[throwawayian]

I don’t think you understand the problem space. Although, this is a great alternative for SMB’s who aren’t being targeted by attackers who are writing tools specifically for their business.

But, also.. A hardcoded “what’s 7\1=“ would also achieve the same outcome.

Barrier to beat is “can the attacker put together a webauthn emulator”. Low, but will work for many organisations for a long time.