Given platform authenticators can only be used in a single device, it should not be the only factors that users enroll. To learn how to enable platform authenticators, check the Webauthn with Device Biometrics documentation. For example, if you are wearing a mask, instead of using Face ID you can enter your passcode. When biometrics cannot be used, alternative authentication methods are usually provided. Biometric data is stored on the device and never sent to the server. Some examples are MacBook’s TouchBar, Windows Hello, iOS Touch/FaceId, and Android’s fingerprint/face recognition. Platform authenticators are attached to a device and only work on that device. To authenticate with a roaming authenticator, you need to connect it to the device (through USB, NFC, or Bluetooth), provide proof of presence (by touching it, for example), and optionally provide user verification, for example, by entering a PIN. Roaming authenticators are removable and cross-platform, like a Yubikey, and can be used on multiple devices. WebAuthn let users authenticate with two types of authenticators:

It's standard based and implemented across browsers and operating systems

It's the only web authentication method that is phishing resistant. A simple and familiar gesture lets users authenticate.

WebAuthn is the most secure and usable authentication method on the web. The API allows users to be authenticated using public key cryptography.

The Web Authentication API (also known as WebAuthn) is a specification written by the W3C and FIDO, with the participation of Google, Mozilla, Microsoft, Yubico, and others.

Fido key