Support WebAuthn without PIN entry #36530
Labels
0. Needs triage
Pending check for reproducibility or if it fits our roadmap
enhancement
feature: authentication
Is your feature request related to a problem? Please describe.
There are currently two methods available by default to replace passwords for authentication:
U2F and WebAuthn
When U2F is used, the user is asked to touch the authenticator to verify the user presence.
When WebAuthn is used, the user has to both touch their authenticator and enter a PIN
According to the Fido2 specification the server can determine what methods the user has to provide to authenticate (e.g. only touch, only PIN or both)
Describe the solution you'd like
When registering a WebAuthn authenticator, the user should be able to select the method required to authenticate, e.g. allowing the use of an authenticator without entering a pin and instead only require user presence (touching the device)
Describe alternatives you've considered
Since entering a pin in addition to touching the authenticator at every login is more inconvenient then plain password authentication, the logical alternative would be to stick with passwords.
Additional context
The forced use of PIN verification during the WebAuthn process is an inconvenience that could drive users to stick with weak password authentication.
The text was updated successfully, but these errors were encountered: