This is not a bug report but is a feature request to potentially allow instances to configure whether WebAuthn is a two-factor authentication method or not. Fluxer has made the decision, like Discord, that WebAuthn is a two-factor authentication method, and it is implemented as such. If it weren't required to login to your account, but you could just use an email and password, it is not two-factor authentication and it provides zero extra security. It only provides convenience. That may be a valid way someone wants their instance to work, however, and it is worth discussing as a feature request.
RexSystem1 voteoriginally by @Victor-root on GitHub OP
I think we're talking past each other, my issue is not about recovery or backup codes.
I did NOT enable two-factor authentication. I only added a passkey as an authentication method.
Registering a passkey should not implicitly opt me into mandatory password + WebAuthn MFA unless I explicitly choose to enable that.
A passkey can be used as a primary authentication method; registering one does not inherently mean the user wants it enforced as a second factor for password logins.
The lockout on my second PC is just the consequence of that unexpected behaviour.
Thread
Comment by Hampus
Comment by @Victor-root