4 ms·
Passwordless login doesn't necessarily mean a physical separate dumb key, it can have many implementations that make sense: 1. WebAuthn (current spec) is also
by smileybarry 5y ago
Passwordless login doesn't necessarily mean a physical separate dumb key, it can have many implementations that make sense:
1. WebAuthn (current spec) is also implemented by Android, iOS macOS and Windows 10/11 (natively); that makes your device a possible "passwordless factor holder". You then essentially tie your authentication with your device passcode and/or biometric ID, similar to what a password manager would do, except there's no password to steal.
2. YubiKey BIO supports biometric authentication (I presume with on-board fingerprint verification) to use the device's keys. So it's essentially a biometric-protected private key.
3. IIRC some hardware crypto wallets can act as WebAuthn devices and display the website domain when asking you to touch it. Maybe they support passcode protection?
4. Even if you were to use a "raw" WebAuthn key stored on your computer (on TPM, Secure Enclave, or even filesystem) -- if you protect it with a password, you essentially have pubkey authentication with a second factor of password.