Document behavior of hanko-auth depending on device capabilities

[FlxMgdnz]

We need to document our implementation / decision algorithm of <hanko-auth>:

• Passkey creation and login is only offered if supported on the current device
• The fallback is always the email passcode (or a password if enabled in the backend config)
• Android has no full passkey support yet, so the username is always required, but then a WebAuthn auth is possible
• On latest iOS, macOS and Windows, the "Sign in with a passkey" button is shown, meaning you can also login without having to enter the username
• There may be more that I am missing here

[irby]

For me, running on macOS Monterey, the "Sign in with a Passkey" option showed up on Safari and Chrome but not on Firefox. I found out it was because of PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable() not being fully supported on Firefox without a USB U2F token. I think having a list of browser compatibility would be helpful, although this may also vary by OS and device compatibility.

[FlxMgdnz]

For me, running on macOS Monterey, the "Sign in with a Passkey" option showed up on Safari and Chrome but not on Firefox. I found out it was because of PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable() not being fully supported on Firefox without a USB U2F token. I think having a list of browser compatibility would be helpful, although this may also vary by OS and device compatibility.

We recently changed the behavior (#331) and are no longer limiting passkey creation to platform authenticators. Now if a browser has WebAuthn, Hanko can create a passkey.

[FlxMgdnz]

We're maintaining a list of compatible OS/browser combinations here: https://www.passkeys.io/compatible-devices