WebAuthn does not require a USB device. For the first few sites that deprecate passwords the explanation will be something like "we have strict security requir

WebAuthn does not require a USB device. For the first few sites that deprecate passwords the explanation will be something like "we have strict security requirements, passwords are not secure, we're getting rid of them". Once that becomes the norm for high-security applications other sites will follow, since they won't have to deal with the initial barrier of getting users to set up WebAuthn. > WebAuthn has been around for almost 8 years now (published May 2016). Big Players enthusiastically support it. They enthusiastically support it for 2FA. I haven't seen any concerted effort yet to use WebAuthn as a password replacement, or to implement any of the basic features that would make that viable (like synced credentials). I find that very disappointing, as we could have been well on our way to phasing out passwords already if the big players in the space had started this 4 years ago back when the WebAuthn spec was finalized.