Web Authentication Working Group - Activity in 2017
No matches.
TR publications
-
1 document published.
Participants
-
1 organization joined.
-
Apple Inc. joined.
-
GitHub
w3c/webauthn
-
13 issues opened.
-
cognitive-accessibility consideration w3c/webauthn#733, by @JohnRochfordUMMS.
-
there is no {{PublicKeyCredentialEntity/id}} w3c/webauthn#727, by @equalsJeffH.
-
txAuthSimple does not conform to extension requirements w3c/webauthn#725, by @gmandyam.
-
Contradiction in whether user handle is required w3c/webauthn#720, by @emlun.
-
PublicKeyCredentialDescriptor.id needs a more precise definition w3c/webauthn#716, by @jcjones.
-
JSON deserialization is not defined w3c/webauthn#713, by @annevk.
-
JSON-serialized client data is wrong w3c/webauthn#712, by @annevk.
-
[[identifier]]'s explanation ought to link to [=credential ID=] w3c/webauthn#711, by @equalsJeffH.
-
remove alg argument lists in Abort Operation section w3c/webauthn#707, by @equalsJeffH.
-
Review acknowledgments and editors list w3c/webauthn#706, by @wseltzer.
-
choose consistent section id prefix w3c/webauthn#704, by @equalsJeffH.
-
-
15 issues closed.
-
attachment is only explicitly used in create() w3c/webauthn#420.
-
Credential ID uniqueness expectations are inconsistent/vague w3c/webauthn#579.
-
remove alg argument lists in Abort Operation section w3c/webauthn#707.
-
[[identifier]]'s explanation ought to link to [=credential ID=] w3c/webauthn#711.
-
there is no {{PublicKeyCredentialEntity/id}} w3c/webauthn#727.
-
Review acknowledgments and editors list w3c/webauthn#706.
-
Need to fix android key attestation verification procedure w3c/webauthn#599.
-
PublicKeyCredentialDescriptor.id needs a more precise definition w3c/webauthn#716.
-
restrict WebAuthentication API to only top level browsing context w3c/webauthn#374.
-
UVM Extension Editorial Change w3c/webauthn#368.
-
-
3 issues reopened.
-
Contradiction in whether user handle is required w3c/webauthn#720, by @akshayku.
-
Contradiction in whether user handle is required w3c/webauthn#720, by @emlun.
-
-
27 issues received 82 new comments.
-
txAuthSimple does not conform to extension requirements w3c/webauthn#725 (7 comments by @emlun, @equalsJeffH, @gmandyam, @Kieun)
-
various issues with AppId extension w3c/webauthn#491 (7 comments by @arnar, @emlun, @equalsJeffH, @leshi)
-
update extensions framework to include interfacing with user agent permissions framework w3c/webauthn#133 (6 comments by @equalsJeffH, @gmandyam, @riking, @selfissued)
-
Review acknowledgments and editors list w3c/webauthn#706 (6 comments by @equalsJeffH, @jcjones, @nadalin, @selfissued)
-
musings wrt webauthn's profile of COSE_Key w3c/webauthn#543 (5 comments by @akshayku, @equalsJeffH, @selfissued, @ttaubert)
-
Bug: getAssertion accidentally calls authenticatorGetAssertion in first factor mode w3c/webauthn#685 (4 comments by @emlun, @rlin1)
-
"5.4. Options for Credential Creation" still lists PublicKeyCredentialUserEntity.name w3c/webauthn#714 (3 comments by @emlun, @ttaubert)
-
User Verification Method (uvm) extension incorrectly mentions user verification *index* w3c/webauthn#589 (3 comments by @equalsJeffH, @rlin1)
-
Crypto algorithm agility: e.g., Specify the set of hash algorithms UAs can select between. w3c/webauthn#362 (3 comments by @equalsJeffH, @jyasskin)
-
remove alg argument lists in Abort Operation section w3c/webauthn#707 (2 comments by @emlun, @equalsJeffH)
-
FIDO U2F Attestation Statement Format needs to clarify that user handle will be empty w3c/webauthn#715 (2 comments by @emlun, @Kieun)
-
Need to fix android key attestation verification procedure w3c/webauthn#599 (2 comments by @equalsJeffH, @rlin1)
-
Credential ID uniqueness expectations are inconsistent/vague w3c/webauthn#579 (1 comment by @equalsJeffH)
-
Authenticator selection extension - should makeCredential fail if no specified authenticator can be found? w3c/webauthn#227 (1 comment by @equalsJeffH)
-
Extension identifiers in examples are inconsistent with registered identifiers w3c/webauthn#588 (1 comment by @rlin1)
-
clarify "authenticator model": RPs may perform feature-based authenticator selection w3c/webauthn#645 (1 comment by @emlun)
-
restrict WebAuthentication API to only top level browsing context w3c/webauthn#374 (1 comment by @AngeloKai)
-
18 pull requests opened.
-
fix 543: improve COSE_Key spec language and add COSE_Key examples w3c/webauthn#732, by @equalsJeffH.
-
fix #455: we are using CTAP canonical CBOR encoding form everywhere w3c/webauthn#731, by @equalsJeffH.
-
Fix #720: Align user handle management with CTAP w3c/webauthn#730, by @emlun.
-
fix 711 identifier internal slot contains credID w3c/webauthn#729, by @equalsJeffH.
-
fix broken {{PublicKeyCredentialEntity/id}} links to be.. w3c/webauthn#728, by @equalsJeffH.
-
Updated editors and acknowledgements w3c/webauthn#726, by @selfissued.
-
Adding CDDL to txAuthSimple w3c/webauthn#724, by @gmandyam.
-
Rework the FIDO AppID extension. w3c/webauthn#723, by @agl.
-
Change id -> ID w3c/webauthn#722, by @emlun.
-
Fix #720: Contradiction in whether user handle is required w3c/webauthn#721, by @emlun.
-
Fix #716: Add formal links to PublicKeyCredentialDescriptor description w3c/webauthn#719, by @emlun.
-
Fix #713: Define JSON deserialization w3c/webauthn#718, by @emlun.
-
Correct Android Key attestation verification procedure w3c/webauthn#717, by @arnar.
-
Specify that SHA-256 is used for hashing the client data. w3c/webauthn#710, by @agl.
-
move the credentialId uniqueness handling to the formal alg steps. w3c/webauthn#709, by @rlin1.
-
#420: Add note on why authenticator attachment is used only in create() w3c/webauthn#708, by @emlun.
-
fix #322: flesh out Security Considerations (for now) w3c/webauthn#705, by @equalsJeffH.
-
Resolve linking errors for WD-07 publication w3c/webauthn#703, by @AngeloKai.
-
-
13 pull requests merged.
-
move the credentialId uniqueness handling to the formal alg steps. w3c/webauthn#709.
-
fix 711 identifier internal slot contains credID w3c/webauthn#729.
-
fix broken {{PublicKeyCredentialEntity/id}} links to be.. w3c/webauthn#728.
-
Updated editors and acknowledgements w3c/webauthn#726.
-
Correct Android Key attestation verification procedure w3c/webauthn#717.
-
#420: Add note on why authenticator attachment is used only in create() w3c/webauthn#708.
-
Fix #720: Contradiction in whether user handle is required w3c/webauthn#721.
-
Specify that SHA-256 is used for hashing the client data. w3c/webauthn#710.
-
Fix issue #685 w3c/webauthn#686.
-
Change id -> ID w3c/webauthn#722.
-
Fix #716: Add formal links to PublicKeyCredentialDescriptor description w3c/webauthn#719.
-
CDDL description of location extension w3c/webauthn#695.
-
Resolve linking errors for WD-07 publication w3c/webauthn#703.
-
-
1 pull request closed.
-
Update the RP operation section to be "not normative" w3c/webauthn#664.
-
-
1 pull request reopened.
-
Fix #720: Align user handle management with CTAP w3c/webauthn#730, by @akshayku.
-
-
27 pull requests received 221 new comments.
-
Fix #622: Clarify PublicKeyCredentialEntity name descriptions w3c/webauthn#666 (29 comments by @akshayku, @emlun, @equalsJeffH, @rlin1)
-
Fix #720: Align user handle management with CTAP w3c/webauthn#730 (20 comments by @akshayku, @emlun, @equalsJeffH)
-
Fix #713: Define JSON deserialization w3c/webauthn#718 (18 comments by @emlun, @equalsJeffH, @jcjones)
-
fix #322: flesh out Security Considerations (for now) w3c/webauthn#705 (14 comments by @agl, @emlun, @equalsJeffH)
-
Resolve linking errors for WD-07 publication w3c/webauthn#703 (9 comments by @AngeloKai, @equalsJeffH, @jcjones)
-
Add privacy consideration about terminating getAssertion early w3c/webauthn#687 (8 comments by @emlun, @equalsJeffH)
-
Update the RP operation section to be "not normative" w3c/webauthn#664 (6 comments by @agl, @equalsJeffH, @nadalin, @rlin1)
-
move the credentialId uniqueness handling to the formal alg steps. w3c/webauthn#709 (5 comments by @equalsJeffH, @rlin1)
-
Specify that SHA-256 is used for hashing the client data. w3c/webauthn#710 (5 comments by @agl, @emlun)
-
#420: Add note on why authenticator attachment is used only in create() w3c/webauthn#708 (4 comments by @agl, @akshayku, @equalsJeffH)
-
Correct Android Key attestation verification procedure w3c/webauthn#717 (4 comments by @equalsJeffH, @rlin1)
-
Describe how authenticators unique and find credential sources. w3c/webauthn#623 (3 comments by @emlun, @equalsJeffH)
-
fix #455: we are using CTAP canonical CBOR encoding form everywhere w3c/webauthn#731 (2 comments by @akshayku, @equalsJeffH)
-
fix 711 identifier internal slot contains credID w3c/webauthn#729 (2 comments by @equalsJeffH, @rlin1)
-
Ask for tests for normative changes in CONTRIBUTING.md w3c/webauthn#653 (2 comments by @equalsJeffH, @foolip)
-
fix 543: improve COSE_Key spec language and add COSE_Key examples w3c/webauthn#732 (1 comment by @akshayku)
-
fix broken {{PublicKeyCredentialEntity/id}} links to be.. w3c/webauthn#728 (1 comment by @equalsJeffH)
-
Fix #716: Add formal links to PublicKeyCredentialDescriptor description w3c/webauthn#719 (1 comment by @jcjones)
GitHub
w3c/webauthn
-
11 issues opened.
-
add sameOriginWithAncestors parameter to internal methods w3c/webauthn#700, by @equalsJeffH.
-
Rename AuthenticatorSelectionCriteria.requireUserVerification to userVerification? w3c/webauthn#698, by @ttaubert.
-
define "blinding" w3c/webauthn#694, by @equalsJeffH.
-
Bug: getAssertion accidentally calls authenticatorGetAssertion in first factor mode w3c/webauthn#685, by @emlun.
-
Add CDDL to every extension w3c/webauthn#679, by @jcjones.
-
CollectedClientData should include a type marker w3c/webauthn#674, by @balfanz.
-
need to clean up "promise" language w3c/webauthn#671, by @equalsJeffH.
-
Recommend RPs to verify UP and UV flags w3c/webauthn#668, by @emlun.
-
37 issues closed.
-
add sameOriginWithAncestors parameter to internal methods w3c/webauthn#700.
-
Filter makeCredential() by acceptable trust anchors w3c/webauthn#396.
-
leverage "credential source" term from credential management spec w3c/webauthn#430.
-
.store() is confusing w3c/webauthn#551.
-
What does "which has no other operations in progress" mean in practice? w3c/webauthn#292.
-
CollectedClientData should include a type marker w3c/webauthn#674.
-
5.6. Authentication Extensions name confusing w3c/webauthn#648.
-
clarify isPlatformAuthenticatorAvailable's semantics w3c/webauthn#627.
-
Update definition of Authenticator to make it more similar to FIDO's def w3c/webauthn#606.
-
Attestation Data defines ECC key X, Y parameters two ways w3c/webauthn#509.
-
RawId vs Id is confusing w3c/webauthn#412.
-
Credential CBOR w3c/webauthn#366.
-
Define what happens when the Document loses focus w3c/webauthn#316.
-
Internationalization self review w3c/webauthn#210.
-
imageURL privacy w3c/webauthn#139.
-
impl guidelines for signature counter w3c/webauthn#125.
-
Make create() and get() abortable w3c/webauthn#537.
-
Should the WebAuth API have a cancel() method? w3c/webauthn#380.
-
revamped [[Create]]() method lacks origin argument w3c/webauthn#661.
-
fix #254: credman alignment: update #getAssertion section a la PR #498 w3c/webauthn#663.
-
need to clean up "promise" language w3c/webauthn#671.
-
Nothing required in PublicKeyCredentialEntity w3c/webauthn#587.
-
authenticatorMakeCredential operation credential filtering w3c/webauthn#650.
-
-
58 issues received 138 new comments.
-
#getAssertion alg needs to pass authenticator selection requirements to authenticatorGetAssertion operation w3c/webauthn#644 (11 comments by @akshayku, @emlun, @equalsJeffH)
-
attachment is only explicitly used in create() w3c/webauthn#420 (6 comments by @christiaanbrand, @emlun, @equalsJeffH, @nadalin)
-
#createCredential alg: "if options.authenticatorSelection is present..." may be incorrect w3c/webauthn#692 (6 comments by @emlun, @equalsJeffH)
-
Privacy concerns with blacklist/whitelist w3c/webauthn#184 (6 comments by @emlun, @equalsJeffH, @kpaulh)
-
Extensions need to define how their parameters convert to/from CBOR w3c/webauthn#626 (4 comments by @jcjones, @nadalin)
-
Crypto algorithm agility: e.g., Specify the set of hash algorithms UAs can select between. w3c/webauthn#362 (4 comments by @equalsJeffH, @nadalin, @rlin1, @selfissued)
-
WebAuthn available to Workers? aka "silent authentication" w3c/webauthn#199 (4 comments by @akshayku, @emlun, @equalsJeffH)
-
Define sensible limits for User and RP Entity to be stored on Authenticator as part of create credential w3c/webauthn#660 (4 comments by @akshayku, @equalsJeffH, @jovasco)
-
Authenticator selection extension - should makeCredential fail if no specified authenticator can be found? w3c/webauthn#227 (3 comments by @emlun, @equalsJeffH, @nadalin)
-
restrict WebAuthentication API to only top level browsing context w3c/webauthn#374 (3 comments by @equalsJeffH, @jcjones, @nadalin)
-
TPM Attestation Statement Format: Missing COSE Key algorithm Identifier and clarification. w3c/webauthn#689 (3 comments by @jyasskin, @selfissued)
-
CollectedClientData should include a type marker w3c/webauthn#674 (3 comments by @akshayku, @balfanz, @kpaulh)
-
explain challenge's security importance and use in both registration and authentication operations w3c/webauthn#404 (3 comments by @equalsJeffH, @jcjones, @kpaulh)
-
"credential ID" not signed over by authenticatorGetAssertion operation w3c/webauthn#394 (3 comments by @emlun, @nadalin, @rlin1)
-
Refine meaning of PublicKeyCredentialType to be "signature & assertion format (and version thereof)" w3c/webauthn#296 (3 comments by @equalsJeffH, @rlin1)
-
further details for authenticatorCancel operation w3c/webauthn#116 (3 comments by @equalsJeffH, @jcjones, @nadalin)
-
Rename AuthenticatorSelectionCriteria.requireUserVerification to userVerification? w3c/webauthn#698 (2 comments by @emlun, @jcjones)
-
Packed and U2F Attestation Statements' verifications don't differentiate between Basic and Privacy CA Attestation Types w3c/webauthn#656 (2 comments by @equalsJeffH, @jcjones)
-
clarify isPlatformAuthenticatorAvailable's semantics w3c/webauthn#627 (2 comments by @AngeloKai, @nadalin)
-
Update definition of Authenticator to make it more similar to FIDO's def w3c/webauthn#606 (2 comments by @rlin1)
-
Need to remove the term "authentication key" in self attestation description w3c/webauthn#590 (2 comments by @rlin1)
-
Add getAuthenticatorInfo to the Authenticator Model section w3c/webauthn#349 (2 comments by @AngeloKai, @rlin1)
-
detail-level issues in signature format, attestation format(s), attestation statement w3c/webauthn#233 (2 comments by @equalsJeffH, @rlin1)
-
Not necessary to pass AuthenticatorSelectionCriteria members to authenticatorMakeCredential() w3c/webauthn#524 (1 comment by @emlun)
-
leverage "credential source" term from credential management spec w3c/webauthn#430 (1 comment by @equalsJeffH)
-
No description regarding representation of credential Id length w3c/webauthn#570 (1 comment by @nadalin)
-
Android SafetyNet Attestation lacks information on authenticator provenance w3c/webauthn#438 (1 comment by @equalsJeffH)
-
Correct uses of "JSON string" versus "DOMString" and other string terminology usage w3c/webauthn#417 (1 comment by @nadalin)
-
Justify differences in TPM Attestation Verification procedures in WebAuthn versus TCG specifications w3c/webauthn#372 (1 comment by @nadalin)
-
define what to do if both normalizedAlgorithm and cryptoParameters are empty w3c/webauthn#361 (1 comment by @equalsJeffH)
-
What does "which has no other operations in progress" mean in practice? w3c/webauthn#292 (1 comment by @equalsJeffH)
-
CTAP/U2F doesn't status indicating the user cancelled the operation w3c/webauthn#658 (1 comment by @equalsJeffH)
-
-
25 pull requests opened.
