Hacker News new | ask | show | jobs
by arianvanp 493 days ago
User verification is optional.

If you only do user presence and non-discoverable, then WebAuthn is completely stateless and deterministic for a given (challenge,rpId,origin) triplet

1 comments

Isn't a 'passkey' with no discoverable credentials and no user verification just a regular U2F token?
Well, it could still provide credBlob (up to 32 bytes of data stored in the non-discoverable credential and handed back after verification). But mostly yes, it's losing the advantages of FIDO2.
Modulo supporting more algorithms -- yes