I think you're confusing the cloud-assisted Bluetooth (caBLE) transport with actual built-in device keystores. Google is testing this on their properties while it's being standardized in CTAP and WebAuthn, see https://github.com/w3c/webauthn/issues/1381
In What I Wish I Knew About U2F and Other Hardware MFA Protocolsw3c
webauthn
Bikeshed2018–2026
w3c / webauthn
webauthn
Web Authentication: An API for accessing Public Key Credentials
25Distinct people
40Mentions
1Explicit recommenders
1.5KGitHub stars
What to know before exploring
What it is
Web Authentication: An API for accessing Public Key Credentials
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
The working group is definitely quite corporate-driven – just look at who's most active in it! – and has made some bad decisions in the past (my favorite example being [1],…
lxgr used a recommendation phrase. One indexed comment matches. This is a phrase match, not a verdict.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
- fido-alliance/how-to-fido · linked in 2 of the same discussions
- yackermann/awesome-webauthn · linked in 2 of the same discussions
Mentioned in the same Hacker News threads. That is not proof they are substitutes.
This week on Hacker News
Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 2:04:58 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year40 dated mentions
Observed mentions: 2018-03-26 04:28:28 UTC to 2026-07-16 10:45:11 UTC.
* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 3 | 0 | 3 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 2 | 1 | 1 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 3 | 0 | 3 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 12 | 0 | 12 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 3 | 0 | 3 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 10 | 0 | 10 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 3 | 1 | 2 |
| 2026 (partial) | 2026-01-01 00:00:00 UTC | 2027-01-01 00:00:00 UTC | 2 | 0 | 2 |
From the project README
An excerpt from the repository, fetched Nov 13, 2026.
Read the project’s introduction
Web Authentication Specification
This is the repository for the W3C WebAuthn Working Group, producing the draft "Web Authentication" specification.
The editor's copy is available at https://w3c.github.io/webauthn/, or in the gh-pages branch of this repository.
The current offically published working-draft snapshot is here: https://www.w3.org/TR/webauthn/.
The build history is available from the repo Actions tab
W3C WebAuthn Blog
Web platform tests repository
Contributing
To materially contribute to this specification, you must meet the requirements outlined in CONTRIBUTING.md. Also, before submitting feedback, please familiarize yourself with our current issues list and review the mailing list discussion.
Building the Draft
The following are required before continuing:
mise
Run the following commands to set up your local development environment to work on these specifications:
mise setup
Formatted HTML for the draft can then be built with the following command:
mise build
You can use the following command to automatically regenerate the rendered document as you make changes locally, and view the rendered document at http://localhost:8000:
mise serve
Continuous Integration & Branches
https://w3c.github.io/webauthn/ is autopublished from the gh-pages branch on every push to the main branch, using https://github.com/w3c/webauthn/blob/main/.github/workflows/build-validate-publish.yml to configure the autopublishing behavior.
Read the full README on GitHubWhat Hacker News says
3 sourcesTPMs are also sold separately that which can be plugged in to motherboards, e.g. Gigabyte (https://www.gigabyte.com/us/Motherboard/GC-TPM20-SPI-20) and Asus (https://www.asus.com/Motherboards-Components/Motherboards/Ac...) to name a couple.
The article has a couple of other weird faults, too:
1. I'm not sure why the author is complaining about FIDO2 having backwards compatibility with U2F/CTAP1. The article even incorrectly claims FIDO2 is "a 3rd incompatible standard" only to counter-argue the point a few paragraphs below explaining CTAP? People not having to throw away their perfectly fine old devices is a good thing in my book.
2. "All FIDO standards are web-centric and aren’t designed with any other client software in mind" the first part is true, the second part not so much. For example FIDO2 supports silent authentication (no user i
Read the rest
nteraction) while WebAuthn explicitly does not[0]. It also supports the hmac-secret extension[1] which is used for offline authentication with Azure Active Directory[2] and IIRC no WebAuthn browser implementation exposes this extension to web apps.
[0]: see e.g. discussion on https://github.com/w3c/webauthn/issues/199
[1]: https://fidoalliance.org/specs/fido-v2.1-rd-20210309/#sctn-h...
[2]: https://docs.microsoft.com/en-us/azure/active-directory/auth...
CaBLE may be of interest to you. It's better than 2fa codes, since it's effectively FIDO/web AuthN (unphishable).
https://github.com/w3c/webauthn/pull/909
In Show HN: Authenticator by 2Stable