-
fix #700 & #701: add same origin with ancestors param w3c/webauthn#702, by @equalsJeffH.
-
Resolve #698 - Rename requireUserVerification w3c/webauthn#699, by @jcjones.
-
fix comments in pre blocks and other linking errors w3c/webauthn#697, by @equalsJeffH.
-
Fix issue #692 w3c/webauthn#696, by @emlun.
-
CDDL description of location extension w3c/webauthn#695, by @gmandyam.
-
build on Adding a choice for RP to express preferences for attestation types w3c/webauthn#693, by @equalsJeffH.
-
New: Adding a choice for RP to express preferences for attestation types w3c/webauthn#691, by @christiaanbrand.
-
Update session management for BT w3c/webauthn#688, by @jovasco.
-
Add privacy consideration about terminating getAssertion early w3c/webauthn#687, by @emlun.
-
Fix issue #685 w3c/webauthn#686, by @emlun.
-
Tiny nit: "pair of cryptographic keys" instead of "set of cryptographic keys" w3c/webauthn#684, by @emlun.
-
Trust Anchor Selection Criteria w3c/webauthn#683, by @gmandyam.
-
Adding a type field to CollectedClientData w3c/webauthn#682, by @balfanz.
-
Fix #404 - Add a Security Consideration for Cryptographic Challenges w3c/webauthn#681, by @jcjones.
-
Clarify semantics of isPlatformAuthenticatorAvailable w3c/webauthn#680, by @balfanz.
-
Updated authnr def w3c/webauthn#678, by @rlin1.
-
use the registered ext ids in examples w3c/webauthn#677, by @rlin1.
-
replaced authentication key by credential private key. Close #590 w3c/webauthn#676, by @rlin1.
-
Fix uvm 368 w3c/webauthn#675, by @rlin1.
-
Fix #644: Add UV parameter to getAssertion w3c/webauthn#672, by @emlun.
-
Fix #668: Recommend RPs to verify UP and UV flags w3c/webauthn#670, by @emlun.
-
Fix #587: Make PublicKeyCredentialEntity members required in IDL w3c/webauthn#669, by @emlun.
-
Sensible limits for RP and User Entity fields. w3c/webauthn#667, by @akshayku.
-
-
24 pull requests merged.
-
fix #700 & #701: add same origin with ancestors param w3c/webauthn#702.
-
Resolve #698 - Rename requireUserVerification w3c/webauthn#699.
-
fix comments in pre blocks and other linking errors w3c/webauthn#697.
-
Fix issue #692 w3c/webauthn#696.
-
Fix #644: Add UV parameter to getAssertion w3c/webauthn#672.
-
New: Adding a choice for RP to express preferences for attestation types w3c/webauthn#691.
-
Fix #404 - Add a Security Consideration for Cryptographic Challenges w3c/webauthn#681.
-
Adding a type field to CollectedClientData w3c/webauthn#682.
-
Fix uvm 368 w3c/webauthn#675.
-
use the registered ext ids in examples w3c/webauthn#677.
-
Clarify semantics of isPlatformAuthenticatorAvailable w3c/webauthn#680.
-
Updated authnr def w3c/webauthn#678.
-
replaced authentication key by credential private key. Close #590 w3c/webauthn#676.
-
Modify SafetyNet descriptive text w3c/webauthn#643.
-
fix #254: credman alignment: update #getAssertion section a la PR #498 w3c/webauthn#665.
-
Make create() and get() abortable w3c/webauthn#544.
-
Fix #587: Make PublicKeyCredentialEntity members required in IDL w3c/webauthn#669.
-
Only exclude CredIDs matching the RPID w3c/webauthn#651.
-
Sensible limits for RP and User Entity fields. w3c/webauthn#667.
-
Define Public Key Credential Source and Credential ID. w3c/webauthn#620.
-
-
2 pull requests closed.
-
Trust Anchor Selection Criteria w3c/webauthn#683.
-
Adding a choice for RP to express preferences for attestation types w3c/webauthn#636.
-
-
27 pull requests received 412 new comments.
-
Fix #644: Add UV parameter to getAssertion w3c/webauthn#672 (104 comments by @akshayku, @balfanz, @christiaanbrand, @emlun, @equalsJeffH, @jcjones, @Kieun, @nadalin, @rlin1)
-
Adding a choice for RP to express preferences for attestation types w3c/webauthn#636 (71 comments by @agl, @akshayku, @balfanz, @christiaanbrand, @emlun, @equalsJeffH, @ghost, @jcjones, @nadalin, @rlin1)
-
build on Adding a choice for RP to express preferences for attestation types w3c/webauthn#693 (52 comments by @agl, @akshayku, @christiaanbrand, @emlun, @equalsJeffH, @gmandyam, @jcjones, @jyasskin, @nadalin, @rlin1)
-
Make create() and get() abortable w3c/webauthn#544 (49 comments by @AngeloKai, @equalsJeffH, @jcjones, @jyasskin)
-
fix #700 & #701: add same origin with ancestors param w3c/webauthn#702 (20 comments by @AngeloKai, @emlun, @equalsJeffH, @jcjones, @nadalin)
-
Define Public Key Credential Source and Credential ID. w3c/webauthn#620 (19 comments by @equalsJeffH, @jyasskin, @rlin1)
-
Sensible limits for RP and User Entity fields. w3c/webauthn#667 (18 comments by @akshayku, @emlun, @equalsJeffH, @jovasco, @jyasskin)
-
Update session management for BT w3c/webauthn#688 (14 comments by @akshayku, @AngeloKai, @equalsJeffH, @jcjones, @nadalin, @rlin1, @YubicoDemo, @yubicoderek)
-
Fix #622: Clarify PublicKeyCredentialEntity name descriptions w3c/webauthn#666 (11 comments by @emlun, @equalsJeffH, @rlin1)
-
Ask for tests for normative changes in CONTRIBUTING.md w3c/webauthn#653 (5 comments by @foolip, @jcjones, @kpaulh)
-
fix #254: credman alignment: update #getAssertion section a la PR #498 w3c/webauthn#665 (5 comments by @AngeloKai, @equalsJeffH, @nadalin)
-
Resolve #698 - Rename requireUserVerification w3c/webauthn#699 (4 comments by @AngeloKai, @emlun, @equalsJeffH, @jcjones)
-
Fix #404 - Add a Security Consideration for Cryptographic Challenges w3c/webauthn#681 (3 comments by @equalsJeffH, @jcjones, @kpaulh)
-
Fix #668: Recommend RPs to verify UP and UV flags w3c/webauthn#670 (3 comments by @emlun, @equalsJeffH)
-
Resolve #292 - Clarify that only one operation is permitted per authenticator session w3c/webauthn#673 (3 comments by @AngeloKai, @equalsJeffH, @gmandyam)
-
Only exclude CredIDs matching the RPID w3c/webauthn#651 (3 comments by @equalsJeffH, @jcjones, @jovasco)
-
Add privacy consideration about terminating getAssertion early w3c/webauthn#687 (2 comments by @emlun, @kpaulh)
-
Add RSASSA-PKCS1-v1_5 w/ SHA1 for TPM attestations and correct TPM signing/verification text w3c/webauthn#690 (1 comment by @nadalin)
-
Fix #587: Make PublicKeyCredentialEntity members required in IDL w3c/webauthn#669 (1 comment by @equalsJeffH)
-
Lifecycle
-
1 charter started.
-
Chartered until 15 September 2019.
-
GitHub
w3c/webauthn
-
31 issues opened.
-
fix #254: credman alignment: update #getAssertion section a la PR #498 w3c/webauthn#663, by @equalsJeffH.
-
revamped [[Create]]() method lacks origin argument w3c/webauthn#661, by @equalsJeffH.
-
Feature request: Add API for android finger print reader w3c/webauthn#659, by @BorntraegerMarc.
-
CTAP/U2F doesn't status indicating the user cancelled the operation w3c/webauthn#658, by @AngeloKai.
-
authenticatorMakeCredential: Only exclude CredIDs matching the RPID w3c/webauthn#654, by @equalsJeffH.
-
authenticatorMakeCredential operation credential filtering w3c/webauthn#650, by @jovasco.
-
Authenticator session not possible for BLE w3c/webauthn#649, by @jovasco.
-
5.6. Authentication Extensions name confusing w3c/webauthn#648, by @jovasco.
-
Privacy CA not defined or linked w3c/webauthn#647, by @jovasco.
-
Rename PublicKeyCredentialEntity fields w3c/webauthn#646, by @emlun.
-
First factor authenticator selection w3c/webauthn#640, by @Kieun.
-
clarify isPlatformAuthenticatorAvailable's semantics w3c/webauthn#627, by @balfanz.
-
Extensions need to define how their parameters convert to/from CBOR w3c/webauthn#626, by @jcjones.
-
Signature Counter needs to be mandatory in authenticationData w3c/webauthn#625, by @akshayku.
-
clientExtensionResults attribute cannot be a Record type w3c/webauthn#624, by @jcjones.
-
PublicKeyCredentialUserEntity difference between name, displayName and id not clear w3c/webauthn#622, by @jovasco.
-
Transaction authorization extensions are registration and authentication extension? w3c/webauthn#621, by @Kieun.
-
isPlatformAuthenticatorAvailable's examples imply it should be static w3c/webauthn#618, by @jcjones.
-
Allow hot-plugged authenticators? w3c/webauthn#613, by @emlun.
-
Per TCG: "privacy CA" is now "Attestation CA" w3c/webauthn#610, by @equalsJeffH.
-
technical & terminology issues with PR#558 Plumb User ID through w3c/webauthn#609, by @equalsJeffH.
-
Update CTAP references w3c/webauthn#608, by @apowers313.
-
Update definition of Authenticator to make it more similar to FIDO's def w3c/webauthn#606, by @rlin1.
-
Define how to verify the attestation certificate w3c/webauthn#605, by @jyasskin.
-
-
45 issues closed.
-
Incorrect feedback link in 20160531 WD w3c/webauthn#592.
-
Define how to verify the attestation certificate w3c/webauthn#605.
-
First factor authenticator selection w3c/webauthn#640.
-
Feature request: Add API for android finger print reader w3c/webauthn#659.
-
Rename PublicKeyCredentialEntity fields w3c/webauthn#646.
-
parameter lists in #createCredential and #op-make-cred do not match w3c/webauthn#536.
-
Not clear what's executed in parallel in Section 4.1.3, Step 24.3 w3c/webauthn#559.
-
Public Key Infrastructures and Web Authentication w3c/webauthn#521.
-
authenticatorMakeCredential: Only exclude CredIDs matching the RPID w3c/webauthn#654.
-
keyType: "public-key" is superfluous w3c/webauthn#554.
-
FIDO U2F Attestation Statement Format doesn't say what to do with AAGUID w3c/webauthn#506.
-
clientExtensionResults attribute cannot be a Record type w3c/webauthn#624.
-
#registering-a-new-credential step 10 breakage w3c/webauthn#561.
-
Add [Exposed] to all interfaces w3c/webauthn#569.
-
rename "attestation data" to be "attested credential" w3c/webauthn#393.
-
basicIntegrity in SafetyNet documentation not sufficiently defined w3c/webauthn#437.
-
ctsprofilematch in SafetyNet documentation not sufficiently defined w3c/webauthn#436.
-
Change user.id examples to binary encoding. w3c/webauthn#598.
-
Update CTAP references w3c/webauthn#608.
-
What does store() do? w3c/webauthn#415.
-
Spec should not mandate behavior of server w3c/webauthn#88.
-
Consider dropping requirement for TUP on create() w3c/webauthn#564.
-
Signature Counter needs to be mandatory in authenticationData w3c/webauthn#625.
-
include public key in result from create() w3c/webauthn#557.
-
#createCredential step 12 incorrectly refers to a timer w3c/webauthn#535.
-
authenticatorCancel seems like it can cancel too much w3c/webauthn#283.
-
isPlatformAuthenticatorAvailable's examples imply it should be static w3c/webauthn#618.
-
Key types and algorithms are confusing w3c/webauthn#547.
-
incosistent concatenation symbols - notational conventions section? w3c/webauthn#562.
-
Make packed attestation format Privacy CA-friendly w3c/webauthn#584.
-
technical & terminology issues with PR#558 Plumb User ID through w3c/webauthn#609.
-
CDDL for attStmtType is confusing w3c/webauthn#577.
-
user id should be returned in get() w3c/webauthn#556.
-
1 issue reopened.
-
.store() is confusing w3c/webauthn#551, by @equalsJeffH.
-
-
73 issues received 273 new comments.
