For quite some time WebKit and others support WebAuthn. This allows for a pretty seamless 2FA experience with a key, like Yubico. On Apple devices TouchID/FaceID can also be used as a hardware key.

This creates an interesting workflow:

  1. User is promoted for U+P combo
  2. Apple Keychain prompt is automatically triggered. Placing your finger on a TouchID sensor fills in the login and password.
  3. Website requires 2FA and prompts for it using WebAuthn
  4. TouchID prompt is triggered; user accepts 2FA using the same finger

Isn't that scheme in direct violation of 2FA ideas? While following best practices (password manager, 2FA enabled, hardware key) the user in practice gets access to the system using just one fingerprint and nothing else.

1 Answer 1


No, WebAuthn is two-factor:

  1. Something you have (your device)
  2. Something you are (your fingerprint, face, etc.)

However, I think that the flow that you describe is a bit off. There is no username/password combination at all involved in WebAuthn. The prompting for the biometrics is all that is need to to login.

The workflow is:

  1. User navigates to website
  2. User is prompted for biometrics
  3. Upon the presentation of proper biometrics, user is authenticated

A lot is happening behind the scenes, but the user experience is quite simple.

You can give it a try here. It takes but a few seconds to register and then login. No password anywhere.

You can read more about how it all works here.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .