access to your service by devices by some reasonable method.
If you have to use a domain joined laptop then probably yes. If you are using an app on a mobile device, then using the native biometrics capability to encrypt a secret then probably yes.
