6 ms·
To clarify, biometrics are only used for local authentication against the platform authenticator. An attacker still needs the authenticators private data, too.
by wolletd 3y ago
To clarify, biometrics are only used for local authentication against the platform authenticator. An attacker still needs the authenticators private data, too. The authentication against the service is using public key crypto.
Also, you should be able to use a platform authenticator with a PIN.
- elderlybanana 3y agoI think understanding this distinction is going to be one of the main challenges for mainstream WebAuthn adoption over passwords as the default authentication method.