CUNY Academic Commons

Hi Raffi,

The plugin we rely on for WebAuthn passkeys is tied to the core 2FA plugin. So at a glance, it looks like the WebAuthn plugin only supplements the core 2FA plugin by adding WebAuthn as a provider and does not do any core changes like bypassing the initial username/password authentication.

I also checked the WebAuthn wp.org support forum and their Github issues list and no one has raised this issue before. That being said, I'll ask the WebAuthn author on their Github issues page to see if this could be addressed in their WebAuthn plugin.

Thanks, Ray. I feel that this should be a new plugin that would replace the existing 2FA one. A quick search revealed the following:

- https://wordpress.org/plugins/ownid-passwordless-login/
- https://github.com/ivankristianto/wp-passkey
- https://wordpress.com/plugins/wp-webauthn

By "replace," I mean, I personally would replace the 2FA plug-in with just the passkey. But, if there are other users that want to keep using password/2FA combination, then they can continue to use the 2FA plug-in.

There was a recent issue added to the core two-factor plugin about passkeys: https://github.com/WordPress/two-factor/issues/779. We'll see if anything comes of it in the near future.