3 ms·

User verification is optional. If you only do user presence and non-discoverable, then WebAuthn is completely stateless and deterministic for a given (challeng

User verification is optional. If you only do user presence and non-discoverable, then WebAuthn is completely stateless and deterministic for a given (challenge,rpId,origin) triplet

michaelt 2y ago
Isn't a 'passkey' with no discoverable credentials and no user verification just a regular U2F token?
- Borealid 2y ago
  Well, it could still provide credBlob (up to 32 bytes of data stored in the non-discoverable credential and handed back after verification). But mostly yes, it's losing the advantages of FIDO2.
- arianvanp 2y ago
  Modulo supporting more algorithms -- yes