-
Authenticator session not possible for BLE w3c/webauthn#649 (19 comments by @AngeloKai, @emlun, @equalsJeffH, @jovasco)
-
PublicKeyCredentialUserEntity difference between name, displayName and id not clear w3c/webauthn#622 (15 comments by @emlun, @equalsJeffH, @jovasco, @jyasskin)
-
credentials.get() should have optional parameters for userVerification and userPresence w3c/webauthn#629 (15 comments by @akshayku, @emlun, @equalsJeffH, @idamlaj, @nadalin)
-
Allow RPs to choose between "required" and "optional" attestation in credentials.create() w3c/webauthn#628 (15 comments by @agl, @balfanz, @emlun, @equalsJeffH, @Kieun, @ve7jtb)
-
First factor authenticator selection w3c/webauthn#640 (13 comments by @agl, @AngeloKai, @emlun, @equalsJeffH, @jovasco, @Kieun)
-
Consider dropping requirement for TUP on create() w3c/webauthn#564 (12 comments by @akshayku, @emlun, @equalsJeffH, @idamlaj, @jovasco, @nadalin, @rlin1, @selfissued)
-
Extensions need to define how their parameters convert to/from CBOR w3c/webauthn#626 (8 comments by @bzbarsky, @jyasskin, @selfissued)
-
Make packed attestation format Privacy CA-friendly w3c/webauthn#584 (8 comments by @akshayku, @Kieun, @nadalin, @selfissued, @ve7jtb)
-
CTAP/U2F doesn't status indicating the user cancelled the operation w3c/webauthn#658 (7 comments by @AngeloKai, @equalsJeffH, @jcjones, @jehrensvard, @nadalin)
-
Define sensible limits for User and RP Entity to be stored on Authenticator as part of create credential w3c/webauthn#660 (7 comments by @akshayku, @equalsJeffH, @jovasco, @jyasskin)
-
No way to select an intended authenticator during authentication with attachment info w3c/webauthn#583 (7 comments by @AngeloKai, @emlun, @Kieun)
-
preventSilentAccess() -- what effect does calling it have? w3c/webauthn#565 (6 comments by @AngeloKai, @equalsJeffH, @jcjones, @jyasskin, @leshi)
-
Transaction authorization extensions are registration and authentication extension? w3c/webauthn#621 (6 comments by @AngeloKai, @emlun, @Kieun)
-
Feature request: Add API for android finger print reader w3c/webauthn#659 (6 comments by @BorntraegerMarc, @emlun, @jyasskin)
-
Nothing required in PublicKeyCredentialEntity w3c/webauthn#587 (5 comments by @AngeloKai, @emlun, @equalsJeffH, @jyasskin, @YubicoDemo)
-
Define how to verify the attestation certificate w3c/webauthn#605 (5 comments by @AngeloKai, @arshadnoor, @nadalin, @SAHF)
-
restrict WebAuthentication API to only top level browsing context w3c/webauthn#374 (4 comments by @AngeloKai, @clelland, @equalsJeffH, @mikewest)
-
authenticatorMakeCredential operation credential filtering w3c/webauthn#650 (4 comments by @equalsJeffH, @nadalin)
-
FIDO U2F Attestation Statement Format doesn't say what to do with AAGUID w3c/webauthn#506 (4 comments by @equalsJeffH, @jcjones, @rlin1)
-
include public key in result from create() w3c/webauthn#557 (4 comments by @balfanz, @equalsJeffH, @jcjones, @rlin1)
-
clientExtensionResults attribute cannot be a Record type w3c/webauthn#624 (4 comments by @bzbarsky, @equalsJeffH, @jcjones)
-
where does return value of PublicKeyCredential.getClientExtensionResults() come from? w3c/webauthn#657 (3 comments by @equalsJeffH, @jcjones, @nadalin)
-
Rename PublicKeyCredentialEntity fields w3c/webauthn#646 (3 comments by @AngeloKai, @emlun, @jcjones)
-
keyType: "public-key" is superfluous w3c/webauthn#554 (3 comments by @equalsJeffH, @jcjones, @nadalin)
-
5.6. Authentication Extensions name confusing w3c/webauthn#648 (3 comments by @equalsJeffH, @jovasco, @selfissued)
-
#registering-a-new-credential step 10 breakage w3c/webauthn#561 (3 comments by @emlun, @equalsJeffH)
-
Not necessary to pass AuthenticatorSelectionCriteria members to authenticatorMakeCredential() w3c/webauthn#524 (3 comments by @emlun, @equalsJeffH)
-
parameter lists in #createCredential and #op-make-cred do not match w3c/webauthn#536 (3 comments by @equalsJeffH, @nadalin)
-
basicIntegrity in SafetyNet documentation not sufficiently defined w3c/webauthn#437 (3 comments by @equalsJeffH, @gmandyam, @ve7jtb)
-
Change user.id examples to binary encoding. w3c/webauthn#598 (3 comments by @christiaanbrand, @nadalin, @selfissued)
-
Key types and algorithms are confusing w3c/webauthn#547 (3 comments by @jcjones, @nadalin, @selfissued)
-
How should the browser handle CredentialMediationRequirement for public key credentials? w3c/webauthn#566 (3 comments by @equalsJeffH, @jyasskin)
-
Credential ID uniqueness expectations are inconsistent/vague w3c/webauthn#579 (2 comments by @AngeloKai, @emlun)
-
Need to fix android key attestation verification procedure w3c/webauthn#599 (2 comments by @AngeloKai)
-
Packed and U2F Attestation Statements' verifications don't differentiate between Basic and Privacy CA Attestation Types w3c/webauthn#656 (2 comments by @emlun, @Kieun)
-
Not clear what to do with cross platform authenticators during make-an-assertion step w3c/webauthn#574 (2 comments by @emlun, @jcjones)
-
FIDO U2F Attestation Statement Format doesn't say what to do with Counter w3c/webauthn#507 (2 comments by @nadalin, @rlin1)
-
`AuthenticationExtensions` typedef name is confusing; also there are issues with its description w3c/webauthn#471 (2 comments by @jcjones)
-
Update definition of Authenticator to make it more similar to FIDO's def w3c/webauthn#606 (2 comments by @nadalin, @rlin1)
-
No description regarding representation of credential Id length w3c/webauthn#570 (1 comment by @AngeloKai)
-
isUserVerifyingPlatformAuthenticatorAvailable() timeout really 10 minutes? w3c/webauthn#575 (1 comment by @AngeloKai)
-
Extension identifiers in examples are inconsistent with registered identifiers w3c/webauthn#588 (1 comment by @AngeloKai)
-
User Verification Method (uvm) extension incorrectly mentions user verification *index* w3c/webauthn#589 (1 comment by @AngeloKai)
-
Need to remove the term "authentication key" in self attestation description w3c/webauthn#590 (1 comment by @AngeloKai)
-
There is no "current settings object" in algorithm steps that are executing in parallel w3c/webauthn#254 (1 comment by @equalsJeffH)
-
authenticatorMakeCredential: Only exclude CredIDs matching the RPID w3c/webauthn#654 (1 comment by @equalsJeffH)
-
Specify how to handle authenticators that are plugged after registration/signing is requested w3c/webauthn#508 (1 comment by @equalsJeffH)
-
WebAuthn available to Workers? aka "silent authentication" w3c/webauthn#199 (1 comment by @equalsJeffH)
-
Android SafetyNet Attestation lacks information on authenticator provenance w3c/webauthn#438 (1 comment by @gmandyam)
-
ctsprofilematch in SafetyNet documentation not sufficiently defined w3c/webauthn#436 (1 comment by @equalsJeffH)
-
Privacy Considerations should describe risks of storing userID/displayName in "second-factor" authenticators w3c/webauthn#578 (1 comment by @equalsJeffH)
-
#createCredential step 12 incorrectly refers to a timer w3c/webauthn#535 (1 comment by @equalsJeffH)
-
Signature Counter needs to be mandatory in authenticationData w3c/webauthn#625 (1 comment by @rlin1)
-
What does "which has no other operations in progress" mean in practice? w3c/webauthn#292 (1 comment by @equalsJeffH)
-
detail-level issues in signature format, attestation format(s), attestation statement w3c/webauthn#233 (1 comment by @equalsJeffH)
-
-
36 pull requests opened.
-
Fix #622: Clarify PublicKeyCredentialEntity name descriptions w3c/webauthn#666, by @emlun.
-
fix #254: credman alignment: update #getAssertion section a la PR #498 w3c/webauthn#665, by @equalsJeffH.
-
Update the RP operation section to be "not normative" w3c/webauthn#664, by @AngeloKai.
-
Fix #574 - Change language for Create and Get to support hotplugging w3c/webauthn#655, by @jcjones.
-
Ask for tests for normative changes in CONTRIBUTING.md w3c/webauthn#653, by @foolip.
-
Only exclude CredIDs matching the RPID w3c/webauthn#651, by @jovasco.
-
Modify SafetyNet descriptive text w3c/webauthn#643, by @gmandyam.
-
Link "extension identifier" as requested in #602 w3c/webauthn#642, by @jyasskin.
-
clarified the ECDAA signing procedure. Close #591 w3c/webauthn#641, by @rlin1.
-
update CTAP ref with correct authors and URL w3c/webauthn#638, by @equalsJeffH.
-
Fix User.ID example w3c/webauthn#637, by @christiaanbrand.
-
Adding a choice for RP to express preferences for attestation types w3c/webauthn#636, by @balfanz.
-
Link attestation statement and -format in §6.1 step 10 w3c/webauthn#635, by @emlun.
-
Relaxing user prompt requirements in certain cases w3c/webauthn#634, by @balfanz.
-
Fix #624 - Change PublicKeyCredential.clientExtensionResults to an operation w3c/webauthn#633, by @jcjones.
-
Fix #569 - Add Exposed to all WebIDL interfaces w3c/webauthn#632, by @jcjones.
-
Fix #551 - Define a Store method for PublicKeyCredential. w3c/webauthn#631, by @jcjones.
-
Require authenticators to implement the signature counter w3c/webauthn#630, by @selfissued.
-
Describe how authenticators unique and find credential sources. w3c/webauthn#623, by @jyasskin.
-
Define Public Key Credential Source and Credential ID. w3c/webauthn#620, by @jyasskin.
-
Fix #618 - Make PublicKeyCredential.isPlatformAuthenticatorAvailable static w3c/webauthn#619, by @jcjones.
-
Remove [SameObject] from AuthenticatorAssertionResponse.userId w3c/webauthn#617, by @jcjones.
-
Fix #609: Formally define User Handle w3c/webauthn#616, by @emlun.
-
Use || uniformly for concatenation. w3c/webauthn#615, by @jyasskin.
-
Fix #393: Rename attestation data to attested credential data w3c/webauthn#614, by @emlun.
-
Tools: Add Vagrantfile for a VM with bikeshed installed w3c/webauthn#612, by @emlun.
-
Rewrite the "make an assertion" introduction to clarify how get() works. w3c/webauthn#611, by @jyasskin.
-
updated the definition of authenticator w3c/webauthn#607, by @rlin1.
-
Add a Relying Party conformance class. w3c/webauthn#604, by @jyasskin.
-
Name the parameters and variables in authenticatorGetAssertion. w3c/webauthn#603, by @jyasskin.
-
Name the parameters and variables in authenticatorMakeCredential. w3c/webauthn#602, by @jyasskin.
-
Number the steps in the authenticator operations. w3c/webauthn#601, by @jyasskin.
-
Rewrite Generating an Attestation Object as an algorithm. w3c/webauthn#600, by @jyasskin.
-
-
29 pull requests merged.
-
Fix #574 - Change language for Create and Get to support hotplugging w3c/webauthn#655.
-
clarified the ECDAA signing procedure. Close #591 w3c/webauthn#641.
-
fixup algs contd 3 w3c/webauthn#498.
-
Fix #561 w3c/webauthn#652.
-
Fix #569 - Add Exposed to all WebIDL interfaces w3c/webauthn#632.
-
Fix #393: Rename attestation data to attested credential data w3c/webauthn#614.
-
Link "extension identifier" as requested in #602 w3c/webauthn#642.
-
Fix User.ID example w3c/webauthn#637.
-
update CTAP ref with correct authors and URL w3c/webauthn#638.
-
Rewrite the "make an assertion" introduction to clarify how get() works. w3c/webauthn#611.
-
Link attestation statement and -format in §6.1 step 10 w3c/webauthn#635.
-
Fix #551 - Define a Store method for PublicKeyCredential. w3c/webauthn#631.
-
Name the parameters and variables in authenticatorMakeCredential. w3c/webauthn#602.
-
Add a Relying Party conformance class. w3c/webauthn#604.
-
Relaxing user prompt requirements in certain cases w3c/webauthn#634.
-
updated the definition of authenticator w3c/webauthn#607.
-
Require authenticators to implement the signature counter w3c/webauthn#630.
-
Sign counter alg clarification [see issue #507] w3c/webauthn#539.
-
Use || uniformly for concatenation. w3c/webauthn#615.
-
Rewrite Generating an Attestation Object as an algorithm. w3c/webauthn#600.
-
Fix #609: Formally define User Handle w3c/webauthn#616.
-
Tools: Add Vagrantfile for a VM with bikeshed installed w3c/webauthn#612.
-
Number the steps in the authenticator operations. w3c/webauthn#601.
-
Fix #577 - CDDL for attStmtTemplate is ambiguous w3c/webauthn#581.
-
Plumb User ID through w3c/webauthn#558.
-
4 pull requests closed.
-
Name the parameters and variables in authenticatorGetAssertion. w3c/webauthn#603.
-
Restore identifier alignment with CTAP and WD-06 w3c/webauthn#582.
-
Sign counter alg 507 alternative: optional sig counter w3c/webauthn#597.
-
Remove [SameObject] from AuthenticatorAssertionResponse.userId w3c/webauthn#617.
-
-
36 pull requests received 341 new comments.
-
Define Public Key Credential Source and Credential ID. w3c/webauthn#620 (47 comments by @emlun, @equalsJeffH, @jovasco, @jyasskin, @mikewest, @nadalin, @rlin1)
-
Make create() and get() abortable w3c/webauthn#544 (36 comments by @AngeloKai, @annevk, @equalsJeffH, @jakearchibald, @jcjones, @nadalin)
-
Only exclude CredIDs matching the RPID w3c/webauthn#651 (28 comments by @akshayku, @emlun, @equalsJeffH, @jcjones, @jovasco, @nadalin)
-
Fix #560: ensure #registering-a-new-credential step 10 and the inputs to all attStmt types' verification procedures match w3c/webauthn#639 (23 comments by @emlun, @equalsJeffH, @jcjones)
-
Rewrite the "make an assertion" introduction to clarify how get() works. w3c/webauthn#611 (21 comments by @equalsJeffH, @jyasskin)
-
Fix #609: Formally define User Handle w3c/webauthn#616 (18 comments by @emlun, @jcjones, @jyasskin, @nadalin)
-
Fix #574 - Change language for Create and Get to support hotplugging w3c/webauthn#655 (17 comments by @AngeloKai, @equalsJeffH, @jcjones)
-
Name the parameters and variables in authenticatorMakeCredential. w3c/webauthn#602 (15 comments by @equalsJeffH, @jcjones, @jyasskin)
-
Describe how authenticators unique and find credential sources. w3c/webauthn#623 (14 comments by @equalsJeffH, @jyasskin, @nadalin, @rlin1)
-
Rewrite Generating an Attestation Object as an algorithm. w3c/webauthn#600 (9 comments by @equalsJeffH, @jyasskin)
-
Fix #622: Clarify PublicKeyCredentialEntity name descriptions w3c/webauthn#666 (7 comments by @emlun, @jovasco)
-
Fix #393: Rename attestation data to attested credential data w3c/webauthn#614 (7 comments by @emlun, @equalsJeffH, @nadalin)
-
Name the parameters and variables in authenticatorGetAssertion. w3c/webauthn#603 (7 comments by @equalsJeffH, @jcjones, @jyasskin)
-
Sign counter alg 507 alternative: optional sig counter w3c/webauthn#597 (6 comments by @equalsJeffH, @jehrensvard, @rlin1, @ve7jtb)
-
Update the RP operation section to be "not normative" w3c/webauthn#664 (4 comments by @AngeloKai, @jcjones, @jyasskin)
-
Ask for tests for normative changes in CONTRIBUTING.md w3c/webauthn#653 (3 comments by @foolip, @jcjones)
-
Fix #624 - Change PublicKeyCredential.clientExtensionResults to an operation w3c/webauthn#633 (3 comments by @bzbarsky, @nadalin)
-
Fix #569 - Add Exposed to all WebIDL interfaces w3c/webauthn#632 (3 comments by @AngeloKai, @nadalin)
-
Tools: Add Vagrantfile for a VM with bikeshed installed w3c/webauthn#612 (3 comments by @emlun, @jcjones)
-
Relaxing user prompt requirements in certain cases w3c/webauthn#634 (2 comments by @akshayku, @balfanz)
-
Restore identifier alignment with CTAP and WD-06 w3c/webauthn#582 (2 comments by @equalsJeffH, @selfissued)
-
Fix #618 - Make PublicKeyCredential.isPlatformAuthenticatorAvailable static w3c/webauthn#619 (2 comments by @jcjones, @jyasskin)
-
Sign counter alg clarification [see issue #507] w3c/webauthn#539 (2 comments by @jyasskin, @selfissued)
-
Remove [SameObject] from AuthenticatorAssertionResponse.userId w3c/webauthn#617 (2 comments by @jcjones, @jyasskin)
-
fix #254: credman alignment: update #getAssertion section a la PR #498 w3c/webauthn#665 (1 comment by @jcjones)
-
fix #657: where does return value of PublicKeyCredential.getClientExtensionResults() come from? w3c/webauthn#662 (1 comment by @jcjones)
-
Fix #551 - Define a Store method for PublicKeyCredential. w3c/webauthn#631 (1 comment by @AngeloKai)
-
Participants
-
1 organization joined.
