Yeah, this is a bad article leading to a really bad discussion. FIDO2 is basically proposing to replace passwords with U2F. How the keys are generated, exchange

Yeah, this is a bad article leading to a really bad discussion. FIDO2 is basically proposing to replace passwords with U2F. How the keys are generated, exchanged, and challenged has nothing to do with biometrics[1]. That part of this appears to be MS and Google demonstrations of using biometrics to unlock what is essentially just an OS password manager for U2F keys, which wouldn't even raise an eyebrow if found in today's Android or iOS. [1] The relevant part of the spec: "In order to provide evidence of user interaction, an external authenticator implementing this protocol is expected to have a mechanism to obtain a user gesture. Possible examples of user gestures include: as a consent button, password, a PIN, a biometric or a combination of these." https://fidoalliance.org/specs/fido-v2.0-rd-20170927/fido-client-to-authenticator-protocol-v2.0-rd-20170927.html https://fidoalliance.org/specs/fido-v2.0-rd-20170927/fido-cl...