How CTAP2.0 made UserVerification even more confusing I have previously written about how Webauthn introduces a false sense of security with how it manages UserVerification (UV) by default. To summarise, when you request "preferred" which means "perform UV if possible", it can be bypassed since relying parties's (RP) do not check if UV was actually performed, and Webauthn makes no recommendations on how to store credentials in a manner that allows future checking to ensure UV is requested or ...
