Web Authentication Working Group - Activity in 2016
No matches.
TR publications
-
1 document published.
Participants
-
1 participant joined.
-
Adam Powers (Amazon) joined.
-
GitHub
w3c/webauthn
-
9 issues opened.
-
Define what happens when the Document loses focus w3c/webauthn#316, by @jcjones.
-
Should WebAuthnAttestation attributes have constructors? w3c/webauthn#313, by @kpaulh.
-
Consider scoping Account and ClientData w3c/webauthn#312, by @kpaulh.
-
Consider removing the "n" in "WebAuthnAttestation", etc w3c/webauthn#311, by @kpaulh.
-
Can we get rid of the "Web" prefix for WebAuthnAttestation, etc? w3c/webauthn#310, by @kpaulh.
-
authenticator attachment terminology w3c/webauthn#308, by @equalsJeffH.
-
"NotAllowedError" is in WebIDL editors draft but not in WebIDL Level 1 w3c/webauthn#305, by @equalsJeffH.
-
Should use "RS1" instead of "RSA1_5" w3c/webauthn#304, by @rlin1.
-
Propose procedure for adding to attestation/extension registry w3c/webauthn#303, by @gmandyam.
-
-
10 issues closed.
-
authenticator attachment terminology w3c/webauthn#308.
-
Link to WebCrypto API is stale w3c/webauthn#261.
-
polish {#sample-authentication} wrt authn assertion validation w3c/webauthn#234.
-
When talking about "normalizing an algorithm", please just link to it w3c/webauthn#262.
-
Description of ScopedCredentialInfo.credential seems odd w3c/webauthn#284.
-
Add notion of internal/external authenticator attachment to options w3c/webauthn#213.
-
Enforce strict same-origin policy on rpId w3c/webauthn#241.
-
-
1 issue reopened.
-
23 issues received 55 new comments.
-
Consider removing the "n" in "WebAuthnAttestation", etc w3c/webauthn#311 (7 comments by @arshadnoor, @equalsJeffH, @nadalin, @zcorpan)
-
callerOrigin isn't actually the origin of the caller; it's the origin of the callee w3c/webauthn#271 (6 comments by @domenic, @equalsJeffH)
-
The W3C HTML spec is broken, and probably shouldn't be referenced w3c/webauthn#257 (6 comments by @domenic, @equalsJeffH, @wseltzer)
-
What ensures any semblance of interop for WebAuthnExtensions? w3c/webauthn#290 (4 comments by @arshadnoor, @equalsJeffH)
-
Please coordinate with the HTML spec to extract the relevant bits of the document.domain setter so you can call them w3c/webauthn#256 (3 comments by @bzbarsky, @equalsJeffH)
-
Can we get rid of the "Web" prefix for WebAuthnAttestation, etc? w3c/webauthn#310 (3 comments by @equalsJeffH, @zcorpan)
-
do not entirely lose distinctions between External and Embedded Authenticators w3c/webauthn#181 (2 comments by @equalsJeffH)
-
Why are some of the attestation interfaces [SecureContext] while others are not? w3c/webauthn#286 (1 comment by @equalsJeffH)
-
"If extensions was specified" should instead use the "present" terminology w3c/webauthn#269 (1 comment by @equalsJeffH)
-
Should WebAuthnAttestation attributes have constructors? w3c/webauthn#313 (1 comment by @equalsJeffH)
-
Need to clearly define what it means to SHA-256 hash the "host" output of the document.domain setter w3c/webauthn#258 (1 comment by @jcjones)
-
Add notion of internal/external authenticator attachment to options w3c/webauthn#213 (1 comment by @leshi)
-
Update attestation format identifiers in registry to match spec w3c/webauthn#300 (1 comment by @equalsJeffH)
-
Throw "NotFoundError" when internal authenticator is not available or not found w3c/webauthn#302 (1 comment by @equalsJeffH)
-
-
6 pull requests opened.
-
Renaming WebAuthn -> Authentication w3c/webauthn#317, by @equalsJeffH.
-
Reference the Encoding spec's UTF-8 Encode definition w3c/webauthn#315, by @jcjones.
-
Inline and clarify the "Relaxing the Same-Origin Restriction" algorithm w3c/webauthn#314, by @jcjones.
-
authenticator attachment terminology refinement w3c/webauthn#309, by @equalsJeffH.
-
Specify encoding of rpid to bytes before hashing. w3c/webauthn#307, by @kpaulh.
-
Jeffh editorial cleanups4 w3c/webauthn#306, by @equalsJeffH.
-
-
5 pull requests merged.
-
authenticator attachment terminology refinement w3c/webauthn#309.
-
Jeffh editorial cleanups4 w3c/webauthn#306.
-
Specify encoding of rpid to bytes before hashing. w3c/webauthn#307.
-
Adds authenticator attachement to credential options w3c/webauthn#243.
-
section verification of WebAuthnAssertion added. See #102 w3c/webauthn#246.
-
-
7 pull requests received 88 new comments.
-
Inline and clarify the "Relaxing the Same-Origin Restriction" algorithm w3c/webauthn#314 (41 comments by @bzbarsky, @domenic, @equalsJeffH, @jcjones)
-
Adds authenticator attachement to credential options w3c/webauthn#243 (25 comments by @equalsJeffH, @jcjones, @leshi, @vijaybh)
-
section verification of WebAuthnAssertion added. See #102 w3c/webauthn#246 (5 comments by @equalsJeffH, @rlin1)
-
authenticator attachment terminology refinement w3c/webauthn#309 (4 comments by @equalsJeffH, @jcjones, @leshi)
-
Specify encoding of rpid to bytes before hashing. w3c/webauthn#307 (4 comments by @annevk, @equalsJeffH, @jcjones, @kpaulh)
-
GitHub
w3c/webauthn
-
59 issues opened.
-
Throw "NotFoundError" when internal authenticator is not available or not found w3c/webauthn#302, by @AngeloKai.
-
Move {#sample-scenarios} (currently Section 10) to the top of the doc w3c/webauthn#301, by @vijaybh.
-
Update attestation format identifiers in registry to match spec w3c/webauthn#300, by @vijaybh.
-
Timeouts should be in ms not seconds w3c/webauthn#299, by @vijaybh.
-
Authenticator selection extension needs to define snapshotting behavior w3c/webauthn#294, by @bzbarsky.
-
What does "which has no other operations in progress" mean in practice? w3c/webauthn#292, by @bzbarsky.
-
What ensures any semblance of interop for WebAuthnExtensions? w3c/webauthn#290, by @bzbarsky.
-
Can the "attestation" of a WebAuthnAttestation be a non-object? w3c/webauthn#289, by @bzbarsky.
-
Is there a reason "WebAuthnAssertion" is not "WebAuthenticationAssertion"? w3c/webauthn#288, by @bzbarsky.
-
Which of the attestation format interfaces are expected to be exposed in UAs? w3c/webauthn#287, by @bzbarsky.
-
Why are some of the attestation interfaces [SecureContext] while others are not? w3c/webauthn#286, by @bzbarsky.
-
Various attributes of ScopedCredentialInfo should probably be [SameObject] w3c/webauthn#285, by @bzbarsky.
-
Description of ScopedCredentialInfo.credential seems odd w3c/webauthn#284, by @bzbarsky.
-
authenticatorCancel seems like it can cancel too much w3c/webauthn#283, by @bzbarsky.
-
Creation of WebAuthnAssertion in getAssertion should probably be more explicit w3c/webauthn#282, by @bzbarsky.
-
What does it mean to "get assertions" in getAssertion step 7? w3c/webauthn#281, by @bzbarsky.
-
"might be present on this authenticator" could use a clearer definition w3c/webauthn#280, by @bzbarsky.
-
getAssertion needs to not go async before making a copy of the assertionChallenge w3c/webauthn#279, by @bzbarsky.
-
Creation of ScopedCredentialInfo in makeCredential should probably be more explicit w3c/webauthn#277, by @bzbarsky.
-
ScopedCredentialDescriptor can contain BufferSources that are processed async w3c/webauthn#276, by @bzbarsky.
-
"JSON serialization" in makeCredential probably needs to be defined more clearly w3c/webauthn#274, by @bzbarsky.
-
I don't understand how to create a ClientData in makeCredential w3c/webauthn#273, by @bzbarsky.
-
callerOrigin isn't actually the origin of the caller; it's the origin of the callee w3c/webauthn#271, by @bzbarsky.
-
Processing model for extensions is very underdefined w3c/webauthn#270, by @bzbarsky.
