Apple already kind-of supports this for iClout login. If you want to authenticate on a new device, you’ll get a prompt on one of your already authenticated devices to confirm the login. You still need the password, but it’s really not necessary... if there was also some additional “privilege” system (i.e. that the same user account would have less privileges if logged in through a less secure method) it would be even safer.

I'm surprised nobody has mentioned this but you can also use a hardware FIDO2 token for Webauthn. Like a Yubikey. This is ideal if you use many computers.

If you need to sign in on a borrowed computer you visit the site, it'll ask you to insert the yubikey (if not already), you enter the PIN code and touch it, that's it.

I believe a yubikey with fingerprint instead of PIN (or additionally? Information is scarce on it) is also coming.

A few options if you want to maintain MFA:

For my Okta account, they support push notification to their app on my phone as an alternative authentication measure.

Another approach is a bluetooth (or NFC) enabled device (like your phone) that actually caries the private key. When using a borrowed computer, the signed attestation data is shared with the borrowed system, but that can only be used once, since the private key is never transmitted.

So basically you can either have a side-channel to another MFA method, or a relay where you don't need to trust the intermediary beyond the current session.

Similar to how you would sign in on devices/browsers without WebAuthn support or don't have physical token (Yubikey/etc.) with you: use a fallback method provided by a website. This is usually TOTP or a scratch code. The website need to implement it though.

One thing to keep in mind is this is not supposed to be the only factor required to sign in. It should be used as a 2nd factor in the similar way to TOTP (but with much better usability).

With Okta (since gp mentioned it), you would sign in with a password, then click the "yes its me" button on your phone, or you could use TOTP, or even a yubikey.

Okta is more of a SAML/OpenID Connect thing with built-in multi factor authentication than a replacement for WebAuthn, though. Okta could embrace WebAuthn Platform Authenticator as one of their authenticating factor if user is unwilling to install an app, but a website isn't expected to use Okta as a second factor in their authentication flow.

OP is referring to how you already can sign in to Okta as a website, not as an authentication mechanism. You can create a sign in flow that goes like so:

username -> password -> [ WebAuthn | Okta Verify Push ]

This approach can be used on any website, just with a regular TOTP code in place of the proprietary Okta Verify Push.

Ah I didn't know you could do the Okta push without using their whole SSO suite. Thank you! I guess in this scenario Okta acts more like Authy proprietary OTP thing then.

Web Authentication does support being the only authentication mechanism, since it is in itself multi factor (in this case, physical possession of the phone and biometric confirmation)

It's mentioned in the video as well that website should always use this as faster sign in option with providing other options alongside.