ReferenceMFA methods
WebAuthn
Cryptographic challenge-response with hardware (YubiKey, Touch ID) or passkeys.
Web Authentication API
Spec: W3C WebAuthn
Provides AAL: AAL2 (AAL3 with attestation)
Summary
Cryptographic challenge-response with hardware (YubiKey, Touch ID) or passkeys.
Strengths
- Phishing-resistant (origin binding)
- User-friendly (biometric / touch)
- Strong cryptography
Weaknesses
- Requires browser/OS support (now ubiquitous)
- Per-domain, passkeys don't migrate when you rename your domain
Enrollment
Browser prompts user to use Touch ID / hardware key / save a passkey.
Recovery
Multiple authenticators enrolled is the right pattern. Otherwise password reset.