-
"If extensions was specified" should instead use the "present" terminology w3c/webauthn#269, by @bzbarsky.
-
The concept "empty" is not really defined for IDL sequences w3c/webauthn#267, by @bzbarsky.
-
What does "If normalizedAlgorithm is empty" mean? w3c/webauthn#266, by @bzbarsky.
-
What does normalizedParameters actually contain in makeCredential? w3c/webauthn#265, by @bzbarsky.
-
Exception handling in cryptoParameters processing needs to be clarified w3c/webauthn#264, by @bzbarsky.
-
WebCryptoAPI's "normalizing an algorithm" cannot be done as part of async steps w3c/webauthn#263, by @bzbarsky.
-
When talking about "normalizing an algorithm", please just link to it w3c/webauthn#262, by @bzbarsky.
-
Link to WebCrypto API is stale w3c/webauthn#261, by @bzbarsky.
-
Is _rpId_ supposed to look like an origin serialization, or like a hostname? w3c/webauthn#259, by @bzbarsky.
-
The W3C HTML spec is broken, and probably shouldn't be referenced w3c/webauthn#257, by @bzbarsky.
-
Setting _rpId_ to _callerOrigin_ doesn't make sense w3c/webauthn#255, by @bzbarsky.
-
Grammar of makeCredential/getAssertion step 1 is a bit odd w3c/webauthn#252, by @bzbarsky.
-
The steps for makeCredential do a bunch of implicit getting of members w3c/webauthn#251, by @bzbarsky.
-
"authentication" attribute on Navigator should be [SecureContext] w3c/webauthn#250, by @bzbarsky.
-
Should the "authentication" attribute on Navigator be [SameObject]? w3c/webauthn#249, by @bzbarsky.
-
"an Relying Party" should be "a Relying Party" w3c/webauthn#247, by @bzbarsky.
-
remove "required" on ScopedCredentialDescriptor.id w3c/webauthn#245, by @AngeloKai.
-
Simplifying attestation, take two w3c/webauthn#244, by @vijaybh.
-
certifyinfo needs to be specified w3c/webauthn#242, by @gmandyam.
-
Enforce strict same-origin policy on rpId w3c/webauthn#241, by @AngeloKai.
-
-
8 issues closed.
-
clarify conveyance of attested public key w3c/webauthn#94.
-
Scoped credentials represent a relationship between user and RP w3c/webauthn#87.
-
also cite the other extant TLS channel binding mechanisms? w3c/webauthn#168.
-
Grammar of makeCredential/getAssertion step 1 is a bit odd w3c/webauthn#252.
-
"an Relying Party" should be "a Relying Party" w3c/webauthn#247.
-
Moving callers from U2F to WebAuthn w3c/webauthn#216.
-
"relaxing the same-origin restriction" w3c/webauthn#218.
-
Clarify how AAGUID is generated to avoid collisions w3c/webauthn#232.
-
-
48 issues received 90 new comments.
-
Add notion of internal/external authenticator attachment to options w3c/webauthn#213 (6 comments by @apowers313, @equalsJeffH, @leshi, @vijaybh)
-
Clarify uses of ClientData w3c/webauthn#209 (5 comments by @AngeloKai, @equalsJeffH, @gmandyam, @vijaybh)
-
Can the "attestation" of a WebAuthnAttestation be a non-object? w3c/webauthn#289 (5 comments by @AngeloKai, @bzbarsky, @equalsJeffH, @vijaybh)
-
The W3C HTML spec is broken, and probably shouldn't be referenced w3c/webauthn#257 (5 comments by @AngeloKai, @bzbarsky, @equalsJeffH)
-
"JSON serialization" in makeCredential probably needs to be defined more clearly w3c/webauthn#274 (5 comments by @bzbarsky, @equalsJeffH, @vijaybh)
-
callerOrigin isn't actually the origin of the caller; it's the origin of the callee w3c/webauthn#271 (3 comments by @AngeloKai, @bzbarsky)
-
Need to clearly define what it means to SHA-256 hash the "host" output of the document.domain setter w3c/webauthn#258 (3 comments by @annevk, @bzbarsky, @equalsJeffH)
-
ScopedCredentialDescriptor can contain BufferSources that are processed async w3c/webauthn#276 (3 comments by @bzbarsky, @equalsJeffH)
-
Please coordinate with the HTML spec to extract the relevant bits of the document.domain setter so you can call them w3c/webauthn#256 (3 comments by @bzbarsky, @equalsJeffH)
-
I don't understand how to create a ClientData in makeCredential w3c/webauthn#273 (2 comments by @bzbarsky, @jcjones)
-
Why are some of the attestation interfaces [SecureContext] while others are not? w3c/webauthn#286 (2 comments by @equalsJeffH, @vijaybh)
-
Various attributes of ScopedCredentialInfo should probably be [SameObject] w3c/webauthn#285 (2 comments by @bzbarsky, @equalsJeffH)
-
Exception handling in cryptoParameters processing needs to be clarified w3c/webauthn#264 (2 comments by @bzbarsky, @equalsJeffH)
-
When talking about "normalizing an algorithm", please just link to it w3c/webauthn#262 (2 comments by @bzbarsky, @equalsJeffH)
-
"authentication" attribute on Navigator should be [SecureContext] w3c/webauthn#250 (2 comments by @bzbarsky, @equalsJeffH)
-
Clarify how a user can authenticate from multiple devices w3c/webauthn#151 (1 comment by @equalsJeffH)
-
Scoped credentials represent a relationship between user and RP w3c/webauthn#87 (1 comment by @equalsJeffH)
-
also cite the other extant TLS channel binding mechanisms? w3c/webauthn#168 (1 comment by @equalsJeffH)
-
Refine meaning of PublicKeyCredentialType to be "signature & assertion format (and version thereof)" w3c/webauthn#296 (1 comment by @rlin1)
-
should authenticator layer send hashed or unhashed rpId to authenticators? w3c/webauthn#188 (1 comment by @AngeloKai)
-
Move `allowList` from optional to default on `getAssertion` w3c/webauthn#221 (1 comment by @AngeloKai)
-
TAG review feedback: Align Credential interface with Credential Management? w3c/webauthn#60 (1 comment by @jeisinger)
-
Why is the only value of ScopedCredentialType "ScopedCred" as opposed to "ScopedCredential"? w3c/webauthn#291 (1 comment by @equalsJeffH)
-
Which of the attestation format interfaces are expected to be exposed in UAs? w3c/webauthn#287 (1 comment by @vijaybh)
-
Why are various predefined extensions defined as extensions, and not just parts of the spec? w3c/webauthn#295 (1 comment by @equalsJeffH)
-
Should the "authentication" attribute on Navigator be [SameObject]? w3c/webauthn#249 (1 comment by @equalsJeffH)
-
It would be nice if the definition of "Scoped Credential" said something about what `identifier` and `type` are w3c/webauthn#248 (1 comment by @equalsJeffH)
-
What ensures any semblance of interop for WebAuthnExtensions? w3c/webauthn#290 (1 comment by @bzbarsky)
-
What does "which has no other operations in progress" mean in practice? w3c/webauthn#292 (1 comment by @bzbarsky)
-
Is there a reason "WebAuthnAssertion" is not "WebAuthenticationAssertion"? w3c/webauthn#288 (1 comment by @bzbarsky)
-
excludeList/allowList can be defaulted to a zero-length sequence in IDL instead of prose w3c/webauthn#268 (1 comment by @bzbarsky)
-
"If extensions was specified" should instead use the "present" terminology w3c/webauthn#269 (1 comment by @bzbarsky)
-
There is no "current settings object" in algorithm steps that are executing in parallel w3c/webauthn#254 (1 comment by @bzbarsky)
-
Does "Then asynchronously continue executing the following steps" mean "in parallel"? w3c/webauthn#253 (1 comment by @bzbarsky)
-
Grammar of makeCredential/getAssertion step 1 is a bit odd w3c/webauthn#252 (1 comment by @bzbarsky)
-
-
3 pull requests opened.
-
Jeffh editorial cleanups 3 w3c/webauthn#298, by @equalsJeffH.
-
section verification of WebAuthnAssertion added. See #102 w3c/webauthn#246, by @rlin1.
-
Adds authenticator attachement to credential options w3c/webauthn#243, by @leshi.
-
-
3 pull requests merged.
-
Jeffh editorial cleanups 3 w3c/webauthn#298.
-
Adding fido appid extension w3c/webauthn#229.
-
5 pull requests received 42 new comments.
