Hacker News Reader

This is really cool! And well-timed - I have a project coming up this would be perfect for. The only thing I wonder is, if a user didn’t have biometrics on their device, how would they authenticate? Would I have to maintain a backup system for these users?

View on HN

Biometrics are not needed, however device support is not 100%.

If the user is not running a model OS they could still be supported by using what is known as a security key (yubico) etc.

The Passwordless API can also help with out of band authentication (using a iOS device to sign in on unsupported old laptop)

In general they just need _something_. If Windows Hello has even a pin number, Chrome and FF webauthn prompts will use Windows Hello as a TPM provider (assuming the website is using actual Webauthn and not the older U2F-compatible standard, which some sites still use for compatibility, eg google). If they don't have anything, then they will definitely need at least a usb hardware key.

Reply on news.ycombinator.com