Just please be aware of the limitations and offer choices. The author writes this:
> Due to the abstraction of the WebAuthn API, you can’t be certain the user is authenticating via a biometric. You can take certain steps to encourage it, but you can’t force it.
> However, biometric authentication tied to popular operating systems are a quite prevalent form of WebAuthn-compatible hardware, so it is likely that if you encourage your users to set up WebAuthn logins, they’ll be using biometrics. You can also encourage this via the messaging on your website.
Look man, I wake up around 3 in the morning most days. I browse in the dark pretty frequently. I've never set up face ID, but even if I had, I'm not going to go turn a light on to try and log into your website. And yeah, in 2022, you might find this hard to believe, but I don't even a web cam on any of my desktops. It sure is nice to still be able to use the web.
I also walk very frequently, play Pokemon Go quite a bit, and lift weights daily usually with chalk. As a result, my fingertips are often pretty burned and dry, and it is often not possible to take a fingerprint reading at all. I do have touch ID turned on for all my laptops, but it works maybe 50% of the time.
Just offer options. Whether you think it's less secure or not, my keyboard is almost never going to stop working.
Had you tried Face ID, you would be aware that it requires no visible light. It works in the infrared spectrum and produces the required infrared light independently.
Face ID also works a lot more reliably that Touch ID.
I also walk very frequently, play Pokemon Go quite a bit, and lift weights daily usually with chalk. As a result, my fingertips are often pretty burned and dry, and it is often not possible to take a fingerprint
How vigorously are you playing Pokemon that it's rubbing off your fingerprints?
Or is "playing Pokémon" a euphemism for some other activity?
> Due to the abstraction of the WebAuthn API, you can’t be certain the user is authenticating via a biometric. You can take certain steps to encourage it, but you can’t force it.
> However, biometric authentication tied to popular operating systems are a quite prevalent form of WebAuthn-compatible hardware, so it is likely that if you encourage your users to set up WebAuthn logins, they’ll be using biometrics. You can also encourage this via the messaging on your website.
Look man, I wake up around 3 in the morning most days. I browse in the dark pretty frequently. I've never set up face ID, but even if I had, I'm not going to go turn a light on to try and log into your website. And yeah, in 2022, you might find this hard to believe, but I don't even a web cam on any of my desktops. It sure is nice to still be able to use the web.
I also walk very frequently, play Pokemon Go quite a bit, and lift weights daily usually with chalk. As a result, my fingertips are often pretty burned and dry, and it is often not possible to take a fingerprint reading at all. I do have touch ID turned on for all my laptops, but it works maybe 50% of the time.
Just offer options. Whether you think it's less secure or not, my keyboard is almost never going to stop working.