Re: [webauthn] Authentication through only what you are (#1728)

> > _why_ do you want this?
> 
> a user's family member stole information from their phone and used it in a harmful way
> 
> if accessing the information had required scanning the user's fingerprint and didn't accept simply the PIN (which the family member had discovered somehow, probably through observation) then the information would have remained protected

If the person has the PIN it's game over - that's the root of trust to authenticate to that device, and you could do a lot more than just webauthn auth from there. Installing apps, go through emails for account resets and more.

So the issue here is the "PIN needs to be stronger", for example iphone allows a full text password. As well, device possession is a factor too. Keeping the device away from malicious entities is a factor here! 

IIRC some phones allow you to panic hit the lock button and it disables biometrics and makes it pin/pw only for example. 

-- 
GitHub Notification of comment by Firstyear
Please view or discuss this issue at https://github.com/w3c/webauthn/issues/1728#issuecomment-1118001379 using your GitHub account


-- 
Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config

Received on Wednesday, 4 May 2022 22:43:34 UTC