-
Wiley joined.
-
GitHub
w3c/webauthn
-
41 issues opened.
-
Need to fix android key attestation verification procedure w3c/webauthn#599, by @Kieun.
-
Change user.id examples to binary encoding. w3c/webauthn#598, by @christiaanbrand.
-
Examples should include non-ASCII [editorial] w3c/webauthn#594, by @r12a.
-
Display name content rules? w3c/webauthn#593, by @r12a.
-
Incorrect feedback link in 20160531 WD w3c/webauthn#592, by @r12a.
-
Description of attestation signature generation for ECDAA needs to be fixed. w3c/webauthn#591, by @Kieun.
-
Need to remove the term "authentication key" in self attestation description w3c/webauthn#590, by @Kieun.
-
Extension identifiers in examples are inconsistent with registered identifiers w3c/webauthn#588, by @manger.
-
Nothing required in PublicKeyCredentialEntity w3c/webauthn#587, by @apowers313.
-
address needs of various webauthn spec audiences w3c/webauthn#585, by @equalsJeffH.
-
Make packed attestation format Privacy CA-friendly w3c/webauthn#584, by @balfanz.
-
No way to select an intended authenticator during authentication with attachment info w3c/webauthn#583, by @Kieun.
-
Credential ID uniqueness expectations are inconsistent/vague w3c/webauthn#579, by @emlun.
-
CDDL for attStmtType is confusing w3c/webauthn#577, by @jcjones.
-
RP guidelines should allow RP to not check attestation w3c/webauthn#576, by @jyasskin.
-
isUserVerifyingPlatformAuthenticatorAvailable() timeout really 10 minutes? w3c/webauthn#575, by @christiaanbrand.
-
Not clear what to do with cross platform authenticators during make-an-assertion step w3c/webauthn#574, by @leshi.
-
No description regarding representation of credential Id length w3c/webauthn#570, by @Kieun.
-
Add [Exposed] to all interfaces w3c/webauthn#569, by @annevk.
-
Where are rsaAlgName and eccAlgName defined? w3c/webauthn#568, by @emlun.
-
preventSilentAccess() -- what effect does calling it have? w3c/webauthn#565, by @leshi.
-
Consider dropping requirement for TUP on create() w3c/webauthn#564, by @balfanz.
-
Safetynet attestation does not return byte array as a response. w3c/webauthn#563, by @Kieun.
-
incosistent concatenation symbols - notational conventions section? w3c/webauthn#562, by @equalsJeffH.
-
#registering-a-new-credential step 10 breakage w3c/webauthn#561, by @equalsJeffH.
-
Not clear what's executed in parallel in Section 4.1.3, Step 24.3 w3c/webauthn#559, by @balfanz.
-
include public key in result from create() w3c/webauthn#557, by @balfanz.
-
user id should be returned in get() w3c/webauthn#556, by @balfanz.
-
keyType: "public-key" is superfluous w3c/webauthn#554, by @balfanz.
-
.store() is confusing w3c/webauthn#551, by @leshi.
-
should authenticatorExtensions really be a dictionary? w3c/webauthn#550, by @balfanz.
-
"Authenticator extension processing" is likely wrong w3c/webauthn#548, by @leshi.
-
Key types and algorithms are confusing w3c/webauthn#547, by @balfanz.
-
musings wrt webauthn's profile of COSE_Key w3c/webauthn#543, by @equalsJeffH.
-
-
22 issues closed.
-
"Authenticator extension processing" is likely wrong w3c/webauthn#548.
-
Safetynet attestation does not return byte array as a response. w3c/webauthn#563.
-
Make U2F Attestation Format "sig" more precise w3c/webauthn#530.
-
Where are rsaAlgName and eccAlgName defined? w3c/webauthn#568.
-
should authenticatorExtensions really be a dictionary? w3c/webauthn#550.
-
[PR 384] Does requireUserMediation() make sense after merge w3c/webauthn#402.
-
New research suggest using ED512 instead of ED256. w3c/webauthn#101.
-
Consider using USVString instead of DOMString sometimes w3c/webauthn#166.
-
"might be present on this authenticator" could use a clearer definition w3c/webauthn#280.
-
Drop UAF references in favor of better explanation w3c/webauthn#217.
-
Specify what happens when the Client receives invalid CBOR w3c/webauthn#469.
-
The W3C HTML spec is broken, and probably shouldn't be referenced w3c/webauthn#257.
-
Consider allowing authenticators to randomise signed hashes. w3c/webauthn#453.
-
-
2 issues reopened.
-
Credential ID uniqueness expectations are inconsistent/vague w3c/webauthn#579, by @emlun.
-
Consider requiring canonical CBOR throughout w3c/webauthn#455, by @selfissued.
-
-
69 issues received 210 new comments.
-
include public key in result from create() w3c/webauthn#557 (19 comments by @akshayku, @AngeloKai, @balfanz, @emlun, @idamlaj, @jyasskin, @leshi, @nadalin)
-
Credential ID uniqueness expectations are inconsistent/vague w3c/webauthn#579 (15 comments by @akshayku, @christiaanbrand, @emlun, @jovasco, @Kieun, @ve7jtb)
-
Consider dropping requirement for TUP on create() w3c/webauthn#564 (10 comments by @akshayku, @balfanz, @christiaanbrand, @nadalin)
-
basicIntegrity in SafetyNet documentation not sufficiently defined w3c/webauthn#437 (10 comments by @gmandyam, @jyasskin, @nadalin, @selfissued, @ve7jtb)
-
PublicKeyCredentialDescriptor.id and PublicKeyCredentialEntity.id type differ w3c/webauthn#504 (10 comments by @AngeloKai, @nadalin, @yackermann)
-
user id should be returned in get() w3c/webauthn#556 (9 comments by @akshayku, @AngeloKai, @christiaanbrand, @emlun, @nadalin, @rlin1)
-
keyType: "public-key" is superfluous w3c/webauthn#554 (8 comments by @balfanz, @equalsJeffH, @leshi, @nadalin, @rlin1)
-
.store() is confusing w3c/webauthn#551 (6 comments by @AngeloKai, @christiaanbrand, @jyasskin, @mikewest, @nadalin)
-
Consider requiring canonical CBOR throughout w3c/webauthn#455 (6 comments by @agl, @jovasco, @selfissued)
-
Where are rsaAlgName and eccAlgName defined? w3c/webauthn#568 (5 comments by @akshayku, @rlin1, @selfissued)
-
restrict WebAuthentication API to only top level browsing context w3c/webauthn#374 (5 comments by @AngeloKai, @equalsJeffH, @leshi, @nadalin)
-
The W3C HTML spec is broken, and probably shouldn't be referenced w3c/webauthn#257 (5 comments by @AngeloKai, @bzbarsky, @nadalin, @tabatkins)
-
#registering-a-new-credential step 10 breakage w3c/webauthn#561 (4 comments by @emlun, @equalsJeffH, @nadalin)
-
Not necessary to pass AuthenticatorSelectionCriteria members to authenticatorMakeCredential() w3c/webauthn#524 (4 comments by @AngeloKai, @equalsJeffH, @rlin1)
-
Consider allowing authenticators to randomise signed hashes. w3c/webauthn#453 (4 comments by @agl, @AngeloKai)
-
Not clear what's executed in parallel in Section 4.1.3, Step 24.3 w3c/webauthn#559 (3 comments by @AngeloKai, @equalsJeffH, @nadalin)
-
It would be nice if the definition of "Scoped Credential" said something about what `identifier` and `type` are w3c/webauthn#248 (3 comments by @AngeloKai, @equalsJeffH, @nadalin)
-
musings wrt webauthn's profile of COSE_Key w3c/webauthn#543 (3 comments by @akshayku, @AngeloKai, @equalsJeffH)
-
"Authenticator extension processing" is likely wrong w3c/webauthn#548 (2 comments by @nadalin, @selfissued)
-
authenticatorMakeCredential has an excludeCredentialDescriptorList parameter, but doesn't do anything with it w3c/webauthn#567 (2 comments by @christiaanbrand, @leshi)
-
Refine meaning of PublicKeyCredentialType to be "signature & assertion format (and version thereof)" w3c/webauthn#296 (2 comments by @equalsJeffH, @nadalin)
-
should authenticatorExtensions really be a dictionary? w3c/webauthn#550 (2 comments by @balfanz, @nadalin)
-
Android SafetyNet Attestation lacks information on authenticator provenance w3c/webauthn#438 (2 comments by @nadalin, @ve7jtb)
-
#createCredential step 12 incorrectly refers to a timer w3c/webauthn#535 (2 comments by @nadalin, @yackermann)
-
need description & illustrations of overall flow: authnr <--> platform API <--> RP w3c/webauthn#24 (2 comments by @AngeloKai, @equalsJeffH)
-
Authenticator selection extension needs to define snapshotting behavior w3c/webauthn#294 (2 comments by @bzbarsky, @nadalin)
-
makeCredential should be more precise than NotAllowedError in its last step w3c/webauthn#376 (2 comments by @nadalin, @selfissued)
-
New research suggest using ED512 instead of ED256. w3c/webauthn#101 (2 comments by @nadalin, @selfissued)
-
Consider using USVString instead of DOMString sometimes w3c/webauthn#166 (2 comments by @nadalin, @selfissued)
-
Drop UAF references in favor of better explanation w3c/webauthn#217 (2 comments by @equalsJeffH, @nadalin)
-
FIDO U2F Attestation Statement Format doesn't say what to do with AAGUID w3c/webauthn#506 (2 comments by @AngeloKai, @selfissued)
-
note that "credential public key" is the same as "user's public key" w3c/webauthn#540 (2 comments by @akshayku, @AngeloKai)
-
Must returned extensions be mathematically proper subsets of requested extensions? w3c/webauthn#541 (2 comments by @AngeloKai, @emlun)
-
Privacy Considerations should describe risks of storing userID/displayName in "second-factor" authenticators w3c/webauthn#578 (1 comment by @ve7jtb)
-
Not clear what to do with cross platform authenticators during make-an-assertion step w3c/webauthn#574 (1 comment by @akshayku)
-
How should the browser handle CredentialMediationRequirement for public key credentials? w3c/webauthn#566 (1 comment by @balfanz)
-
isUserVerifyingPlatformAuthenticatorAvailable() timeout really 10 minutes? w3c/webauthn#575 (1 comment by @kpaulh)
-
[PR 384] Does requireUserMediation() make sense after merge w3c/webauthn#402 (1 comment by @AngeloKai)
-
Safetynet attestation does not return byte array as a response. w3c/webauthn#563 (1 comment by @AngeloKai)
-
An issue about setAttestationChallenge() in "android-key" attestation statement w3c/webauthn#456 (1 comment by @christiaanbrand)
-
Move {#sample-scenarios} (currently Section 10) to the top of the doc w3c/webauthn#301 (1 comment by @nadalin)
-
The authenticatorMakeCredential operation section doesn't specify how to pass extensions to authenticator w3c/webauthn#549 (1 comment by @leshi)
-
ctsprofilematch in SafetyNet documentation not sufficiently defined w3c/webauthn#436 (1 comment by @nadalin)
-
"WebAuthn Authenticator model" seemingly prohibits random AAGUIDs (minor) w3c/webauthn#452 (1 comment by @nadalin)
-
Correct uses of "JSON string" versus "DOMString" and other string terminology usage w3c/webauthn#417 (1 comment by @nadalin)
-
Propose procedure for adding to attestation/extension registry w3c/webauthn#303 (1 comment by @nadalin)
-
Authenticator selection extension - should makeCredential fail if no specified authenticator can be found? w3c/webauthn#227 (1 comment by @nadalin)
-
"might be present on this authenticator" could use a clearer definition w3c/webauthn#280 (1 comment by @equalsJeffH)
-
parameter lists in #createCredential and #op-make-cred do not match w3c/webauthn#536 (1 comment by @equalsJeffH)
-
Specify what happens when the Client receives invalid CBOR w3c/webauthn#469 (1 comment by @AngeloKai)
-
authenticatorGetAssertion showing selection UI for external authenticators w3c/webauthn#231 (1 comment by @AngeloKai)
-
-
16 pull requests opened.
-
Sign counter alg 507 alternative: optional sig counter w3c/webauthn#597, by @rlin1.
-
Corrected inaccuracy in authenticator extension processing description w3c/webauthn#596, by @selfissued.
-
Fix syntax errors in JavaScript examples. w3c/webauthn#595, by @futureimperfect.
-
Make user.id a byte array w3c/webauthn#586, by @selfissued.
-
Restore identifier alignment with CTAP and WD-06 w3c/webauthn#582, by @selfissued.
-
Fix #577 - CDDL for attStmtTemplate is ambiguous w3c/webauthn#581, by @jcjones.
-
Clean up COSEAlgorithmIdentifier loose ends w3c/webauthn#580, by @selfissued.
-
Clarify excludeCredentialDescriptorList w3c/webauthn#573, by @christiaanbrand.
-
Clarify Safetynet attestation return value w3c/webauthn#572, by @christiaanbrand.
-
Clarifying signing procedure for U2F attestation w3c/webauthn#571, by @balfanz.
-
Plumb User ID through w3c/webauthn#558, by @christiaanbrand.
-
using descriptive names for authenticator selection criteria w3c/webauthn#555, by @balfanz.
-
Remove user agent getting user consent sentence w3c/webauthn#553, by @leshi.
-
Fix Android attestation w3c/webauthn#546, by @christiaanbrand.
-
Address security and privacy issues witht the iconURL w3c/webauthn#545, by @AngeloKai.
-
Make create() and get() abortable w3c/webauthn#544, by @AngeloKai.
-
-
12 pull requests merged.
-
Corrected inaccuracy in authenticator extension processing description w3c/webauthn#596.
-
Fix syntax errors in JavaScript examples. w3c/webauthn#595.
-
Clarify Safetynet attestation return value w3c/webauthn#572.
-
Clarifying signing procedure for U2F attestation w3c/webauthn#571.
-
Make user.id a byte array w3c/webauthn#586.
-
Clean up COSEAlgorithmIdentifier loose ends w3c/webauthn#580.
-
Clarify excludeCredentialDescriptorList w3c/webauthn#573.
-
Address security and privacy issues witht the iconURL w3c/webauthn#545.
-
Fix Android attestation w3c/webauthn#546.
-
using descriptive names for authenticator selection criteria w3c/webauthn#555.
-
Remove user agent getting user consent sentence w3c/webauthn#553.
-
Remove "proper subset" from extension algorithm w3c/webauthn#542.
-
-
1 pull request reopened.
-
Plumb User ID through w3c/webauthn#558, by @christiaanbrand.
-
-
18 pull requests received 175 new comments.