-
Adds authenticator attachement to credential options w3c/webauthn#243 (18 comments by @equalsJeffH, @leshi, @vijaybh)
-
remove ScopedCredentialInfo.publicKey; use "credential public key" term consistently w3c/webauthn#235 (8 comments by @bifurcation, @equalsJeffH, @vijaybh)
-
section verification of WebAuthnAssertion added. See #102 w3c/webauthn#246 (6 comments by @equalsJeffH, @rlin1, @vijaybh)
-
GitHub
w3c/webauthn
-
9 issues opened.
-
RSA credential public key encoding in "attestation data" incorrectly specified? w3c/webauthn#240, by @equalsJeffH.
-
explicitly denote RSA signature scheme w3c/webauthn#239, by @equalsJeffH.
-
High Level Architecture Diagram w3c/webauthn#237, by @CallumBrankin.
-
polish {#sample-authentication} wrt authn assertion validation w3c/webauthn#234, by @equalsJeffH.
-
Clarify how AAGUID is generated to avoid collisions w3c/webauthn#232, by @leshi.
-
authenticatorGetAssertion showing selection UI for external authenticators w3c/webauthn#231, by @mpolanco.
-
"Authenticator argument" vs. "authenticator data value" in Extensions section w3c/webauthn#230, by @vijaybh.
-
-
7 issues closed.
-
WebAPI: USB fob use case w3c/webauthn#11.
-
update mention & refs of FIDO protocols in Basic Attestation section w3c/webauthn#120.
-
Define UTF-8 string w3c/webauthn#179.
-
CredentialDescription -> CredentialDescriptor w3c/webauthn#195.
-
Cut-and-paste error w3c/webauthn#205.
-
High Level Architecture Diagram w3c/webauthn#237.
-
-
16 issues received 25 new comments.
-
WebAPI: FIDO Authenticator model - clarifications needed w3c/webauthn#12 (3 comments by @equalsJeffH, @vijaybh)
-
Authenticator selection extension - should makeCredential fail if no specified authenticator can be found? w3c/webauthn#227 (2 comments by @sangraecho, @vijaybh)
-
polish {#sample-authentication} wrt authn assertion validation w3c/webauthn#234 (2 comments by @equalsJeffH, @vijaybh)
-
Clarify how AAGUID is generated to avoid collisions w3c/webauthn#232 (2 comments by @equalsJeffH, @vijaybh)
-
RSA credential public key encoding in "attestation data" incorrectly specified? w3c/webauthn#240 (1 comment by @equalsJeffH)
-
detail-level issues in signature format, attestation format(s), attestation statement w3c/webauthn#233 (1 comment by @equalsJeffH)
-
Silent/touchless Authn? clarification of bit 0 in AuthenticatorData w3c/webauthn#22 (1 comment by @nadalin)
-
Example Use Cases only has phone-as-authenticator example -- we should add another w3c/webauthn#223 (1 comment by @equalsJeffH)
-
update mention & refs of FIDO protocols in Basic Attestation section w3c/webauthn#120 (1 comment by @equalsJeffH)
-
3 pull requests opened.
-
Jeffh editorial cleanups 2 w3c/webauthn#236, by @equalsJeffH.
-
Adding fido appid extension w3c/webauthn#229, by @leshi.
-
-
1 pull request merged.
-
Jeffh editorial cleanups 2 w3c/webauthn#236.
-
-
3 pull requests received 29 new comments.
-
Adding fido appid extension w3c/webauthn#229 (17 comments by @equalsJeffH, @jcjones, @leshi, @plinss, @rlin1, @tobie, @vijaybh)
-
remove ScopedCredentialInfo.publicKey; use "credential public key" term consistently w3c/webauthn#235 (5 comments by @equalsJeffH, @vijaybh)
-
TR publications
-
2 documents published.
-
Web Authentication: An API for accessing Scoped Credentials published twice as a Working Draft. History of Web Authentication: An API for accessing Scoped Credentials
-
GitHub
w3c/webauthn
-
24 issues opened.
-
TPM attestation format spec is incomplete w3c/webauthn#226, by @vijaybh.
-
Example Use Cases only has phone-as-authenticator example -- we should add another w3c/webauthn#223, by @leshi.
-
Move `allowList` from optional to default on `getAssertion` w3c/webauthn#221, by @bifurcation.
-
Add explanation of why the account argument is useful w3c/webauthn#219, by @leshi.
-
"relaxing the same-origin restriction" w3c/webauthn#218, by @annevk.
-
Drop UAF references in favor of better explanation w3c/webauthn#217, by @bifurcation.
-
Moving callers from U2F to WebAuthn w3c/webauthn#216, by @leshi.
-
Figure out how transport hints get from Authenticator to RP w3c/webauthn#215, by @leshi.
-
Define a U2F attestation format w3c/webauthn#214, by @leshi.
-
Add notion of internal/external authenticator attachment to options w3c/webauthn#213, by @leshi.
-
Expand algorithm to include attestation format w3c/webauthn#212, by @leshi.
-
Internationalization self review w3c/webauthn#210, by @vijaybh.
-
Clarify uses of ClientData w3c/webauthn#209, by @gmandyam.
-
Location Extension and privacy w3c/webauthn#208, by @yaronf.
-
Clarify wording on authenticator selection w3c/webauthn#207, by @yaronf.
-
Credential ID not signed w3c/webauthn#206, by @yaronf.
-
Cut-and-paste error w3c/webauthn#205, by @yaronf.
-
Privacy across Account IDs w3c/webauthn#204, by @yaronf.
-
section {#uvm-extension} cites FIDO registry w/o proper references w3c/webauthn#200, by @equalsJeffH.
-
WebAuthn available to Workers? aka "silent authentication" w3c/webauthn#199, by @equalsJeffH.
-
CredentialDescription -> CredentialDescriptor w3c/webauthn#195, by @equalsJeffH.
-
40 issues closed.
-
Figure out how transport hints get from Authenticator to RP w3c/webauthn#215.
-
lowercase form of this RP ID w3c/webauthn#178.
-
Should rpId be removed from clientData? w3c/webauthn#189.
-
Where should transport hints go? w3c/webauthn#6.
-
Expand algorithm to include attestation format w3c/webauthn#212.
-
facet should be defined in terms of the HTML Standard w3c/webauthn#174.
-
Secure context should be MUST not SHOULD w3c/webauthn#146.
-
Usability Issue: Server Challenge timeout w3c/webauthn#25.
-
Underspecified error conditions w3c/webauthn#53.
-
Location Extension and privacy w3c/webauthn#208.
-
Create an Explainer document w3c/webauthn#91.
-
Terminology consistency w3c/webauthn#66.
-
Relying Party or Server w3c/webauthn#65.
-
What if callerOrigin is an opaque origin w3c/webauthn#172.
-
callerOrigin w3c/webauthn#171.
-
Clarify the definition of "origin" w3c/webauthn#160.
-
"web origin of the script" w3c/webauthn#173.
-
section {#uvm-extension} cites FIDO registry w/o proper references w3c/webauthn#200.
-
ScopedCredentialInfo attestation w3c/webauthn#86.
-
Add Android "N" attestation type. w3c/webauthn#103.
-
clarify that at least one model of attestation must be employed w3c/webauthn#115.
-
Change Android SafetyNet attestation type identifier ? w3c/webauthn#128.
-
"version 4 GUID" should be "version 4 UUID" w3c/webauthn#148.
-
AAGUID must be a "version 4 UUID" ? w3c/webauthn#149.
-
do we need "Byte length l of AAGUID" ? w3c/webauthn#150.
-
define requirements for attestation format specifications w3c/webauthn#126.
-
Clarify which sign. algm.'s RP's must support (Sec. 4.3.2.1.2) w3c/webauthn#104.
-
Attestation format identifiers lack formal definition and matching rules w3c/webauthn#127.
-
Spec draft points to wrong GitHub issues page w3c/webauthn#183.
-
define "attestation" in terminology section w3c/webauthn#141.
-
4.1 heading should appear before the IDL w3c/webauthn#177.
-
clarify content of algorithm member of ScopedCredentialParameters w3c/webauthn#113.
-
The FIDO Metadata Service needs a non-FIDO analogous mechanism w3c/webauthn#47.
-
Section 4.3: add reference to privacy w3c/webauthn#100.
-
consider moving IDL from monolithic block to individual spec sections w3c/webauthn#112.
-
-
2 issues reopened.
-
lowercase form of this RP ID w3c/webauthn#178, by @equalsJeffH.
-
"web origin of the script" w3c/webauthn#173, by @equalsJeffH.
-
-
38 issues received 99 new comments.
