Platform support isn't exactly the problem. Apple, Microsoft, and Android all support WebAuth (https://blog.mozilla.org/security/2019/03/19/passwordless-web-au

Platform support isn't exactly the problem. Apple, Microsoft, and Android all support WebAuth (https://blog.mozilla.org/security/2019/03/19/passwordless-web-authentication-support-via-windows-hello/ https://blog.mozilla.org/security/2019/03/19/passwordless-we..., https://webkit.org/blog/11312/meet-face-id-and-touch-id-for-the-web/ https://webkit.org/blog/11312/meet-face-id-and-touch-id-for-..., https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/webauthnapis https://docs.microsoft.com/en-us/windows/security/identity-p..., https://developers.google.com/identity/fido/android/native-apps https://developers.google.com/identity/fido/android/native-a...), so most (??) users are in fact covered. eBay, for example, offers a passwordless experience using WebAuthn--so it can be done, even on a major consumer site. The problem is really that until relying parties can trust that 1. Platforms will backup and restore key material from authenticators 2. Users will figure out how to use those backups (including if they e.g. switch from Mac to Windows) they will have to provide some fallback. (Realistically, that means "for the foreseeable future.") This relegates WebAuthn, unfortunately, to a "neat trick"--eBay's "passwordless option"--and not a security guarantee. (Phishers can always downgrade the user to passwords or similar.) What's needed in the interregnum is probably a way to make that fallback option more secure by, at minimum, conveying to users that it's not _normal_--so that phishing attempts targeting that phishable backup are less likely to succeed. Unfortunately this requires a lot of good UX design and unilateral action on part of the relying parties, which I think is tough.