-
Sign counter alg clarification [see issue #507] w3c/webauthn#539 (95 comments by @agl, @akshayku, @christiaanbrand, @emlun, @equalsJeffH, @jehrensvard, @jovasco, @leshi, @nadalin, @rlin1, @ve7jtb)
-
Plumb User ID through w3c/webauthn#558 (29 comments by @akshayku, @christiaanbrand, @emlun, @jovasco, @jyasskin, @leshi, @nadalin, @selfissued, @wseltzer)
-
Address security and privacy issues witht the iconURL w3c/webauthn#545 (8 comments by @AngeloKai, @equalsJeffH, @jyasskin, @leshi, @nadalin)
-
using descriptive names for authenticator selection criteria w3c/webauthn#555 (2 comments by @equalsJeffH, @leshi)
-
Remove user agent getting user consent sentence w3c/webauthn#553 (2 comments by @equalsJeffH, @nadalin)
-
TR publications
-
1 document published.
Participants
-
1 organization joined.
-
Trust1Team joined.
-
-
1 organization left.
-
360 left.
-
GitHub
w3c/webauthn
-
15 issues opened.
-
Must returned extensions be mathematically proper subsets of requested extensions? w3c/webauthn#541, by @emlun.
-
note that "credential public key" is the same as "user's public key" w3c/webauthn#540, by @equalsJeffH.
-
Should the "name" field in PublicKeyCredentialEntity be marked required? w3c/webauthn#538, by @kpaulh.
-
Make create() and get() abortable w3c/webauthn#537, by @balfanz.
-
parameter lists in #createCredential and #op-make-cred do not match w3c/webauthn#536, by @equalsJeffH.
-
#createCredential step 12 incorrectly refers to a timer w3c/webauthn#535, by @equalsJeffH.
-
Make U2F Attestation Format "sig" more precise w3c/webauthn#530, by @jcjones.
-
Include Constants for COSE Algorithm Numbers w3c/webauthn#529, by @jcjones.
-
revise approach of isPlatformAuthenticatorAvailable() w3c/webauthn#527, by @equalsJeffH.
-
Conflicting definition of AlgorithmIdentifier w3c/webauthn#526, by @dontcallmedom.
-
Public Key Infrastructures and Web Authentication w3c/webauthn#521, by @AdamSobieski.
-
do not need to normalize web crypto params any longer w3c/webauthn#520, by @equalsJeffH.
-
Update Attestation Object figure to match the spec w3c/webauthn#518, by @selfissued.
-
document why only "valid domain" format is allowed for "effective domain" w3c/webauthn#517, by @equalsJeffH.
-
-
17 issues closed.
-
Should the "name" field in PublicKeyCredentialEntity be marked required? w3c/webauthn#538.
-
Clarify meaning of UVI w3c/webauthn#156.
-
Enable web developers to migrate keys from one domain to another w3c/webauthn#458.
-
Pre-Registration Discovery w3c/webauthn#503.
-
Conflicting definition of AlgorithmIdentifier w3c/webauthn#526.
-
revise approach of isPlatformAuthenticatorAvailable() w3c/webauthn#527.
-
do not need to normalize web crypto params any longer w3c/webauthn#520.
-
Update Attestation Object figure to match the spec w3c/webauthn#518.
-
Is AlgorithmIdentifier value a string or an object? w3c/webauthn#512.
-
restrict webauthn support to "valid domains" ? w3c/webauthn#474.
-
Add "willMakeCredentialWorkWithTheseConstraints()" method to the API w3c/webauthn#345.
-
requireUserVerification option in AuthenticatorSelectionCriteria w3c/webauthn#459.
-
-
1 issue reopened.
-
Attestation Data defines ECC key X, Y parameters two ways w3c/webauthn#509, by @AngeloKai.
-
-
48 issues received 97 new comments.
-
Consider requiring canonical CBOR throughout w3c/webauthn#455 (7 comments by @agl, @jovasco, @jyasskin)
-
FIDO U2F Attestation Statement Format doesn't say what to do with Counter w3c/webauthn#507 (6 comments by @agl, @AngeloKai, @equalsJeffH, @nadalin, @rlin1)
-
Enable web developers to migrate keys from one domain to another w3c/webauthn#458 (5 comments by @AngeloKai, @arshadnoor, @equalsJeffH, @jyasskin, @selfissued)
-
Should the WebAuth API have a cancel() method? w3c/webauthn#380 (4 comments by @AngeloKai, @jakearchibald, @mikewest)
-
Should the "name" field in PublicKeyCredentialEntity be marked required? w3c/webauthn#538 (3 comments by @AngeloKai, @equalsJeffH)
-
adopt consistent terms for RP server-side and client-side components w3c/webauthn#80 (3 comments by @AngeloKai, @equalsJeffH, @nadalin)
-
Not necessary to pass AuthenticatorSelectionCriteria members to authenticatorMakeCredential() w3c/webauthn#524 (3 comments by @equalsJeffH, @nadalin, @selfissued)
-
What does "which has no other operations in progress" mean in practice? w3c/webauthn#292 (3 comments by @equalsJeffH, @nadalin)
-
Update Attestation Object figure to match the spec w3c/webauthn#518 (3 comments by @nadalin, @selfissued)
-
further details for authenticatorCancel operation w3c/webauthn#116 (2 comments by @AngeloKai, @equalsJeffH)
-
Consider allowing authenticators to randomise signed hashes. w3c/webauthn#453 (2 comments by @equalsJeffH, @rlin1)
-
undefined terms and terms we really ought to define w3c/webauthn#462 (2 comments by @AngeloKai, @equalsJeffH)
-
clarify normality of authenticator model - is it actually authenticator API ? w3c/webauthn#176 (2 comments by @equalsJeffH, @nadalin)
-
update extensions framework to include interfacing with user agent permissions framework w3c/webauthn#133 (2 comments by @equalsJeffH, @nadalin)
-
normalizing term(s) for authenticator-generated RP-specific public key w3c/webauthn#79 (2 comments by @equalsJeffH, @nadalin)
-
FIDO U2F Attestation Statement Format doesn't say what to do with AAGUID w3c/webauthn#506 (2 comments by @kpaulh, @nadalin)
-
Attestation Data defines ECC key X, Y parameters two ways w3c/webauthn#509 (2 comments by @AngeloKai)
-
restrict webauthn support to "valid domains" ? w3c/webauthn#474 (2 comments by @equalsJeffH, @jcjones)
-
PublicKeyCredentialRequestOptions and MakeCredentialOptions could both inherit from a dictionary which has their shared members w3c/webauthn#278 (2 comments by @jcjones, @jyasskin)
-
Must returned extensions be mathematically proper subsets of requested extensions? w3c/webauthn#541 (1 comment by @AngeloKai)
-
restrict WebAuthentication API to only top level browsing context w3c/webauthn#374 (1 comment by @AngeloKai)
-
leverage "credential source" term from credential management spec w3c/webauthn#430 (1 comment by @AngeloKai)
-
Authenticator Selection Extension - Client Processing - Clarification w3c/webauthn#95 (1 comment by @equalsJeffH)
-
need description & illustrations of overall flow: authnr <--> platform API <--> RP w3c/webauthn#24 (1 comment by @nadalin)
-
There is no "current settings object" in algorithm steps that are executing in parallel w3c/webauthn#254 (1 comment by @equalsJeffH)
-
Add getAuthenticatorInfo to the Authenticator Model section w3c/webauthn#349 (1 comment by @selfissued)
-
Update README.md to include more specific instructions for spec submission w3c/webauthn#492 (1 comment by @AngeloKai)
-
Add "willMakeCredentialWorkWithTheseConstraints()" method to the API w3c/webauthn#345 (1 comment by @selfissued)
-
-
14 pull requests opened.
-
Remove "proper subset" from extension algorithm w3c/webauthn#542, by @AngeloKai.
-
Sign counter alg clarification [see issue #507] w3c/webauthn#539, by @rlin1.
-
Updated steps for creating working drafts w3c/webauthn#534, by @AngeloKai.
-
add WD06 link to editor's draft w3c/webauthn#533, by @AngeloKai.
-
add WD06 publish dir w3c/webauthn#532, by @AngeloKai.
-
revision and polishing of the merged isPlatformAuthenticatorAvailable PR #379 w3c/webauthn#528, by @equalsJeffH.
-
Register COSE Algorithm numbers for RSASSA-PKCS1-v1_5 w3c/webauthn#525, by @selfissued.
-
Fixed the example and other points listed in isPlatformAuthenticatorReady comment w3c/webauthn#523, by @AngeloKai.
-
nomalizedAlgorithm->credTypesAndPubKeyAlgs w3c/webauthn#522, by @equalsJeffH.
-
cose key fixups w3c/webauthn#519, by @equalsJeffH.
-
Add a script to update .spec-data, and update the data. w3c/webauthn#516, by @jcjones.
-
Restrict WebAuthn support to valid domains w3c/webauthn#515, by @selfissued.
-
Use COSE_Key and COSE Algorithm Identifiers w3c/webauthn#514, by @selfissued.
-
-
12 pull requests merged.
-
Updated steps for creating working drafts w3c/webauthn#534.
-
add WD06 link to editor's draft w3c/webauthn#533.
-
add WD06 publish dir w3c/webauthn#532.
-
Register COSE Algorithm numbers for RSASSA-PKCS1-v1_5 w3c/webauthn#525.
-
nomalizedAlgorithm->credTypesAndPubKeyAlgs w3c/webauthn#522.
-
Use COSE_Key and COSE Algorithm Identifiers w3c/webauthn#514.
-
Restrict WebAuthn support to valid domains w3c/webauthn#515.
-
Add isPlatformAuthenticatorReady function to the API surface w3c/webauthn#379.
-
Adds requireUserVerification option in AuthenticatorSelectionCriteria w3c/webauthn#460.
-
Add a script to update .spec-data, and update the data. w3c/webauthn#516.
-
-
2 pull requests closed.
-
cose key fixups w3c/webauthn#519.
-
10 pull requests received 76 new comments.
-
Add isPlatformAuthenticatorReady function to the API surface w3c/webauthn#379 (35 comments by @AngeloKai, @balfanz, @equalsJeffH, @kpaulh, @leshi, @mikewest, @selfissued)
-
Sign counter alg clarification [see issue #507] w3c/webauthn#539 (18 comments by @agl, @akshayku, @AngeloKai, @equalsJeffH, @jcjones, @rlin1)
-
Use COSE_Key and COSE Algorithm Identifiers w3c/webauthn#514 (10 comments by @equalsJeffH, @nadalin, @selfissued)
-
revision and polishing of the merged isPlatformAuthenticatorAvailable PR #379 w3c/webauthn#528 (2 comments by @equalsJeffH, @selfissued)
-
Fixed the example and other points listed in isPlatformAuthenticatorReady comment w3c/webauthn#523 (1 comment by @equalsJeffH)
-
Participants
-
1 organization joined.
-
Airbnb Inc joined.
-
-
1 organization left.
-
Plantronics, Inc. left.
-
GitHub
w3c/webauthn
-
7 issues opened.
-
Is AlgorithmIdentifier value a string or an object? w3c/webauthn#512, by @selfissued.
-
Attestation Data defines ECC key X, Y parameters two ways w3c/webauthn#509, by @jcjones.
-
FIDO U2F Attestation Statement Format doesn't say what to do with Counter w3c/webauthn#507, by @jcjones.
-
FIDO U2F Attestation Statement Format doesn't say what to do with AAGUID w3c/webauthn#506, by @jcjones.
-
PublicKeyCredentialDescriptor.id and PublicKeyCredentialEntity.id type differ w3c/webauthn#504, by @yackermann.
-
Pre-Registration Discovery w3c/webauthn#503, by @hillbrad.
-
-
6 issues closed.
-
MakeCredentialOptions should be MakePublicKeyCredentialOptions w3c/webauthn#488.
-
MakeCredentialOptions.parameters needs more precise name w3c/webauthn#473.
-
denote current Web Authentication spec as "Level 1" w3c/webauthn#475.
-
Section 4.1.4 Use Existing Credential "get" w3c/webauthn#480.
-
15 issues received 34 new comments.
-
Pre-Registration Discovery w3c/webauthn#503 (7 comments by @AngeloKai, @arshadnoor, @devd, @equalsJeffH, @hillbrad, @rlin1)
-
PublicKeyCredentialDescriptor.id and PublicKeyCredentialEntity.id type differ w3c/webauthn#504 (5 comments by @equalsJeffH, @yackermann)
-
MakeCredentialOptions should be MakePublicKeyCredentialOptions w3c/webauthn#488 (4 comments by @jcjones, @nadalin, @selfissued)
-
MakeCredentialOptions.parameters needs more precise name w3c/webauthn#473 (3 comments by @nadalin, @selfissued)
-
Add getAuthenticatorInfo to the Authenticator Model section w3c/webauthn#349 (3 comments by @AngeloKai, @equalsJeffH)
-
PublicKeyCredentialRequestOptions and MakeCredentialOptions could both inherit from a dictionary which has their shared members w3c/webauthn#278 (2 comments by @jcjones, @nadalin)
-
There is no "current settings object" in algorithm steps that are executing in parallel w3c/webauthn#254 (2 comments by @equalsJeffH, @nadalin)
-
Specify how to handle authenticators that are plugged after registration/signing is requested w3c/webauthn#508 (1 comment by @pzboyz)
-
FIDO U2F Attestation Statement Format doesn't say what to do with Counter w3c/webauthn#507 (1 comment by @agl)
-
FIDO U2F Attestation Statement Format doesn't say what to do with AAGUID w3c/webauthn#506 (1 comment by @agl)
-
-
4 pull requests opened.
-
PublicKeyCredentialParameters parameter name is alg - not algorithm w3c/webauthn#513, by @selfissued.
-
Biometric Criteria Extension w3c/webauthn#510, by @gmandyam.
-
-
5 pull requests merged.
-
PublicKeyCredentialParameters parameter name is alg - not algorithm w3c/webauthn#513.
-
Fix typo. w3c/webauthn#505.
-
fixup algs contd 2 w3c/webauthn#495.
-
-
3 pull requests received 26 new comments.
-
Add isPlatformAuthenticatorReady function to the API surface w3c/webauthn#379 (12 comments by @equalsJeffH, @jcjones, @selfissued)
-
Adds requireUserVerification option in AuthenticatorSelectionCriteria w3c/webauthn#460 (11 comments by @AngeloKai, @equalsJeffH, @gmandyam, @leshi, @nadalin, @selfissued)
-
add requireResidentKey param to the invocation step of authenticatorMakeCredential w3c/webauthn#502 (3 comments by @equalsJeffH, @selfissued)
-
Participants
-
1 participant left.
-
Michel Weksler (Airbnb Inc) left.
-
GitHub
w3c/webauthn
-
10 issues opened.
-
Cloud Based "Phone Token" Option w3c/webauthn#496, by @cyberphone.
-
complete terminology cleanup from PR #427 w3c/webauthn#494, by @equalsJeffH.
-
Update README.md to include more specific instructions for spec submission w3c/webauthn#492, by @AngeloKai.
-
various issues with AppId extension w3c/webauthn#491, by @equalsJeffH.
-
CredentialCreationOptions can't have a nullable MakeCredentialOptions w3c/webauthn#490, by @qdot.
-
MakeCredentialOptions should be MakePublicKeyCredentialOptions w3c/webauthn#488, by @equalsJeffH.
-
Public draft images return 404 w3c/webauthn#486, by @yackermann.
-
requireResidentKey param missing from invocation of authenticatorMakeCredential w3c/webauthn#485, by @equalsJeffH.
-
17 issues closed.
-
Add Rate Limiting definition to terminology section w3c/webauthn#483.
-
Cloud Based "Phone Token" Option w3c/webauthn#496.
-
Add acceptable trust anchors to AuthenticatorSelectionCriteria w3c/webauthn#461.
-
complete terminology cleanup from PR #427 w3c/webauthn#494.
-
U2F Attestation only lists Basic Attestation as supported w3c/webauthn#392.
-
CredentialCreationOptions can't have a nullable MakeCredentialOptions w3c/webauthn#490.
-
hashAlg -> hashAlgorithm? w3c/webauthn#326.