-
What if callerOrigin is an opaque origin w3c/webauthn#172 (13 comments by @annevk, @balfanz, @equalsJeffH, @rlin1, @vijaybh)
-
Add explanation of why the account argument is useful w3c/webauthn#219 (7 comments by @bifurcation, @equalsJeffH, @jcjones, @leshi, @vijaybh)
-
Move `allowList` from optional to default on `getAssertion` w3c/webauthn#221 (5 comments by @equalsJeffH, @jcjones, @vijaybh)
-
Spec draft points to wrong GitHub issues page w3c/webauthn#183 (5 comments by @equalsJeffH, @vijaybh)
-
Add notion of internal/external authenticator attachment to options w3c/webauthn#213 (4 comments by @equalsJeffH, @jcjones, @rlin1, @yaronf)
-
Expand algorithm to include attestation format w3c/webauthn#212 (4 comments by @jcjones, @leshi, @rlin1)
-
facet should be defined in terms of the HTML Standard w3c/webauthn#174 (3 comments by @annevk, @equalsJeffH)
-
should authenticator layer send hashed or unhashed rpId to authenticators? w3c/webauthn#188 (3 comments by @rlin1, @vijaybh)
-
Attestation format identifiers lack formal definition and matching rules w3c/webauthn#127 (3 comments by @equalsJeffH)
-
Silent/touchless Authn? clarification of bit 0 in AuthenticatorData w3c/webauthn#22 (2 comments by @equalsJeffH, @nadalin)
-
WebAuthn available to Workers? aka "silent authentication" w3c/webauthn#199 (2 comments by @equalsJeffH, @vijaybh)
-
Section 4: Mention requirement for user to give consent for key to be used w3c/webauthn#99 (2 comments by @equalsJeffH, @rlin1)
-
add references to IANA WebAuthn Attestation Formats and Extension Identifiers Registries w3c/webauthn#155 (2 comments by @equalsJeffH)
-
WebAuthn extension identifiers lack match criteria and charset declaration w3c/webauthn#129 (2 comments by @equalsJeffH)
-
Authenticator selection extension - should makeCredential fail if no specified authenticator can be found? w3c/webauthn#227 (1 comment by @rlin1)
-
Provide client instructions for testing whether authenticator has credential in excludeList w3c/webauthn#211 (1 comment by @leshi)
-
update extensions framework to include interfacing with user agent permissions framework w3c/webauthn#133 (1 comment by @equalsJeffH)
-
Clarify which sign. algm.'s RP's must support (Sec. 4.3.2.1.2) w3c/webauthn#104 (1 comment by @vijaybh)
-
define requirements for attestation format specifications w3c/webauthn#126 (1 comment by @equalsJeffH)
-
-
15 pull requests opened.
-
Try out moving to latest copy of bikeshed to avoid git checkout error w3c/webauthn#228, by @vijaybh.
-
Clarify usage of transport hints w3c/webauthn#225, by @leshi.
-
Use RP macro in more places w3c/webauthn#224, by @leshi.
-
Move accountInformation into options. w3c/webauthn#220, by @leshi.
-
add [SecureContext] extended attr to WebAuthentication member of Navi… w3c/webauthn#203, by @equalsJeffH.
-
Proper origin terminology, references, and setting of callerOrigin w3c/webauthn#202, by @equalsJeffH.
-
various editorial cleanups w3c/webauthn#201, by @equalsJeffH.
-
Allow callers to explicitly specify RP ID w3c/webauthn#198, by @vijaybh.
-
fix some grammar, add bikeshed clarifications, add link to official... w3c/webauthn#197, by @equalsJeffH.
-
Fix a few long-standing technical issues w3c/webauthn#196, by @vijaybh.
-
Adds optional transport hints to CredentialDescription w3c/webauthn#194, by @leshi.
-
Update draft-hodges-webauthn-registries.xml w3c/webauthn#193, by @gmandyam.
-
add registry refs and update associated text w3c/webauthn#192, by @equalsJeffH.
-
Jeffh update reg draft w3c/webauthn#191, by @equalsJeffH.
-
Use a local copy of the bikeshed config w3c/webauthn#190, by @vijaybh.
-
-
20 pull requests merged.
-
Clarify usage of transport hints w3c/webauthn#225.
-
Try out moving to latest copy of bikeshed to avoid git checkout error w3c/webauthn#228.
-
Use RP macro in more places w3c/webauthn#224.
-
Update draft-hodges-webauthn-registries.xml w3c/webauthn#193.
-
Allow callers to explicitly specify RP ID w3c/webauthn#198.
-
Adds optional transport hints to CredentialDescription w3c/webauthn#194.
-
add [SecureContext] extended attr to WebAuthentication member of Navi… w3c/webauthn#203.
-
Fix a few long-standing technical issues w3c/webauthn#196.
-
Proper origin terminology, references, and setting of callerOrigin w3c/webauthn#202.
-
various editorial cleanups w3c/webauthn#201.
-
Make attestation more modular w3c/webauthn#161.
-
fix some grammar, add bikeshed clarifications, add link to official... w3c/webauthn#197.
-
add registry refs and update associated text w3c/webauthn#192.
-
Use a local copy of the bikeshed config w3c/webauthn#190.
-
Jeffh update reg draft w3c/webauthn#191.
-
Token Binding ID: JWK -> opaque w3c/webauthn#164.
-
editorial cleanups w3c/webauthn#185.
-
Fixed spelling, grammar, and document syntax issues w3c/webauthn#187.
-
breakup IDL w3c/webauthn#186.
-
Adding the User Verification Mode extension as per discussions in the… w3c/webauthn#169.
-
-
2 pull requests closed.
-
Move accountInformation into options. w3c/webauthn#220.
-
Allow caller to pick between strict and eTLD+1 matching w3c/webauthn#162.
-
-
17 pull requests received 111 new comments.
-
Allow callers to explicitly specify RP ID w3c/webauthn#198 (31 comments by @balfanz, @equalsJeffH, @vijaybh)
-
Adds optional transport hints to CredentialDescription w3c/webauthn#194 (13 comments by @equalsJeffH, @leshi, @vijaybh)
-
Proper origin terminology, references, and setting of callerOrigin w3c/webauthn#202 (10 comments by @equalsJeffH, @vijaybh)
-
Update draft-hodges-webauthn-registries.xml w3c/webauthn#193 (9 comments by @equalsJeffH, @gmandyam, @jcjones)
-
Allow caller to pick between strict and eTLD+1 matching w3c/webauthn#162 (6 comments by @equalsJeffH, @vijaybh, @yaronf)
-
add [SecureContext] extended attr to WebAuthentication member of Navi… w3c/webauthn#203 (3 comments by @equalsJeffH, @vijaybh)
-
Participants
-
1 participant joined.
-
Olive Xu (W3C) joined.
-
-
2 organizations joined.
-
INCA Internet Co.,Ltd. joined.
-
Intuit joined.
-
-
1 organization left.
-
Visa left.
-
GitHub
w3c/webauthn
-
24 issues opened.
-
Should rpId be removed from clientData? w3c/webauthn#189, by @equalsJeffH.
-
should authenticator layer send hashed or unhashed rpId to authenticators? w3c/webauthn#188, by @equalsJeffH.
-
Privacy concerns with blacklist/whitelist w3c/webauthn#184, by @hillbrad.
-
Spec draft points to wrong GitHub issues page w3c/webauthn#183, by @hillbrad.
-
normalize RFC2119 language w3c/webauthn#182, by @equalsJeffH.
-
do not entirely lose distinctions between External and Embedded Authenticators w3c/webauthn#181, by @equalsJeffH.
-
do not totally lose the term "WebAuthn Relying Party" w3c/webauthn#180, by @equalsJeffH.
-
Define UTF-8 string w3c/webauthn#179, by @annevk.
-
lowercase form of this RP ID w3c/webauthn#178, by @annevk.
-
4.1 heading should appear before the IDL w3c/webauthn#177, by @annevk.
-
clarify normality of authenticator model - is it actually authenticator API ? w3c/webauthn#176, by @equalsJeffH.
-
facet should be USVString w3c/webauthn#175, by @annevk.
-
facet should be defined in terms of the HTML Standard w3c/webauthn#174, by @annevk.
-
"web origin of the script" w3c/webauthn#173, by @annevk.
-
What if callerOrigin is an opaque origin w3c/webauthn#172, by @annevk.
-
callerOrigin w3c/webauthn#171, by @annevk.
-
makeCredential() should use a dictionary w3c/webauthn#170, by @annevk.
