Request for Passkey Unlock Method Information to Enhance User Experience

Dear FIDO Dev Group,

I am writing to propose an enhancement to the passkey authentication process, with the goal of improving user experience without compromising security.

During integration of passkeys, I noticed that both Android and iOS allow users to unlock passkeys using their device PIN. It's well known that some users may choose weak PINs, which could potentially create a security vulnerability if the device is stolen. However, biometric authentication provides a stronger level of assurance.

To address this, I suggest that operating systems provide developers with information about the method used to unlock the passkey (pattern/PIN/biometrics). This would enable developers to tailor authentication requirements accordingly. For instance, if a PIN was used, an additional authentication factor could be requested, whereas biometrics might not necessitate this. Currently, this information is not made available to developers. I believe that making this a standard would significantly improve the user experience while maintaining robust security.

Thank you for considering this proposal.

And there is a huge chance that they won't.
I had once discovered a vulnerability where if you could manipulate your victim to install a malware, you could take control over their passkeys in real-time.

I discussed it with the security secretariat of FIDO, he directed me to WebAuthn WG. I raised an issue and there they claimed that it is out of their threat model. Yeah the vulnerability still exists and nobody took any action. 🫠

Kinda true. The fingerprints templates are stored in a Govt DB. And the card number just maps to the primary key.