This is fantastic. I look forward to finally having much easier authentication on the web. Imagine browsers syncing between devices a single encryption key that will authenticate you to all sites, which you can easily back up to a piece of paper.
EDIT: Unfortunately, it looks like the WebAuthn credential is only used as the second factor, so you can't use it to replace your password yet, let alone your username.
As discussed before, biometric data (used by WebAuthn) will never be used as the single factor for authentication, due to the fact that you can't revoke your face or fingerprint once that data is hacked or leaked. Also, single encryption key is risky (in the way as using the same password across all websites) as it could be hacked or leaked. Username/Password would still stay as the primary authentication method at least for near future IMO.
> biometric data (used by WebAuthn) will never be used as the single factor for authentication
WebAuthn doesn't use biometric data, the authenticator does. You can just as easily use a PIN or whatever you want.
> Also, single encryption key is risky (in the way as using the same password across all websites) as it could be hacked or leaked
The difference is that one compromised site can't leak your encryption key, someone would have to physically get it from your computer or steal your security key (and, probably, need to guess the PIN in three tries).
Of course, not every site will make use of this DRM-like anti-feature, but I can well imagine that a lot of sites/industries will adopt policies that treat non-biometric authenticators as insecure.
There is typically a significant UX impact on identifying the authenticator, some of which is effectively baked into the spec.
This is partially because it serves as a fingerprinting vector for authenticating users, and limits functionality (such as reusing the authenticator to access multiple accounts on the same site). This UX penalty will most likely dissuade people from limiting authenticators in cases where they aren't trying to meet AAL3 or rough equivalent.
Once you have an authenticator attestation, you can tie it to metadata on features, certification, and security incidents.
However, I actually don't suspect that real-world policy will rely on such dynamic metadata. Instead, organizations will limit the allowed authenticators to a static set of models, most likely models they issue to users.
So you'll see things such as banks allowing large money transfers only when you use the bank-issued authenticator, or having government contractors only able to authenticate into systems using the key fob they were issued.
I agree with you that we likely won't see this feature used much in the real world. I always tell Firefox to deny knowing which device model I have if asked. None of your damn business.
For personal accounts at least my experience was that a very large transfer (hundreds of thousands of dollars in a single transaction) required talking to two random employees. The first was a random call center worker who answered my call & the second was randomly chosen by the bank to run the whole process with me again to confirm. The web UI was clear that I would not be able to perform my transaction without talking to a human. Using two at random defuses the risk of internal collusion to defraud a customer. But I did use my good bank, maybe a mediocre bank would accept something a bit less stringent.
WebAuthn typically uses two factors when you are relying on the authenticator for primary authentication. One is possession of the authenticator, the other is biometric or a PIN.
If someone "steals" your fingerprint or your PIN, they still have to seize your key fob/phone/laptop.
The biometric data or PIN does not leave the authenticator (although the browser/OS may be responsible for capturing the PIN for a key fob with limited input capabilities).
The devices also have security and biometric testing/certification, so users who are concerned about the data being hacked or leaked from that device in your possession can look for a certain certification level.
Yes, it is unlikely that a pure biometric as the sole factor with remote verification would ever be secure enough to be a single, lifetime authentication method. It would require a zero knowledge challenge/response against some biological process, with no false positive/negatives (even in cases of family members/twins with similar features/DNA). There's also legal reasons I'd want to stop being identified as that person (witness protection program being the one that jumps to mind).
It's far more likely we would go from wearables to implanted hardware, which would still be a two factor authenticator.
EDIT: Unfortunately, it looks like the WebAuthn credential is only used as the second factor, so you can't use it to replace your password yet, let alone your username.