-
Too generic names? w3c/webauthn#329.
-
References to "algorithm" and "alg" should be same string w3c/webauthn#351.
-
Public draft images return 404 w3c/webauthn#486.
-
Consider empty allowLists w3c/webauthn#387.
-
Some editing cleanup following cred man merge w3c/webauthn#414.
-
-
2 issues reopened.
-
33 issues received 115 new comments.
-
credential ID returned by authenticatorGetAssertion() is optional if allowList has exactly one member w3c/webauthn#472 (13 comments by @bzbarsky, @domenic, @equalsJeffH)
-
Public draft images return 404 w3c/webauthn#486 (10 comments by @AngeloKai, @equalsJeffH, @jyasskin, @wseltzer, @yackermann)
-
Add acceptable trust anchors to AuthenticatorSelectionCriteria w3c/webauthn#461 (8 comments by @AngeloKai, @equalsJeffH, @gmandyam, @jyasskin)
-
CredentialCreationOptions can't have a nullable MakeCredentialOptions w3c/webauthn#490 (6 comments by @battre, @equalsJeffH, @jyasskin)
-
restrict WebAuthentication API to only top level browsing context w3c/webauthn#374 (5 comments by @AngeloKai, @equalsJeffH)
-
credentialList needs to be non-empty in order to call authenticatorGetAssertion w3c/webauthn#481 (5 comments by @equalsJeffH, @rlin1)
-
remove "required" on ScopedCredentialDescriptor.id w3c/webauthn#245 (4 comments by @AngeloKai, @equalsJeffH)
-
There is no "current settings object" in algorithm steps that are executing in parallel w3c/webauthn#254 (4 comments by @bzbarsky, @equalsJeffH)
-
do not totally lose the term "WebAuthn Relying Party" w3c/webauthn#180 (3 comments by @AngeloKai, @equalsJeffH, @selfissued)
-
An issue about setAttestationChallenge() in "android-key" attestation statement w3c/webauthn#456 (3 comments by @AngeloKai, @equalsJeffH)
-
Privacy section may wish to discuss recommended user-agent responses to leaks w3c/webauthn#454 (3 comments by @AngeloKai, @equalsJeffH)
-
excludeList/allowList can be defaulted to a zero-length sequence in IDL instead of prose w3c/webauthn#268 (2 comments by @equalsJeffH)
-
update #credentialcreationoptions-extension & #credentialrequestoptions-extension section titles w3c/webauthn#497 (2 comments by @AngeloKai, @equalsJeffH)
-
authenticatorMakeCredential() description of input PublicKeyCredential objects is incorrect w3c/webauthn#468 (2 comments by @equalsJeffH)
-
[PR 384] Does requireUserMediation() make sense after merge w3c/webauthn#402 (2 comments by @AngeloKai, @equalsJeffH)
-
be explict about "same user" is verified at get() time as was verified at create() time w3c/webauthn#493 (2 comments by @AngeloKai, @equalsJeffH)
-
Some editing cleanup following cred man merge w3c/webauthn#414 (2 comments by @equalsJeffH, @kpaulh)
-
explain challenge's security importance and use in both registration and authentication operations w3c/webauthn#404 (2 comments by @AngeloKai, @equalsJeffH)
-
Specify what happens when the Client receives invalid CBOR w3c/webauthn#469 (2 comments by @AngeloKai)
-
Various attributes of ScopedCredentialInfo should probably be [SameObject] w3c/webauthn#285 (1 comment by @equalsJeffH)
-
MakeCredentialOptions.parameters needs more precise name w3c/webauthn#473 (1 comment by @yackermann)
-
Enable web developers to migrate keys from one domain to another w3c/webauthn#458 (1 comment by @AngeloKai)
-
web-api: is further language needed describing AppID (aka rpId) usage ? w3c/webauthn#8 (1 comment by @equalsJeffH)
-
-
8 pull requests opened.
-
add requireResidentKey param to the invocation step of authenticatorMakeCredential w3c/webauthn#502, by @AngeloKai.
-
Merge {#sample-scenarios} section with the {#usecase} section w3c/webauthn#501, by @AngeloKai.
-
remove "required" from PublicKeyCredentialDescriptor.id w3c/webauthn#500, by @AngeloKai.
-
Add Rate Limiting definition to terminology section w3c/webauthn#499, by @gmandyam.
-
fixup algs contd 3 w3c/webauthn#498, by @equalsJeffH.
-
fixup algs contd 2 w3c/webauthn#495, by @equalsJeffH.
-
cleanup easy issues WD-06 w3c/webauthn#489, by @equalsJeffH.
-
Omitted default abstract header w3c/webauthn#487, by @yackermann.
-
-
4 pull requests merged.
-
Add Rate Limiting definition to terminology section w3c/webauthn#499.
-
Omitted default abstract header w3c/webauthn#487.
-
cleanup easy issues WD-06 w3c/webauthn#489.
-
address empty allowlist in 'use existing cred' alg, fixes #387 w3c/webauthn#427.
-
-
1 pull request closed.
-
Add Rate Limiting and Trust Path to authnr selection criteria w3c/webauthn#484.
-
-
15 pull requests received 115 new comments.
-
cleanup easy issues WD-06 w3c/webauthn#489 (27 comments by @AngeloKai, @battre, @equalsJeffH, @jcjones, @jovasco, @jyasskin, @kpaulh, @selfissued)
-
Add isPlatformAuthenticatorReady function to the API surface w3c/webauthn#379 (21 comments by @AngeloKai, @equalsJeffH, @mikewest)
-
Add Rate Limiting and Trust Path to authnr selection criteria w3c/webauthn#484 (16 comments by @equalsJeffH, @gmandyam, @jyasskin, @nadalin, @selfissued)
-
address empty allowlist in 'use existing cred' alg, fixes #387 w3c/webauthn#427 (6 comments by @equalsJeffH, @rlin1)
-
Add Rate Limiting definition to terminology section w3c/webauthn#499 (4 comments by @equalsJeffH, @gmandyam)
-
remove "required" from PublicKeyCredentialDescriptor.id w3c/webauthn#500 (3 comments by @equalsJeffH)
-
add requireResidentKey param to the invocation step of authenticatorMakeCredential w3c/webauthn#502 (2 comments by @equalsJeffH, @jyasskin)
-
Merge {#sample-scenarios} section with the {#usecase} section w3c/webauthn#501 (1 comment by @AngeloKai)
-
Adds requireUserVerification option in AuthenticatorSelectionCriteria w3c/webauthn#460 (1 comment by @equalsJeffH)
-
TR publications
-
1 document published.
Participants
-
1 participant left.
-
Olive Xu (W3C) left.
-
-
1 organization joined.
-
SoftBank Corp. joined.
-
GitHub
w3c/webauthn
-
33 issues opened.
-
Add Rate Limiting definition to terminology section w3c/webauthn#483, by @gmandyam.
-
credentialList needs to be non-empty in order to call authenticatorGetAssertion w3c/webauthn#481, by @rlin1.
-
Section 4.1.4 Use Existing Credential "get" w3c/webauthn#480, by @rlin1.
-
Move aaguidList from extensions to AuthenticatorSelectionCriteria w3c/webauthn#478, by @rlin1.
-
denote current Web Authentication spec as "Level 1" w3c/webauthn#475, by @equalsJeffH.
-
restrict webauthn support to "valid domains" ? w3c/webauthn#474, by @equalsJeffH.
-
MakeCredentialOptions.parameters needs more precise name w3c/webauthn#473, by @equalsJeffH.
-
Specify what happens when the Client receives invalid CBOR w3c/webauthn#469, by @jyasskin.
-
ensure non-native Signature Assertions are passed-through w3c/webauthn#465, by @equalsJeffH.
-
undefined terms and terms we really ought to define w3c/webauthn#462, by @equalsJeffH.
-
Add acceptable trust anchors to AuthenticatorSelectionCriteria w3c/webauthn#461, by @jyasskin.
-
requireUserVerification option in AuthenticatorSelectionCriteria w3c/webauthn#459, by @leshi.
-
Enable web developers to migrate keys from one domain to another w3c/webauthn#458, by @AngeloKai.
-
An issue about setAttestationChallenge() in "android-key" attestation statement w3c/webauthn#456, by @caileb2017.
-
Consider requiring canonical CBOR throughout w3c/webauthn#455, by @agl.
-
Privacy section may wish to discuss recommended user-agent responses to leaks w3c/webauthn#454, by @agl.
-
Consider allowing authenticators to randomise signed hashes. w3c/webauthn#453, by @agl.
-
"WebAuthn Authenticator model" seemingly prohibits random AAGUIDs (minor) w3c/webauthn#452, by @agl.
-
Add required matcher protection to AuthenticatorSelectionCriteria w3c/webauthn#447, by @gmandyam.
-
Add required key protection to AuthenticatorSelectionCriteria w3c/webauthn#446, by @gmandyam.
-
Add biometric accuracy to AuthenticatorSelectionCriteria w3c/webauthn#445, by @gmandyam.
-
Make AuthenticatorSelectionCriteria more complete. w3c/webauthn#441, by @rlin1.
-
linking errors in master as of commit b7aac16 w3c/webauthn#439, by @equalsJeffH.
-
Android SafetyNet Attestation lacks information on authenticator provenance w3c/webauthn#438, by @gmandyam.
-
basicIntegrity in SafetyNet documentation not sufficiently defined w3c/webauthn#437, by @gmandyam.
-
ctsprofilematch in SafetyNet documentation not sufficiently defined w3c/webauthn#436, by @gmandyam.
-
figure 3 contains "daaKey" - should be "ecdaaKeyId" w3c/webauthn#434, by @equalsJeffH.
-
ECDAA verification algorithm in TPM Attestation Statement Format w3c/webauthn#433, by @sjparkRaon.
-
-
20 issues closed.
-
hostname canonicalization in {#makeCredential} section? w3c/webauthn#167.
-
rpID seems to have changed meaning a bit w3c/webauthn#416.
-
Setting _rpId_ to _callerOrigin_ doesn't make sense w3c/webauthn#255.
-
tokenBinding member of ClientData should be tokenBindingId w3c/webauthn#323.
-
"NotAllowedError" is in WebIDL editors draft but not in WebIDL Level 1 w3c/webauthn#305.
-
cleanup: attestation object `attObj` format not clearly delineated w3c/webauthn#395.
-
figure 3 contains "daaKey" - should be "ecdaaKeyId" w3c/webauthn#434.
-
Add keyStorage enum to ScopedCredentialOptions w3c/webauthn#367.
-
linking errors in master as of commit b7aac16 w3c/webauthn#439.
-
Track rename issues to maintain consistency w3c/webauthn#353.
-
"ScopedCred" enum should be "scoped-cred" w3c/webauthn#328.
-
Rename ScopedCredential to PublicKeyCredential w3c/webauthn#406.
-
attObj and Figure 3 [[#fig-attStructs]] do not agree w3c/webauthn#401.
-
"authentication" attribute on Navigator should be [SecureContext] w3c/webauthn#250.
-
Why was PR #409 (UV bit) merged? w3c/webauthn#424.
-
-
55 issues received 116 new comments.
-
Replace Authenticator Model with CTAP w3c/webauthn#410 (9 comments by @AngeloKai, @equalsJeffH, @jyasskin, @selfissued)
-
Add getAuthenticatorInfo to the Authenticator Model section w3c/webauthn#349 (6 comments by @AngeloKai, @equalsJeffH, @jyasskin, @selfissued)
-
Define what happens when the Document loses focus w3c/webauthn#316 (5 comments by @equalsJeffH, @jcjones, @jyasskin)
-
Add required matcher protection to AuthenticatorSelectionCriteria w3c/webauthn#447 (4 comments by @jyasskin, @rlin1)
-
Add required key protection to AuthenticatorSelectionCriteria w3c/webauthn#446 (4 comments by @gmandyam, @jyasskin, @rlin1)
-
WebAuthn available to Workers? aka "silent authentication" w3c/webauthn#199 (4 comments by @equalsJeffH, @mikewest)
-
credentialList needs to be non-empty in order to call authenticatorGetAssertion w3c/webauthn#481 (3 comments by @equalsJeffH, @rlin1)
-
authenticatorMakeCredential() description of input PublicKeyCredentialType and cryptographic parameters is imprecise w3c/webauthn#467 (3 comments by @AngeloKai, @jcjones, @selfissued)
-
Enable web developers to migrate keys from one domain to another w3c/webauthn#458 (3 comments by @AngeloKai, @AxelNennker, @equalsJeffH)
-
Crypto algorithm agility: e.g., Specify the set of hash algorithms UAs can select between. w3c/webauthn#362 (3 comments by @equalsJeffH, @jyasskin, @samuelweiler)
-
clarify normality of authenticator model - is it actually authenticator API ? w3c/webauthn#176 (3 comments by @equalsJeffH)
-
MakeCredentialOptions.parameters needs more precise name w3c/webauthn#473 (3 comments by @equalsJeffH, @jyasskin, @selfissued)
-
Should the WebAuth API have a cancel() method? w3c/webauthn#380 (2 comments by @equalsJeffH, @jyasskin)
-
hostname canonicalization in {#makeCredential} section? w3c/webauthn#167 (2 comments by @equalsJeffH)
-
remove "required" on ScopedCredentialDescriptor.id w3c/webauthn#245 (2 comments by @equalsJeffH, @jcjones)
-
`AuthenticationExtensions` typedef name is confusing; also there are issues with its description w3c/webauthn#471 (2 comments by @equalsJeffH)
-
[[Create]](options) method does not need to call authenticatorMakeCredential() with separate |rpId| w3c/webauthn#466 (2 comments by @equalsJeffH, @selfissued)
-
What does "which has no other operations in progress" mean in practice? w3c/webauthn#292 (2 comments by @equalsJeffH)
-
rename "attestation data" to be "attested credential" w3c/webauthn#393 (2 comments by @rlin1, @selfissued)
-
Protect against TLS MiTM by including TLS cert chain in signature w3c/webauthn#391 (2 comments by @agl, @equalsJeffH)
-
Some editing cleanup following cred man merge w3c/webauthn#414 (2 comments by @equalsJeffH, @mikewest)
-
Android SafetyNet Attestation lacks information on authenticator provenance w3c/webauthn#438 (2 comments by @equalsJeffH, @gmandyam)
-
basicIntegrity in SafetyNet documentation not sufficiently defined w3c/webauthn#437 (2 comments by @equalsJeffH, @gmandyam)
-
ctsprofilematch in SafetyNet documentation not sufficiently defined w3c/webauthn#436 (2 comments by @equalsJeffH, @gmandyam)
-
Add "willMakeCredentialWorkWithTheseConstraints()" method to the API w3c/webauthn#345 (1 comment by @AngeloKai)
-
Is _rpId_ supposed to look like an origin serialization, or like a hostname? w3c/webauthn#259 (1 comment by @equalsJeffH)
-
"NotAllowedError" is in WebIDL editors draft but not in WebIDL Level 1 w3c/webauthn#305 (1 comment by @equalsJeffH)
-
"credential ID" not signed over by authenticatorGetAssertion operation w3c/webauthn#394 (1 comment by @equalsJeffH)
-
authenticatorMakeCredential() description of input PublicKeyCredential objects is incorrect w3c/webauthn#468 (1 comment by @equalsJeffH)
-
References to "algorithm" and "alg" should be same string w3c/webauthn#351 (1 comment by @selfissued)
-
Various attributes of ScopedCredentialInfo should probably be [SameObject] w3c/webauthn#285 (1 comment by @jyasskin)
-
U2F Attestation only lists Basic Attestation as supported w3c/webauthn#392 (1 comment by @equalsJeffH)
-
detail-level issues in signature format, attestation format(s), attestation statement w3c/webauthn#233 (1 comment by @equalsJeffH)
-
Refine meaning of PublicKeyCredentialType to be "signature & assertion format (and version thereof)" w3c/webauthn#296 (1 comment by @equalsJeffH)
-
requireUserVerification option in AuthenticatorSelectionCriteria w3c/webauthn#459 (1 comment by @selfissued)
-
Why is the only value of ScopedCredentialType "ScopedCred" as opposed to "ScopedCredential"? w3c/webauthn#291 (1 comment by @jyasskin)
-
What extension data is in AuthenticatorAssertionResponse.authenticatorData? w3c/webauthn#418 (1 comment by @equalsJeffH)
-
"authentication" attribute on Navigator should be [SecureContext] w3c/webauthn#250 (1 comment by @equalsJeffH)
-
-
20 pull requests opened.