-
also cite the other extant TLS channel binding mechanisms? w3c/webauthn#168, by @equalsJeffH.
-
hostname canonicalization in {#makeCredential} section? w3c/webauthn#167, by @equalsJeffH.
-
Consider using USVString instead of DOMString sometimes w3c/webauthn#166, by @domenic.
-
DOMString[] should be FrozenArray<DOMString> w3c/webauthn#165, by @domenic.
-
Clarify the definition of "origin" w3c/webauthn#160, by @jcjones.
-
Clarify meaning of UVI w3c/webauthn#156, by @rlin1.
-
-
5 issues closed.
-
Remove attestation specification from spec w3c/webauthn#108.
-
Add opaque data extension w3c/webauthn#98.
-
Problem with authn selection extension w3c/webauthn#152.
-
Client processing steps are not aligned with authenticator model w3c/webauthn#153.
-
makeCredential() should use a dictionary w3c/webauthn#170.
-
-
1 issue reopened.
-
Secure context should be MUST not SHOULD w3c/webauthn#146, by @equalsJeffH.
-
-
26 issues received 47 new comments.
-
clarify content of algorithm member of ScopedCredentialParameters w3c/webauthn#113 (1 comment by @equalsJeffH)
-
Section 4: Mention requirement for user to give consent for key to be used w3c/webauthn#99 (1 comment by @equalsJeffH)
-
Silent/touchless Authn? clarification of bit 0 in AuthenticatorData w3c/webauthn#22 (1 comment by @equalsJeffH)
-
clarify that at least one model of attestation must be employed w3c/webauthn#115 (1 comment by @equalsJeffH)
-
Consider using USVString instead of DOMString sometimes w3c/webauthn#166 (1 comment by @equalsJeffH)
-
clarify normality of authenticator model - is it actually authenticator API ? w3c/webauthn#176 (1 comment by @equalsJeffH)
-
also cite the other extant TLS channel binding mechanisms? w3c/webauthn#168 (1 comment by @equalsJeffH)
-
hostname canonicalization in {#makeCredential} section? w3c/webauthn#167 (1 comment by @equalsJeffH)
-
tokenBinding in ClientData should be a binary type (perhaps base64) and not JsonWebKey w3c/webauthn#163 (1 comment by @Andrei-Popov)
-
10 pull requests opened.
-
Fixed spelling, grammar, and document syntax issues w3c/webauthn#187, by @selfissued.
-
breakup IDL w3c/webauthn#186, by @equalsJeffH.
-
editorial cleanups w3c/webauthn#185, by @equalsJeffH.
-
Adding the User Verification Mode extension as per discussions in the… w3c/webauthn#169, by @rdghosh.
-
Token Binding ID: JWK -> opaque w3c/webauthn#164, by @vijaybh.
-
Allow caller to pick between strict and eTLD+1 matching w3c/webauthn#162, by @vijaybh.
-
Make attestation more modular w3c/webauthn#161, by @vijaybh.
-
IDL cleanup: don't require callers to create Credential objects w3c/webauthn#159, by @vijaybh.
-
Eliminate Credential object w3c/webauthn#158, by @vijaybh.
-
Update index.bs with proposed location extension w3c/webauthn#157, by @gmandyam.
-
-
3 pull requests merged.
-
Update index.bs with proposed location extension w3c/webauthn#157.
-
Cleaned up exposition of processing rules w3c/webauthn#154.
-
IDL cleanup: don't require callers to create Credential objects w3c/webauthn#159.
-
-
2 pull requests closed.
-
Remove ScopedCredentialParameters tuple (by unpairing type & algorithm) w3c/webauthn#143.
-
Eliminate Credential object w3c/webauthn#158.
-
-
1 pull request reopened.
-
Update index.bs with proposed location extension w3c/webauthn#157, by @gmandyam.
-
-
10 pull requests received 51 new comments.
-
Cleaned up exposition of processing rules w3c/webauthn#154 (27 comments by @equalsJeffH, @jcjones, @leshi, @vijaybh)
-
Update index.bs with proposed location extension w3c/webauthn#157 (12 comments by @gmandyam, @jcjones)
-
Allow caller to pick between strict and eTLD+1 matching w3c/webauthn#162 (2 comments by @balfanz, @jcjones)
-
IDL cleanup: don't require callers to create Credential objects w3c/webauthn#159 (2 comments by @equalsJeffH, @jcjones)
-
Adding the User Verification Mode extension as per discussions in the… w3c/webauthn#169 (1 comment by @equalsJeffH)
-
Participants
-
1 participant joined.
-
Naomi Yoshizawa (W3C) joined.
-
-
1 organization joined.
-
Ministerio do Planejamento Orcamento e Gestao joined.
-
GitHub
w3c/webauthn
-
11 issues opened.
-
Client processing steps are not aligned with authenticator model w3c/webauthn#153, by @vijaybh.
-
Problem with authn selection extension w3c/webauthn#152, by @vijaybh.
-
Clarify how a user can authenticate from multiple devices w3c/webauthn#151, by @cjthompson.
-
do we need "Byte length l of AAGUID" ? w3c/webauthn#150, by @equalsJeffH.
-
AAGUID must be a "version 4 UUID" ? w3c/webauthn#149, by @equalsJeffH.
-
"version 4 GUID" should be "version 4 UUID" w3c/webauthn#148, by @equalsJeffH.
-
Secure context should be MUST not SHOULD w3c/webauthn#146, by @vijaybh.
-
define "attestation" in terminology section w3c/webauthn#141, by @equalsJeffH.
-
credential id privacy w3c/webauthn#140, by @AxelNennker.
-
imageURL privacy w3c/webauthn#139, by @AxelNennker.
-
11 issues closed.
-
key-attestation: KeyHandle in attestaion rawData type="packed" w3c/webauthn#31.
-
Key-Attestation: Packed attestation length w3c/webauthn#33.
-
add invocation of authenticatorCancel to step 8 of makeCredential ? w3c/webauthn#124.
-
Move optional parameters and extensions into an "options" dictionary w3c/webauthn#84.
-
clarify returned values from authenticatorMakeCredential operation w3c/webauthn#105.
-
attestation unmentioned in authenticatorMakeCredential operation w3c/webauthn#114.
-
Security: Signature format doesn't cover whole context w3c/webauthn#107.
-
Move AAGUID from extension to packed attestation. w3c/webauthn#132.
-
-
1 issue reopened.
-
Clarify how a user can authenticate from multiple devices w3c/webauthn#151, by @cjthompson.
-
-
13 issues received 42 new comments.
-
Remove attestation specification from spec w3c/webauthn#108 (11 comments by @equalsJeffH, @gmandyam, @rlin1, @selfissued, @vijaybh)
-
Clarify how a user can authenticate from multiple devices w3c/webauthn#151 (8 comments by @cjthompson, @nadalin, @vijaybh)
-
Attestation format identifiers lack formal definition and matching rules w3c/webauthn#127 (6 comments by @jcjones, @vijaybh)
-
Security: Signature format doesn't cover whole context w3c/webauthn#107 (3 comments by @rlin1, @vijaybh)
-
better explain the relation between attestation models and attestation types w3c/webauthn#121 (3 comments by @rlin1)
-
TAG review feedback: Align Credential interface with Credential Management? w3c/webauthn#60 (1 comment by @vijaybh)
-
-
8 pull requests opened.
-
Cleaned up exposition of processing rules w3c/webauthn#154, by @vijaybh.
-
Various minor technical fixes w3c/webauthn#147, by @vijaybh.
-
IDL cleanup: replace optional parameters with a single optional dictionary w3c/webauthn#145, by @vijaybh.
-
Extend the signature format to also include the RP ID w3c/webauthn#144, by @vijaybh.
-
Remove ScopedCredentialParameters tuple (by unpairing type & algorithm) w3c/webauthn#143, by @jcjones.
-
API aesthetic updates w3c/webauthn#142, by @jcjones.
-
Rolf attestation types 121 w3c/webauthn#138, by @rlin1.
-
moved AAGUID into packed attestation core. Removed AAGUID extension. w3c/webauthn#137, by @rlin1.
-
-
7 pull requests merged.
-
Various minor technical fixes w3c/webauthn#147.
-
Extend the signature format to also include the RP ID w3c/webauthn#144.
-
API aesthetic updates w3c/webauthn#142.
-
moved AAGUID into packed attestation core. Removed AAGUID extension. w3c/webauthn#137.
-
Rolf attestation types 121 w3c/webauthn#138.
-
Text aesthetic updates w3c/webauthn#135.
-
-
8 pull requests received 37 new comments.
