This really is just bringing WebAuthn to Safari. I've been using it via chrome w/ TouchID for our corporate okta SSO and it has been working great.
WebAuthn is really just a way to make public-key/private-key crypto scale. The user never really knows about or interacts with the keys.
The website doesn't store a password, they store a public key.
The user doesn't know about the private key (paired to the public key) they just know how to unlock the private key via the yubikey or biometric device.
The site sends some data to the user to sign, and they do so with the private key, then the site verifies the data was signed by the private key, boom: authenticated.
WebAuthn is really just a way to make public-key/private-key crypto scale. The user never really knows about or interacts with the keys.
The website doesn't store a password, they store a public key.
The user doesn't know about the private key (paired to the public key) they just know how to unlock the private key via the yubikey or biometric device.
The site sends some data to the user to sign, and they do so with the private key, then the site verifies the data was signed by the private key, boom: authenticated.