As I read through the WebAuthn / FIDO2 documentation, it appears the authentication is done on the local device to create an attestation to the FIDO server. This future implies the "biometrics" or other Authenticator means must be connected to the local client/browser.
I am wondering if the current FIDO2/WebAuthn standard allows more of a non-connected style of authentication and how I might do it?
The use case would be more of:
- I person goes into the public library to pay bills
- Login into the bill site, it would be good to use WebAuthn to avoid entering credentials onto a public PC which could be infected with malware
- WebAuthn presents a QR Code on the Public PC Browser
- Person scans QR Code on Cellphone with app to authorize PC session (This is where I see the issue)
- Cellphone challenges use (bio, pin, etc) and provides Attestation to server
- Person is authorized to access site and pay bills without entering password on public system
The main motivation here is the desire to not carry a dongle which can be left behind or lost. Most people are very careful of their phone or quickly realize it is missing or left behind. I would like to make the cellphone the "Plug-In".