-
Extend the signature format to also include the RP ID w3c/webauthn#144 (5 comments by @balfanz, @bifurcation, @jcjones, @vijaybh)
-
Rolf attestation types 121 w3c/webauthn#138 (4 comments by @apowers313, @bifurcation, @equalsJeffH, @vijaybh)
-
Remove ScopedCredentialParameters tuple (by unpairing type & algorithm) w3c/webauthn#143 (3 comments by @equalsJeffH, @jcjones)
-
moved AAGUID into packed attestation core. Removed AAGUID extension. w3c/webauthn#137 (3 comments by @apowers313, @equalsJeffH, @vijaybh)
-
IDL cleanup: replace optional parameters with a single optional dictionary w3c/webauthn#145 (1 comment by @vijaybh)
GitHub
w3c/webauthn
-
22 issues opened.
-
Move AAGUID from extension to packed attestation. w3c/webauthn#132, by @rlin1.
-
Add "registration extension" and "authentication extension" to glossary w3c/webauthn#131, by @vijaybh.
-
WebAuthn extension identifiers lack match criteria and charset declaration w3c/webauthn#129, by @equalsJeffH.
-
Change Android SafetyNet attestation type identifier ? w3c/webauthn#128, by @equalsJeffH.
-
Attestation format identifiers lack formal definition and matching rules w3c/webauthn#127, by @equalsJeffH.
-
define requirements for attestation format specifications w3c/webauthn#126, by @equalsJeffH.
-
impl guidelines for signature counter w3c/webauthn#125, by @equalsJeffH.
-
add invocation of authenticatorCancel to step 8 of makeCredential ? w3c/webauthn#124, by @equalsJeffH.
-
Clarify names for crypto algs, e.g. RS256 w3c/webauthn#123, by @rlin1.
-
refine extension terminology w3c/webauthn#122, by @equalsJeffH.
-
better explain the relation between attestation models and attestation types w3c/webauthn#121, by @equalsJeffH.
-
update mention & refs of FIDO protocols in Basic Attestation section w3c/webauthn#120, by @equalsJeffH.
-
clientDataJSON returned in WebAuthnAttestation rather than AttestationStatement w3c/webauthn#119, by @equalsJeffH.
-
differentiate assertion signatures and attestation signatures w3c/webauthn#118, by @equalsJeffH.
-
challenge in ClientData should be ArrayBuffer or BufferSource ? w3c/webauthn#117, by @equalsJeffH.
-
further details for authenticatorCancel operation w3c/webauthn#116, by @equalsJeffH.
-
clarify that at least one model of attestation must be employed w3c/webauthn#115, by @equalsJeffH.
-
attestation unmentioned in authenticatorMakeCredential operation w3c/webauthn#114, by @equalsJeffH.
-
clarify content of algorithm member of ScopedCredentialParameters w3c/webauthn#113, by @equalsJeffH.
-
consider moving IDL from monolithic block to individual spec sections w3c/webauthn#112, by @equalsJeffH.
-
4 issues closed.
-
AAGUID extension underspecified w3c/webauthn#51.
-
Clarify when an extension may be ignored by user agent w3c/webauthn#97.
-
challenge in ClientData should be ArrayBuffer or BufferSource ? w3c/webauthn#117.
-
move biblio.js into in-line <pre class=biblio> block w3c/webauthn#92.
-
-
9 issues received 14 new comments.
-
clarify content of algorithm member of ScopedCredentialParameters w3c/webauthn#113 (3 comments by @apowers313, @equalsJeffH)
-
Add "registration extension" and "authentication extension" to glossary w3c/webauthn#131 (2 comments by @equalsJeffH)
-
WebAuthn extension identifiers lack match criteria and charset declaration w3c/webauthn#129 (1 comment by @equalsJeffH)
-
challenge in ClientData should be ArrayBuffer or BufferSource ? w3c/webauthn#117 (1 comment by @vijaybh)
-
consider moving IDL from monolithic block to individual spec sections w3c/webauthn#112 (1 comment by @apowers313)
-
4 pull requests opened.
-
Use W3C-standard bikeshed/CI scripts w3c/webauthn#136, by @jcjones.
-
Text aesthetic updates w3c/webauthn#135, by @jcjones.
-
Rename index.src.html to index.bs w3c/webauthn#134, by @jcjones.
-
Clean up extensions section w3c/webauthn#130, by @vijaybh.
-
-
4 pull requests merged.
-
Use W3C-standard bikeshed/CI scripts w3c/webauthn#136.
-
Rename index.src.html to index.bs w3c/webauthn#134.
-
Clean up extensions section w3c/webauthn#130.
-
Editorial polishing of abstract, intro material, terminology, etc. w3c/webauthn#109.
-
-
5 pull requests received 13 new comments.
-
Editorial polishing of abstract, intro material, terminology, etc. w3c/webauthn#109 (1 comment by @vijaybh)
TR publications
-
1 document published.
-
Web Authentication: A Web API for accessing scoped credentials published as a First Public Working Draft. History of Web Authentication: A Web API for accessing scoped credentials
-
Participants
-
1 participant joined.
-
atsuhiro tsuchiya (W3C Invited Experts) joined.
-
-
2 organizations joined.
-
IBM Corporation joined.
-
Tencent joined.
-
GitHub
w3c/webauthn
-
27 issues opened.
-
Remove attestation specification from spec w3c/webauthn#108, by @leshi.
-
Security: Signature format doesn't cover whole context w3c/webauthn#107, by @leshi.
-
Document wide review w3c/webauthn#106, by @wseltzer.
-
clarify returned values from authenticatorMakeCredential operation w3c/webauthn#105, by @equalsJeffH.
-
Clarify which sign. algm.'s RP's must support (Sec. 4.3.2.1.2) w3c/webauthn#104, by @gmandyam.
-
Add Android "N" attestation type. w3c/webauthn#103, by @rlin1.
-
Add section describing verification of a WebAuthnAssertion w3c/webauthn#102, by @rlin1.
-
New research suggest using ED512 instead of ED256. w3c/webauthn#101, by @rlin1.
-
Section 4.3: add reference to privacy w3c/webauthn#100, by @rlin1.
-
Section 4: Mention requirement for user to give consent for key to be used w3c/webauthn#99, by @rlin1.
-
Add opaque data extension w3c/webauthn#98, by @gmandyam.
-
Clarify when an extension may be ignored by user agent w3c/webauthn#97, by @gmandyam.
-
Privacy across OS accounts w3c/webauthn#96, by @levangongPayPal.
-
Authenticator Selection Extension - Client Processing - Clarification w3c/webauthn#95, by @levangongPayPal.
-
clarify conveyance of attested public key w3c/webauthn#94, by @equalsJeffH.
-
move biblio.js into in-line <pre class=biblio> block w3c/webauthn#92, by @equalsJeffH.
-
Create an Explainer document w3c/webauthn#91, by @sideshowbarker.
-
tgbbn w3c/webauthn#89, by @apowers313.
-
tgbbnccccccevjdnfkufcdnulgkllldgvjrltediuknnjejbj w3c/webauthn#90, by @apowers313.
-
Spec should not mandate behavior of server w3c/webauthn#88, by @leshi.
-
Scoped credentials represent a relationship between user and RP w3c/webauthn#87, by @levangongPayPal.
-
ScopedCredentialInfo attestation w3c/webauthn#86, by @apowers313.
-
assertionChallenge recommendations w3c/webauthn#85, by @apowers313.
-
Move optional parameters and extensions into an "options" dictionary w3c/webauthn#84, by @vijaybh.
-
adopt consistent terms for RP server-side and client-side components w3c/webauthn#80, by @equalsJeffH.
-
normalizing term(s) for authenticator-generated RP-specific public key w3c/webauthn#79, by @equalsJeffH.
-
biblio.json: TPM refs 404 w3c/webauthn#78, by @equalsJeffH.
-
-
29 issues closed.
-
ED512 Support w3c/webauthn#42.
-
Structure of Credential ID w3c/webauthn#40.
-
Define AuthenticatorVersion extension w3c/webauthn#39.
-
Key-Attestation: no point compression in the Packed attestation w3c/webauthn#34.
-
Usability Issue: Account Deletion w3c/webauthn#26.
-
WebAPI: Authentication failure due to inactivity w3c/webauthn#17.
-
WebAPI: add userID as input parameter in authenticatorGetAssertion w3c/webauthn#14.
-
SigFormat: clarification of FIDOWebAPI scope w3c/webauthn#21.
-
WebAPI: Credential Identifier scope w3c/webauthn#16.