-
Add Rate Limiting and Trust Path to authnr selection criteria w3c/webauthn#484, by @gmandyam.
-
Add Rate Limiting flag to auth selection criteria w3c/webauthn#482, by @gmandyam.
-
Authnr selection aaguidlist w3c/webauthn#479, by @rlin1.
-
Authnr sel matcherprotection w3c/webauthn#477, by @rlin1.
-
Authnr sel keyprotection w3c/webauthn#476, by @rlin1.
-
Normalize RFC2119 langugage w3c/webauthn#470, by @AngeloKai.
-
reconciling origin and RP ID handling w3c/webauthn#464, by @equalsJeffH.
-
redraw fig 3, polish attestation & assertion signature definitions and prose w3c/webauthn#463, by @equalsJeffH.
-
Adds requireUserVerification option in AuthenticatorSelectionCriteria w3c/webauthn#460, by @leshi.
-
Typo fixes w3c/webauthn#451, by @agl.
-
Added new WD05 link w3c/webauthn#450, by @AngeloKai.
-
Remove QuotaExceededError from spec w3c/webauthn#449, by @AngeloKai.
-
Fix all linking errors and address isue 439 w3c/webauthn#448, by @AngeloKai.
-
Process 2017 w3c/webauthn#444, by @wseltzer.
-
update to Process 2017 w3c/webauthn#443, by @wseltzer.
-
move AAGUID for selecting authnr into new AuthenticatorSelectionCriteria w3c/webauthn#442, by @rlin1.
-
Create .pr-preview.json -- set up 'pr-preview' w3c/webauthn#440, by @equalsJeffH.
-
s/daaKey/ecdaaKeyId/ in fig 3 w3c/webauthn#435, by @equalsJeffH.
-
public key cred - fixes #406 w3c/webauthn#432, by @equalsJeffH.
-
-
14 pull requests merged.
-
reconciling origin and RP ID handling w3c/webauthn#464.
-
Fix typo. w3c/webauthn#457.
-
Typo fixes w3c/webauthn#451.
-
Added new WD05 link w3c/webauthn#450.
-
Remove QuotaExceededError from spec w3c/webauthn#449.
-
Fix all linking errors and address isue 439 w3c/webauthn#448.
-
update to Process 2017 w3c/webauthn#443.
-
Create .pr-preview.json -- set up 'pr-preview' w3c/webauthn#440.
-
Process 2017 w3c/webauthn#444.
-
public key cred - fixes #406 w3c/webauthn#432.
-
repair fig 3 - fix #401 w3c/webauthn#426.
-
Remove UV bit from authenticatorData w3c/webauthn#431.
-
-
5 pull requests closed.
-
Add Rate Limiting flag to auth selection criteria w3c/webauthn#482.
-
move AAGUID for selecting authnr into new AuthenticatorSelectionCriteria w3c/webauthn#442.
-
s/daaKey/ecdaaKeyId/ in fig 3 w3c/webauthn#435.
-
-
21 pull requests received 262 new comments.
-
reconciling origin and RP ID handling w3c/webauthn#464 (74 comments by @AngeloKai, @battre, @equalsJeffH, @jcjones, @jyasskin, @selfissued)
-
3rd approach: Add authenticator selection dictionary to create with attachment w3c/webauthn#429 (71 comments by @AngeloKai, @equalsJeffH, @gmandyam, @jyasskin, @rlin1)
-
public key cred - fixes #406 w3c/webauthn#432 (31 comments by @AngeloKai, @equalsJeffH, @jyasskin, @leshi, @nadalin, @rlin1, @selfissued)
-
Adds requireUserVerification option in AuthenticatorSelectionCriteria w3c/webauthn#460 (9 comments by @AngeloKai, @equalsJeffH, @jyasskin, @leshi, @selfissued)
-
move AAGUID for selecting authnr into new AuthenticatorSelectionCriteria w3c/webauthn#442 (7 comments by @equalsJeffH, @jyasskin, @rlin1, @selfissued)
-
address empty allowlist in 'use existing cred' alg, fixes #387 w3c/webauthn#427 (5 comments by @equalsJeffH, @jyasskin)
-
redraw fig 3, polish attestation & assertion signature definitions and prose w3c/webauthn#463 (4 comments by @jyasskin)
-
Create .pr-preview.json -- set up 'pr-preview' w3c/webauthn#440 (3 comments by @equalsJeffH, @jcjones)
-
GitHub
w3c/webauthn
-
25 issues opened.
-
leverage "credential source" term from credential management spec w3c/webauthn#430, by @equalsJeffH.
-
Why was PR #409 (UV bit) merged? w3c/webauthn#424, by @leshi.
-
authenticator taxonomy w3c/webauthn#422, by @equalsJeffH.
-
attachment is only explicitly used in create() w3c/webauthn#420, by @equalsJeffH.
-
What extension data is in AuthenticatorAssertionResponse.authenticatorData? w3c/webauthn#418, by @jyasskin.
-
rpID seems to have changed meaning a bit w3c/webauthn#416, by @leshi.
-
What does store() do? w3c/webauthn#415, by @leshi.
-
Some editing cleanup following cred man merge w3c/webauthn#414, by @kpaulh.
-
Account information merge w3c/webauthn#413, by @leshi.
-
RawId vs Id is confusing w3c/webauthn#412, by @leshi.
-
UVM should be "method" rather than "mode" ? w3c/webauthn#411, by @equalsJeffH.
-
Replace Authenticator Model with CTAP w3c/webauthn#410, by @jyasskin.
-
Rename ScopedCredential to PublicKeyCredential w3c/webauthn#406, by @jyasskin.
-
some RPs may wish to allow multiple registrations to same user account w3c/webauthn#403, by @equalsJeffH.
-
[PR 384] Does requireUserMediation() make sense after merge w3c/webauthn#402, by @leshi.
-
attObj and Figure 3 [[#fig-attStructs]] do not agree w3c/webauthn#401, by @equalsJeffH.
-
How to unmarshal in TPM Structure. w3c/webauthn#400, by @sjparkRaon.
-
Filter makeCredential() by acceptable trust anchors w3c/webauthn#396, by @jyasskin.
-
cleanup: attestation object `attObj` format not clearly delineated w3c/webauthn#395, by @equalsJeffH.
-
"credential ID" not signed over by authenticatorGetAssertion operation w3c/webauthn#394, by @equalsJeffH.
-
rename "attestation data" to be "attested credential" w3c/webauthn#393, by @equalsJeffH.
-
U2F Attestation only lists Basic Attestation as supported w3c/webauthn#392, by @rlin1.
-
-
19 issues closed.
-
Account information merge w3c/webauthn#413.
-
Define extension client processing more carefully. w3c/webauthn#363.
-
refine extension terminology w3c/webauthn#122.
-
Processing model for extensions is very underdefined w3c/webauthn#270.
-
UVM should be "method" rather than "mode" ? w3c/webauthn#411.
-
Should the "authentication" attribute on Navigator be [SameObject]? w3c/webauthn#249.
-
How to unmarshal in TPM Structure. w3c/webauthn#400.
-
DOMString[] should be FrozenArray<DOMString> w3c/webauthn#165.
-
Add cloud transport option to transport hint w3c/webauthn#331.
-
What ensures any semblance of interop for WebAuthnExtensions? w3c/webauthn#290.
-
Expose standard authenticator fields in JS objects, vs. binary w3c/webauthn#337.
-
Add explanation of why the account argument is useful w3c/webauthn#219.
-
Update attestation format identifiers in registry to match spec w3c/webauthn#300.
-
80 issues received 205 new comments.
-
Account information merge w3c/webauthn#413 (12 comments by @AngeloKai, @equalsJeffH, @leshi, @mikewest, @selfissued)
-
explain challenge's security importance and use in both registration and authentication operations w3c/webauthn#404 (11 comments by @AngeloKai, @equalsJeffH, @jyasskin, @mikewest, @vijaybh)
-
authenticatorCancel seems like it can cancel too much w3c/webauthn#283 (9 comments by @bzbarsky, @equalsJeffH, @kpaulh, @selfissued)
-
DOMString[] should be FrozenArray<DOMString> w3c/webauthn#165 (8 comments by @AngeloKai, @domenic, @equalsJeffH, @selfissued)
-
Should the "authentication" attribute on Navigator be [SameObject]? w3c/webauthn#249 (6 comments by @bzbarsky, @equalsJeffH, @mikewest, @selfissued)
-
Various attributes of ScopedCredentialInfo should probably be [SameObject] w3c/webauthn#285 (6 comments by @AngeloKai, @bzbarsky, @equalsJeffH, @selfissued)
-
Fetch intergration for WebAuthn API w3c/webauthn#354 (5 comments by @AngeloKai, @jyasskin, @mikewest, @selfissued)
-
Client arguments should be specified with "partial dictionary AuthenticationExtensions" w3c/webauthn#346 (4 comments by @jyasskin, @selfissued)
-
Consider empty allowLists w3c/webauthn#387 (4 comments by @equalsJeffH, @jyasskin, @selfissued, @vijaybh)
-
Add "willMakeCredentialWorkWithTheseConstraints()" method to the API w3c/webauthn#345 (4 comments by @mikewest, @vijaybh)
-
Refine meaning of PublicKeyCredentialType to be "signature & assertion format (and version thereof)" w3c/webauthn#296 (4 comments by @rlin1, @selfissued)
-
attObj and Figure 3 [[#fig-attStructs]] do not agree w3c/webauthn#401 (3 comments by @equalsJeffH, @selfissued, @vijaybh)
-
"authentication" attribute on Navigator should be [SecureContext] w3c/webauthn#250 (3 comments by @equalsJeffH, @mikewest, @selfissued)
-
Add cloud transport option to transport hint w3c/webauthn#331 (3 comments by @AngeloKai, @equalsJeffH, @selfissued)
-
Expose standard authenticator fields in JS objects, vs. binary w3c/webauthn#337 (3 comments by @equalsJeffH, @selfissued)
-
"ScopedCred" enum should be "scoped-cred" w3c/webauthn#328 (3 comments by @equalsJeffH, @selfissued)
-
Protect against TLS MiTM by including TLS cert chain in signature w3c/webauthn#391 (3 comments by @rlin1, @sampaths, @selfissued)
-
Consider using USVString instead of DOMString sometimes w3c/webauthn#166 (3 comments by @domenic, @selfissued)
-
detail-level issues in signature format, attestation format(s), attestation statement w3c/webauthn#233 (3 comments by @rlin1, @selfissued)
-
clarify normality of authenticator model - is it actually authenticator API ? w3c/webauthn#176 (3 comments by @equalsJeffH, @selfissued)
-
Eliminate duplicate terminology w3c/webauthn#358 (3 comments by @AngeloKai, @equalsJeffH, @selfissued)
-
restrict WebAuthentication API to only top level browsing context w3c/webauthn#374 (3 comments by @jyasskin, @mikewest, @selfissued)
-
Rename ScopedCredential to PublicKeyCredential w3c/webauthn#406 (2 comments by @equalsJeffH, @mikewest)
-
leverage "credential source" term from credential management spec w3c/webauthn#430 (2 comments by @equalsJeffH, @jyasskin)
-
cleanup: attestation object `attObj` format not clearly delineated w3c/webauthn#395 (2 comments by @equalsJeffH)
-
Define extension client processing more carefully. w3c/webauthn#363 (2 comments by @jyasskin, @selfissued)
-
do not totally lose the term "WebAuthn Relying Party" w3c/webauthn#180 (2 comments by @equalsJeffH, @selfissued)
-
What ensures any semblance of interop for WebAuthnExtensions? w3c/webauthn#290 (2 comments by @equalsJeffH, @selfissued)
-
follow Bluetooth and NFC brand usage guidance w3c/webauthn#373 (2 comments by @equalsJeffH, @selfissued)
-
excludeList and allowList should be excludeCredentials and allowCredentials w3c/webauthn#327 (2 comments by @selfissued)
-
tokenBinding member of ClientData should be tokenBindingId w3c/webauthn#323 (2 comments by @selfissued)
-
Throw "NotFoundError" when internal authenticator is not available or not found w3c/webauthn#302 (2 comments by @selfissued)
-
Add explanation of why the account argument is useful w3c/webauthn#219 (2 comments by @jcjones, @selfissued)
-
TAG review feedback: Align Credential interface with Credential Management? w3c/webauthn#60 (2 comments by @selfissued)
-
"NotAllowedError" is in WebIDL editors draft but not in WebIDL Level 1 w3c/webauthn#305 (2 comments by @equalsJeffH, @selfissued)
-
Clarify how a user can authenticate from multiple devices w3c/webauthn#151 (2 comments by @equalsJeffH, @selfissued)
-
Spec should not mandate behavior of server w3c/webauthn#88 (2 comments by @equalsJeffH, @selfissued)
-
What extension data is in AuthenticatorAssertionResponse.authenticatorData? w3c/webauthn#418 (1 comment by @selfissued)
-
"Authenticator argument" vs. "authenticator data value" in Extensions section w3c/webauthn#230 (1 comment by @selfissued)
-
some RPs may wish to allow multiple registrations to same user account w3c/webauthn#403 (1 comment by @equalsJeffH)
-
[PR 384] Does requireUserMediation() make sense after merge w3c/webauthn#402 (1 comment by @jyasskin)
-
_rpId_ generation allows more relaxation of same-origin restrictions than document.domain does w3c/webauthn#260 (1 comment by @selfissued)
-
Is _rpId_ supposed to look like an origin serialization, or like a hostname? w3c/webauthn#259 (1 comment by @selfissued)
-
update extensions framework to include interfacing with user agent permissions framework w3c/webauthn#133 (1 comment by @selfissued)
-
makeCredential should be more precise than NotAllowedError in its last step w3c/webauthn#376 (1 comment by @selfissued)
-
Crypto algorithm agility: e.g., Specify the set of hash algorithms UAs can select between. w3c/webauthn#362 (1 comment by @selfissued)
-
define what to do if both normalizedAlgorithm and cryptoParameters are empty w3c/webauthn#361 (1 comment by @selfissued)
-
References to "algorithm" and "alg" should be same string w3c/webauthn#351 (1 comment by @selfissued)
-
Add getAuthenticatorInfo to the Authenticator Model section w3c/webauthn#349 (1 comment by @selfissued)
-
"rp" isn't a widely enough known acronym?, should be relyingParty instead? w3c/webauthn#325 (1 comment by @selfissued)
-
Update attestation format identifiers in registry to match spec w3c/webauthn#300 (1 comment by @selfissued)
-
Why are various predefined extensions defined as extensions, and not just parts of the spec? w3c/webauthn#295 (1 comment by @selfissued)
-
Why is the only value of ScopedCredentialType "ScopedCred" as opposed to "ScopedCredential"? w3c/webauthn#291 (1 comment by @selfissued)
-
Clarify what is a proprietary attestation format and whether it should be designated by a prefix w3c/webauthn#222 (1 comment by @selfissued)
-
web-api: is further language needed describing AppID (aka rpId) usage ? w3c/webauthn#8 (1 comment by @selfissued)
-
normalizing term(s) for authenticator-generated RP-specific public key w3c/webauthn#79 (1 comment by @equalsJeffH)
-
-
15 pull requests opened.
