I appreciate the usefulness for websites that use a passwordless login; where WebauthN is the only means of authentication. However, having implemented WebauthN on various websites as a second factor. On these websites the user is expected to enter a password as proof of something they know, and supply a USB device as proof of something they have.
With projects like Apple Passkeys or this one, aren't we reducing the usefulness of 2FA to simply proof of something you know but spread over two different inputs?
With projects like Apple Passkeys or this one, aren't we reducing the usefulness of 2FA to simply proof of something you know but spread over two different inputs?