-
WebAPI: Clarification Credential Type w3c/webauthn#15.
-
SigFormat: Question on FIDO 2.0 layers w3c/webauthn#20.
-
key-attestation: lacks explanation of "attestation" w3c/webauthn#27.
-
Credential.id currently assumed to be RP unique w3c/webauthn#38.
-
TAG review comments on eTLD+1 w3c/webauthn#58.
-
Clarify that extensions are optional and may not be supported w3c/webauthn#74.
-
tgbbn w3c/webauthn#89.
-
tgbbnccccccevjdnfkufcdnulgkllldgvjrltediuknnjejbj w3c/webauthn#90.
-
Rename WebAuthnAssertion / getAssertion w3c/webauthn#62.
-
encodedClientData should be clientDataJSON ? w3c/webauthn#29.
-
biblio.json: TPM refs 404 w3c/webauthn#78.
-
Abstraction layer for attestations w3c/webauthn#1.
-
-
31 issues received 36 new comments.
-
key-attestation: KeyHandle in attestaion rawData type="packed" w3c/webauthn#31 (2 comments by @rlin1, @vijaybh)
-
web-api: is further language needed describing AppID (aka rpId) usage ? w3c/webauthn#8 (1 comment by @equalsJeffH)
-
Section 4: Mention requirement for user to give consent for key to be used w3c/webauthn#99 (1 comment by @equalsJeffH)
-
Clarify which sign. algm.'s RP's must support (Sec. 4.3.2.1.2) w3c/webauthn#104 (1 comment by @equalsJeffH)
-
The FIDO Metadata Service needs a non-FIDO analogous mechanism w3c/webauthn#47 (1 comment by @vijaybh)
-
Key-Attestation: no point compression in the Packed attestation w3c/webauthn#34 (1 comment by @vijaybh)
-
WebAPI: need to propagate credential de-commissioning through the system w3c/webauthn#18 (1 comment by @vijaybh)
-
WebAPI: add userID as input parameter in authenticatorGetAssertion w3c/webauthn#14 (1 comment by @vijaybh)
-
SigFormat: Clarification of assertion delivery in platform specific manner w3c/webauthn#23 (1 comment by @equalsJeffH)
-
Verification of publicKey missing in section 3.5 Verifying an Attestation Statement w3c/webauthn#37 (1 comment by @vijaybh)
-
Should a FIDOAssertion on an Android platform use AndroidAttestationClientData? w3c/webauthn#32 (1 comment by @vijaybh)
-
normalizing term(s) for authenticator-generated RP-specific public key w3c/webauthn#79 (1 comment by @vijaybh)
-
-
6 pull requests opened.
-
[5 second review] Fix spec shortname to prep for FPWD w3c/webauthn#110, by @vijaybh.
-
Editorial polishing of abstract, intro material, terminology, etc. w3c/webauthn#109, by @equalsJeffH.
-
Update reference to Secure-Contexts (from Powerful-Features) w3c/webauthn#93, by @jcjones.
-
Lots of FPWD issues w3c/webauthn#83, by @vijaybh.
-
Replace TPM hyperlinks with working ones w3c/webauthn#82, by @vijaybh.
-
Pre-FWPD proofreading corrections w3c/webauthn#81, by @selfissued.
-
-
7 pull requests merged.
-
[5 second review] Fix spec shortname to prep for FPWD w3c/webauthn#110.
-
Update reference to Secure-Contexts (from Powerful-Features) w3c/webauthn#93.
-
Lots of FPWD issues w3c/webauthn#83.
-
Replace TPM hyperlinks with working ones w3c/webauthn#82.
-
Simplify attestation structure by moving details into authnr model w3c/webauthn#76.
-
Pre-FWPD proofreading corrections w3c/webauthn#81.
-
-
7 pull requests received 90 new comments.
-
Editorial polishing of abstract, intro material, terminology, etc. w3c/webauthn#109 (55 comments by @equalsJeffH, @vijaybh)
-
Simplify attestation structure by moving details into authnr model w3c/webauthn#76 (19 comments by @equalsJeffH, @jcjones, @leshi, @rlin1, @vijaybh)
-
Update reference to Secure-Contexts (from Powerful-Features) w3c/webauthn#93 (4 comments by @equalsJeffH, @jcjones)
-
Represent binary data as ArrayBuffers instead of base64-encoded DOMStrings w3c/webauthn#77 (3 comments by @equalsJeffH, @jcjones, @vijaybh)
-
Participants
-
1 participant joined.
-
Samuel Weiler (W3C) joined.
-
-
1 organization joined.
-
Visa joined.
-
GitHub
w3c/webauthn
-
4 issues opened.
-
Clarify that extensions are optional and may not be supported w3c/webauthn#74, by @leshi.
-
Terminology: WebAuthn Relying Party - no account creation w3c/webauthn#70, by @levangongPayPal.
-
Terminology consistency w3c/webauthn#66, by @flpm.
-
Relying Party or Server w3c/webauthn#65, by @apowers313.
-
-
8 issues closed.
-
Put all the extensions in one spot w3c/webauthn#9.
-
Move extension specification out of signature format w3c/webauthn#7.
-
Terminology: WebAuthn Relying Party - no account creation w3c/webauthn#70.
-
Add a Terminology Section w3c/webauthn#50.
-
TAG review feedback: imageUri w3c/webauthn#59.
-
Should we remove the algorithm from FIDOCredentialInfo? w3c/webauthn#41.
-
Genericize nomenclature, where possible w3c/webauthn#46.
-
Fix the licensing statement w3c/webauthn#45.
-
-
15 issues received 24 new comments.
-
TAG review feedback: Should we be using array types instead of base64-encoded DOMStrings? w3c/webauthn#61 (2 comments by @equalsJeffH, @vijaybh)
-
TAG review feedback: Align Credential interface with Credential Management? w3c/webauthn#60 (2 comments by @equalsJeffH, @vijaybh)
-
Clarify that extensions are optional and may not be supported w3c/webauthn#74 (1 comment by @gmandyam)
-
Terminology: WebAuthn Relying Party - no account creation w3c/webauthn#70 (1 comment by @equalsJeffH)
-
9 pull requests opened.
-
Represent binary data as ArrayBuffers instead of base64-encoded DOMStrings w3c/webauthn#77, by @vijaybh.
-
Simplify attestation structure by moving details into authnr model w3c/webauthn#76, by @vijaybh.
-
Markdown cleanup w3c/webauthn#75, by @vijaybh.
-
Proposed refactor to separate web API and autehnticator model w3c/webauthn#73, by @vijaybh.
-
GitHub pages bugfix: Pull in `bikeshed-template` PR detection fix w3c/webauthn#72, by @jcjones.
-
Terminology: WebAuthn Relying Party - no account creation w3c/webauthn#71, by @levangongPayPal.
-
Rename imageUri to imageURL w3c/webauthn#69, by @vijaybh.
-
Issue #50: Add a Terminology Section w3c/webauthn#68, by @jcjones.
-
Add build, installation, contact, and branch information to the README w3c/webauthn#67, by @jcjones.
-
-
8 pull requests merged.
-
Markdown cleanup w3c/webauthn#75.
-
Proposed refactor to separate web API and autehnticator model w3c/webauthn#73.
-
GitHub pages bugfix: Pull in `bikeshed-template` PR detection fix w3c/webauthn#72.
-
Terminology: WebAuthn Relying Party - no account creation w3c/webauthn#71.
-
Rename imageUri to imageURL w3c/webauthn#69.
-
Issue #50: Add a Terminology Section w3c/webauthn#68.
-
-
7 pull requests received 14 new comments.
-
Simplify attestation structure by moving details into authnr model w3c/webauthn#76 (3 comments by @equalsJeffH, @vijaybh)
-
Proposed refactor to separate web API and autehnticator model w3c/webauthn#73 (2 comments by @equalsJeffH, @jcjones)
-
Issue #46 - Update Nomenclature using non-trademarked wordings where possible w3c/webauthn#48 (2 comments by @jcjones, @vijaybh)
-
Participants
-
3 organizations joined.
-
360 joined.
-
National Institute of Standards and Technology (NIST) joined.
-
Electronics and Telecommunications Research Institute (ETRI) joined.
-
GitHub
w3c/webauthn
-
51 issues opened.
-
Rename WebAuthnAssertion / getAssertion w3c/webauthn#62, by @jcjones.
-
TAG review feedback: Align Credential interface with Credential Management? w3c/webauthn#60, by @vijaybh.
-
TAG review feedback: imageUri w3c/webauthn#59, by @vijaybh.
-
TAG review comments on eTLD+1 w3c/webauthn#58, by @wseltzer.
-
Underspecified error conditions w3c/webauthn#53, by @apowers313.
-
AAGUID extension underspecified w3c/webauthn#51, by @rlin1.
-
Add a Terminology Section w3c/webauthn#50, by @jcjones.
-
The FIDO Metadata Service needs a non-FIDO analogous mechanism w3c/webauthn#47, by @jcjones.
-
Genericize nomenclature, where possible w3c/webauthn#46, by @jcjones.
-
Fix the licensing statement w3c/webauthn#45, by @wseltzer.
-
ED512 Support w3c/webauthn#42, by @equalsJeffH.
-
Structure of Credential ID w3c/webauthn#40, by @equalsJeffH.
-
Should we remove the algorithm from FIDOCredentialInfo? w3c/webauthn#41, by @equalsJeffH.
-
Define AuthenticatorVersion extension w3c/webauthn#39, by @equalsJeffH.
-
Credential.id currently assumed to be RP unique w3c/webauthn#38, by @equalsJeffH.
-
WebAPI: Example syntax errors w3c/webauthn#36, by @equalsJeffH.
-
Key-Attestation: no point compression in the Packed attestation w3c/webauthn#34, by @equalsJeffH.
-
all specs: update names used in examples to be faux entities w3c/webauthn#35, by @equalsJeffH.
-
Key-Attestation: Packed attestation length w3c/webauthn#33, by @equalsJeffH.
-
key-attestation: KeyHandle in attestaion rawData type="packed" w3c/webauthn#31, by @equalsJeffH.
-
encodedClientData should be clientDataJSON ? w3c/webauthn#29, by @equalsJeffH.
-
key-attestation: lacks explanation of "attestation" w3c/webauthn#27, by @equalsJeffH.
-
Usability Issue: Account Deletion w3c/webauthn#26, by @equalsJeffH.
-
Usability Issue: Server Challenge timeout w3c/webauthn#25, by @equalsJeffH.
-
SigFormat: Clarification of assertion delivery in platform specific manner w3c/webauthn#23, by @equalsJeffH.
-
Silent/touchless Authn? clarification of bit 0 in AuthenticatorData w3c/webauthn#22, by @equalsJeffH.
-
SigFormat: clarification of FIDOWebAPI scope w3c/webauthn#21, by @equalsJeffH.
-
SigFormat: Question on FIDO 2.0 layers w3c/webauthn#20, by @equalsJeffH.
-
WebAPI: Glossary needed w3c/webauthn#19, by @equalsJeffH.
-
WebAPI: need to propagate credential de-commissioning through the system w3c/webauthn#18, by @equalsJeffH.
-
WebAPI: Authentication failure due to inactivity w3c/webauthn#17, by @equalsJeffH.
-
WebAPI: Credential Identifier scope w3c/webauthn#16, by @equalsJeffH.
-
WebAPI: Clarification Credential Type w3c/webauthn#15, by @equalsJeffH.
-
WebAPI: add userID as input parameter in authenticatorGetAssertion w3c/webauthn#14, by @equalsJeffH.
-
WebAPI: credential binding to a user account w3c/webauthn#13, by @equalsJeffH.
-
WebAPI: FIDO Authenticator model - clarifications needed w3c/webauthn#12, by @equalsJeffH.
-
WebAPI: USB fob use case w3c/webauthn#11, by @equalsJeffH.
-
WebAPI: Registration (embedded authenticator mode) use cases assumptions w3c/webauthn#10, by @equalsJeffH.
-
Put all the extensions in one spot w3c/webauthn#9, by @equalsJeffH.
-
web-api: is further language needed describing AppID (aka rpId) usage ? w3c/webauthn#8, by @equalsJeffH.
-
Move extension specification out of signature format w3c/webauthn#7, by @equalsJeffH.
-
Where should transport hints go? w3c/webauthn#6, by @equalsJeffH.
-
Merge all the specs into one w3c/webauthn#4, by @leshi.
-
Abstraction layer for attestations w3c/webauthn#1, by @hhalpin.
-
5 issues closed.
-
WebAPI: Glossary needed w3c/webauthn#19.
-
Test w3c/webauthn#63.
-
WebAPI: Example syntax errors w3c/webauthn#36.
-
all specs: update names used in examples to be faux entities w3c/webauthn#35.
-
Merge all the specs into one w3c/webauthn#4.
-
-
24 issues received 51 new comments.
-
web-api: is further language needed describing AppID (aka rpId) usage ? w3c/webauthn#8 (7 comments by @equalsJeffH)
-
key-attestation: S 2.3 "attestation types" -- move into S 2.1 "attestation models" ? w3c/webauthn#28 (3 comments by @equalsJeffH)
-
need description & illustrations of overall flow: authnr <--> platform API <--> RP w3c/webauthn#24 (3 comments by @equalsJeffH)
-
The FIDO Metadata Service needs a non-FIDO analogous mechanism w3c/webauthn#47 (2 comments by @nadalin, @rlin1)
-
Should we remove the algorithm from FIDOCredentialInfo? w3c/webauthn#41 (2 comments by @equalsJeffH)
-
key-attestation: KeyHandle in attestaion rawData type="packed" w3c/webauthn#31 (1 comment by @equalsJeffH)
-
WebAPI: Registration (embedded authenticator mode) use cases assumptions w3c/webauthn#10 (1 comment by @equalsJeffH)
-
-
13 pull requests opened.
-
Finish doc merge by deleting old files w3c/webauthn#64, by @vijaybh.
-
Updates example names to be faux entities w3c/webauthn#57, by @leshi.
-
Remove algorithm from FIDOCredentialInfo w3c/webauthn#56, by @leshi.
-
Fix syntax errors w3c/webauthn#55, by @leshi.
-
TravisCI Integration w3c/webauthn#54, by @jcjones.
-
gh-pages update w3c/webauthn#52, by @wseltzer.
-
Update to W3C Doc License w3c/webauthn#49, by @wseltzer.
-
Issue #46 - Update Nomenclature using non-trademarked wordings where possible w3c/webauthn#48, by @jcjones.
-
update from original doc-merge branch w3c/webauthn#43, by @equalsJeffH.
-
ReSpec source files plus how to convert to Bikeshed w3c/webauthn#5, by @equalsJeffH.
-
sync master to gh-pages w3c/webauthn#3, by @wseltzer.
-
FIDO 2.0 Submissions w3c/webauthn#2, by @hhalpin.
-
-
8 pull requests merged.
-
Remove algorithm from FIDOCredentialInfo w3c/webauthn#56.
-
Finish doc merge by deleting old files w3c/webauthn#64.
-
TravisCI Integration w3c/webauthn#54.
-
Update to W3C Doc License w3c/webauthn#49.
-
Doc merge w3c/webauthn#44.
-
ReSpec source files plus how to convert to Bikeshed w3c/webauthn#5.
-
sync master to gh-pages w3c/webauthn#3.
-
FIDO 2.0 Submissions w3c/webauthn#2.
-
-
4 pull requests closed.
-
Updates example names to be faux entities w3c/webauthn#57.
-
Fix syntax errors w3c/webauthn#55.
-
gh-pages update w3c/webauthn#52.
-
update from original doc-merge branch w3c/webauthn#43.
-
-
8 pull requests received 27 new comments.
-
Issue #46 - Update Nomenclature using non-trademarked wordings where possible w3c/webauthn#48 (15 comments by @jcjones, @leshi, @nadalin, @vijaybh)
-
Lifecycle
-
1 charter started.
-
Chartered until 8 February 2017. Participants had to rejoin under this charter.
-
Participants
-
4 participants joined.
-
Keiji Takeda (W3C) joined.
-
Natasha Rooney (W3C Invited Experts) joined.
-
Wendy Seltzer (W3C) joined.
-
Harry Halpin (W3C) joined.
-
-
20 organizations joined.
-
Qualcomm Innovation Center, Inc joined.
-
LSEG joined.
-
Alibaba Group joined.
-
PayGate joined.
-
Orange joined.
-
CANTON CONSULTING joined.
-
Plantronics, Inc. joined.
-
Bloomberg joined.
-
Deutsche Telekom AG joined.
-
Opera Software AS joined.
-
Microsoft Corporation joined.
-
PayPal joined.
-
New Zealand Government joined.
-
HM Government joined.
-
Federal Reserve Bank of Minneapolis joined.
-
Yubico joined.
-
Intel Corporation joined.
-
Google LLC joined.
-
Mozilla Foundation joined.
-
OneSpan joined.
-