-
Remove UV bit from authenticatorData w3c/webauthn#431, by @AngeloKai.
-
3rd approach: Add authenticator selection dictionary to create with attachment w3c/webauthn#429, by @AngeloKai.
-
2nd approach: Add authenticator selection dictionary to create without attachment w3c/webauthn#428, by @AngeloKai.
-
address empty allowlist in 'use existing cred' alg, fixes #387 w3c/webauthn#427, by @equalsJeffH.
-
repair fig 3 - fix #401 w3c/webauthn#426, by @equalsJeffH.
-
Add displayName for the user account w3c/webauthn#423, by @selfissued.
-
Add a link to web-platform-tests to the top of the spec w3c/webauthn#419, by @foolip.
-
Add User Verification (UV) bit to authenticator data w3c/webauthn#409, by @AngeloKai.
-
Add uaf attestation format w3c/webauthn#408, by @rlin1.
-
Add credential type uaf w3c/webauthn#407, by @rlin1.
-
Convert `makeCredential()`'s parameters into a dictionary. w3c/webauthn#399, by @mikewest.
-
Move `getAssertion()`'s `challenge` into `AssertionOptions` w3c/webauthn#398, by @mikewest.
-
Introduce authenticator response interfaces. w3c/webauthn#397, by @mikewest.
-
-
12 pull requests merged.
-
Add a link to web-platform-tests to the top of the spec w3c/webauthn#419.
-
Throw NotFoundError when no authenticator is available w3c/webauthn#350.
-
Add displayName for the user account w3c/webauthn#423.
-
Add gesture verification parameter to option in both makeC and getA w3c/webauthn#348.
-
Add User Verification (UV) bit to authenticator data w3c/webauthn#409.
-
Strawman of an integration between WebAuthn and Credential Management. w3c/webauthn#384.
-
Convert `makeCredential()`'s parameters into a dictionary. w3c/webauthn#399.
-
Move `getAssertion()`'s `challenge` into `AssertionOptions` w3c/webauthn#398.
-
Introduce authenticator response interfaces. w3c/webauthn#397.
-
-
15 pull requests received 326 new comments.
-
Strawman of an integration between WebAuthn and Credential Management. w3c/webauthn#384 (90 comments by @AngeloKai, @balfanz, @domenic, @equalsJeffH, @jyasskin, @mikewest, @selfissued, @vijaybh)
-
Separated proposed changes to extension semantics from PR #386 and use TypeError, per @jyasskin w3c/webauthn#389 (51 comments by @equalsJeffH, @jyasskin, @selfissued, @vijaybh)
-
1st approach: add requireResidentKey without adding authenticator selection dictionary w3c/webauthn#378 (32 comments by @AngeloKai, @equalsJeffH, @jyasskin, @selfissued, @vijaybh)
-
address empty allowlist in 'use existing cred' alg, fixes #387 w3c/webauthn#427 (29 comments by @equalsJeffH, @jyasskin, @selfissued)
-
Convert `makeCredential()`'s parameters into a dictionary. w3c/webauthn#399 (27 comments by @equalsJeffH, @leshi, @mikewest, @vijaybh)
-
Send authenticator extension inputs to authenticators and send client extension outputs to RPs w3c/webauthn#425 (23 comments by @jyasskin, @selfissued)
-
Add User Verification (UV) bit to authenticator data w3c/webauthn#409 (19 comments by @AngeloKai, @equalsJeffH, @jyasskin, @leshi, @selfissued)
-
Throw NotFoundError when no authenticator is available w3c/webauthn#350 (16 comments by @equalsJeffH, @leshi, @selfissued, @vijaybh)
-
Move `getAssertion()`'s `challenge` into `AssertionOptions` w3c/webauthn#398 (13 comments by @equalsJeffH, @jcjones, @leshi, @mikewest, @vijaybh)
-
Introduce authenticator response interfaces. w3c/webauthn#397 (12 comments by @equalsJeffH, @jcjones, @jyasskin, @leshi, @mikewest)
-
3rd approach: Add authenticator selection dictionary to create with attachment w3c/webauthn#429 (5 comments by @AngeloKai, @leshi, @selfissued)
-
Add isPlatformAuthenticatorReady function to the API surface w3c/webauthn#379 (3 comments by @selfissued, @vijaybh)
-
Add a link to web-platform-tests to the top of the spec w3c/webauthn#419 (2 comments by @equalsJeffH, @selfissued)
-
Add gesture verification parameter to option in both makeC and getA w3c/webauthn#348 (1 comment by @selfissued)
-
Participants
-
2 participants joined.
-
Michel Weksler (Airbnb Inc) joined.
-
Dmitri Zagidulin (W3C Invited Experts) joined.
-
GitHub
w3c/webauthn
-
10 issues opened.
-
Protect against TLS MiTM by including TLS cert chain in signature w3c/webauthn#391, by @leshi.
-
Consider empty allowLists w3c/webauthn#387, by @jyasskin.
-
daaKey format? (ECPointToB -> ECPoint2ToB) w3c/webauthn#385, by @sjparkRaon.
-
Describe attacks on privacy that are allowed/prevented w3c/webauthn#382, by @jyasskin.
-
Should the WebAuth API have a cancel() method? w3c/webauthn#380, by @kpaulh.
-
makeCredential should be more precise than NotAllowedError in its last step w3c/webauthn#376, by @jyasskin.
-
restrict WebAuthentication API to only top level browsing context w3c/webauthn#374, by @equalsJeffH.
-
follow Bluetooth and NFC brand usage guidance w3c/webauthn#373, by @equalsJeffH.
-
UVM Extension Editorial Change w3c/webauthn#368, by @apowers313.
-
-
25 issues closed.
-
Add "registration extension" and "authentication extension" to glossary w3c/webauthn#131.
-
daaKey format? (ECPointToB -> ECPoint2ToB) w3c/webauthn#385.
-
Consider scoping Account and ClientData w3c/webauthn#312.
-
What does it mean to "get assertions" in getAssertion step 7? w3c/webauthn#281.
-
The steps for makeCredential do a bunch of implicit getting of members w3c/webauthn#251.
-
The concept "empty" is not really defined for IDL sequences w3c/webauthn#267.
-
Exception handling in cryptoParameters processing needs to be clarified w3c/webauthn#264.
-
`rpID` origin relaxation? w3c/webauthn#338.
-
Credential ID not signed w3c/webauthn#206.
-
User Verification definition needs to be refined w3c/webauthn#357.
-
What does "If normalizedAlgorithm is empty" mean? w3c/webauthn#266.
-
What does normalizedParameters actually contain in makeCredential? w3c/webauthn#265.
-
I don't understand how to create a ClientData in makeCredential w3c/webauthn#273.
-
-
1 issue reopened.
-
TAG review feedback: Align Credential interface with Credential Management? w3c/webauthn#60, by @vijaybh.
-
-
45 issues received 87 new comments.
-
Please ensure that all ArrayBuffer creations are done explicitly, in the correct global w3c/webauthn#293 (9 comments by @bzbarsky, @equalsJeffH, @jyasskin)
-
Should the WebAuth API have a cancel() method? w3c/webauthn#380 (5 comments by @equalsJeffH, @jakearchibald, @jyasskin, @kpaulh, @vijaybh)
-
Add keyStorage enum to ScopedCredentialOptions w3c/webauthn#367 (4 comments by @equalsJeffH, @gmandyam, @rlin1)
-
daaKey format? (ECPointToB -> ECPoint2ToB) w3c/webauthn#385 (4 comments by @rlin1, @sjparkRaon, @vijaybh)
-
Creation of ScopedCredentialInfo in makeCredential should probably be more explicit w3c/webauthn#277 (4 comments by @bzbarsky, @equalsJeffH, @vijaybh)
-
Explain how Token Binding IDs get associated with an HTML context. w3c/webauthn#360 (3 comments by @equalsJeffH, @jyasskin)
-
Propose procedure for adding to attestation/extension registry w3c/webauthn#303 (3 comments by @gmandyam, @selfissued)
-
makeCredential should be more precise than NotAllowedError in its last step w3c/webauthn#376 (3 comments by @jyasskin, @vijaybh)
-
restrict WebAuthentication API to only top level browsing context w3c/webauthn#374 (3 comments by @AngeloKai, @battre, @mikewest)
-
Exception handling in cryptoParameters processing needs to be clarified w3c/webauthn#264 (3 comments by @bzbarsky, @vijaybh)
-
Add "registration extension" and "authentication extension" to glossary w3c/webauthn#131 (2 comments by @equalsJeffH, @selfissued)
-
Why are various predefined extensions defined as extensions, and not just parts of the spec? w3c/webauthn#295 (2 comments by @equalsJeffH, @selfissued)
-
"might be present on this authenticator" could use a clearer definition w3c/webauthn#280 (2 comments by @bzbarsky, @equalsJeffH)
-
ScopedCredentialDescriptor can contain BufferSources that are processed async w3c/webauthn#276 (2 comments by @equalsJeffH, @vijaybh)
-
What does "If normalizedAlgorithm is empty" mean? w3c/webauthn#266 (2 comments by @equalsJeffH, @vijaybh)
-
hostname canonicalization in {#makeCredential} section? w3c/webauthn#167 (1 comment by @equalsJeffH)
-
What ensures any semblance of interop for WebAuthnExtensions? w3c/webauthn#290 (1 comment by @selfissued)
-
Crypto algorithm agility: e.g., Specify the set of hash algorithms UAs can select between. w3c/webauthn#362 (1 comment by @vijaybh)
-
detail-level issues in signature format, attestation format(s), attestation statement w3c/webauthn#233 (1 comment by @rlin1)
-
"NotAllowedError" is in WebIDL editors draft but not in WebIDL Level 1 w3c/webauthn#305 (1 comment by @jyasskin)
-
What does it mean to "get assertions" in getAssertion step 7? w3c/webauthn#281 (1 comment by @vijaybh)
-
Creation of WebAuthnAssertion in getAssertion should probably be more explicit w3c/webauthn#282 (1 comment by @vijaybh)
-
getAssertion needs to not go async before making a copy of the assertionChallenge w3c/webauthn#279 (1 comment by @vijaybh)
-
Need to clearly define what it means to SHA-256 hash the "host" output of the document.domain setter w3c/webauthn#258 (1 comment by @vijaybh)
-
There is no "current settings object" in algorithm steps that are executing in parallel w3c/webauthn#254 (1 comment by @vijaybh)
-
Does "Then asynchronously continue executing the following steps" mean "in parallel"? w3c/webauthn#253 (1 comment by @vijaybh)
-
callerOrigin isn't actually the origin of the caller; it's the origin of the callee w3c/webauthn#271 (1 comment by @equalsJeffH)
-
Should attestationChallenge be snapshotted in makeCredential, or used before going async? w3c/webauthn#272 (1 comment by @vijaybh)
-
Do we need "Algorithm Usage Location(s)" and "JOSE Implementation Requirements" in the IANA Considerations section? w3c/webauthn#297 (1 comment by @equalsJeffH)
-
Please coordinate with the HTML spec to extract the relevant bits of the document.domain setter so you can call them w3c/webauthn#256 (1 comment by @equalsJeffH)
-
What does normalizedParameters actually contain in makeCredential? w3c/webauthn#265 (1 comment by @equalsJeffH)
-
TAG review feedback: Align Credential interface with Credential Management? w3c/webauthn#60 (1 comment by @vijaybh)
-
-
14 pull requests opened.
-
fix webauthn ref in -webauthn-registries to link to webauthn editors' draft w3c/webauthn#390, by @equalsJeffH.
-
Typo: Fix a linking error after DAA merge. w3c/webauthn#388, by @mikewest.
-
Align registries draft and WebAuthn draft and address extension issues w3c/webauthn#386, by @selfissued.
-
Strawman of an integration between WebAuthn and Credential Management. w3c/webauthn#384, by @mikewest.
-
Tiny typo in 'ScopedCredentialDesciptor'. w3c/webauthn#383, by @mikewest.
-
replaced DAA root key by daaKeyId. Added proper references w3c/webauthn#381, by @rlin1.
-
Add isPlatformAuthenticatorReady function to the API surface w3c/webauthn#379, by @AngeloKai.
-
alloc ArrayBuffers in correct global w3c/webauthn#377, by @equalsJeffH.
-
add 'spec roadmap' section w3c/webauthn#375, by @equalsJeffH.
-
fixup getAssertion, polish algorithms w3c/webauthn#371, by @equalsJeffH.
-
Jeffh canonicalize markup w3c/webauthn#370, by @equalsJeffH.
-
Refine makeCredential description w3c/webauthn#369, by @vijaybh.
-
-
13 pull requests merged.
-
Align registries draft and WebAuthn draft and address extension issues w3c/webauthn#386.
-
Typo: Fix a linking error after DAA merge. w3c/webauthn#388.
-
replaced DAA root key by daaKeyId. Added proper references w3c/webauthn#381.
-
Rename Account and ClientData fixes #312 w3c/webauthn#344.
-
alloc ArrayBuffers in correct global w3c/webauthn#377.
-
Tiny typo in 'ScopedCredentialDesciptor'. w3c/webauthn#383.
-
fixup getAssertion, polish algorithms w3c/webauthn#371.
-
Jeffh canonicalize markup w3c/webauthn#370.
-
Refine makeCredential description w3c/webauthn#369.
-
Make hashAlg a "recognized algorithm name". w3c/webauthn#352.
-
Make makeCredential() more precise. w3c/webauthn#347.
-
2 pull requests reopened.
-
Rename Account and ClientData fixes #312 w3c/webauthn#344, by @kpaulh.
-
fixup getAssertion, polish algorithms w3c/webauthn#371, by @equalsJeffH.
-
-
20 pull requests received 251 new comments.
-
Align registries draft and WebAuthn draft and address extension issues w3c/webauthn#386 (44 comments by @equalsJeffH, @gmandyam, @jyasskin, @selfissued, @vijaybh)
-
fixup getAssertion, polish algorithms w3c/webauthn#371 (42 comments by @equalsJeffH, @jcjones, @vijaybh)
-
Strawman of an integration between WebAuthn and Credential Management. w3c/webauthn#384 (34 comments by @battre, @bzbarsky, @equalsJeffH, @jyasskin, @mikewest, @tobie, @vijaybh)
-
Refine makeCredential description w3c/webauthn#369 (27 comments by @equalsJeffH, @jyasskin, @vijaybh)
-
1st approach: add requireResidentKey without adding authenticator selection dictionary w3c/webauthn#378 (18 comments by @AngeloKai, @jyasskin, @vijaybh)
-
refine user verification and authz gesture definitions, add Test of User Presence w3c/webauthn#365 (12 comments by @equalsJeffH, @jcjones, @vijaybh)
-
Rename Account and ClientData fixes #312 w3c/webauthn#344 (11 comments by @equalsJeffH, @kpaulh, @vijaybh)
-
Make makeCredential() more precise. w3c/webauthn#347 (10 comments by @equalsJeffH, @jcjones, @jyasskin, @vijaybh)
-
Add isPlatformAuthenticatorReady function to the API surface w3c/webauthn#379 (9 comments by @AngeloKai, @jyasskin, @vijaybh)
-
Separated proposed changes to extension semantics from PR #386 and use TypeError, per @jyasskin w3c/webauthn#389 (7 comments by @equalsJeffH, @jyasskin, @selfissued)
-
Add gesture verification parameter to option in both makeC and getA w3c/webauthn#348 (7 comments by @AngeloKai, @gmandyam, @vijaybh)
-
replaced DAA root key by daaKeyId. Added proper references w3c/webauthn#381 (7 comments by @equalsJeffH, @rlin1)
-
alloc ArrayBuffers in correct global w3c/webauthn#377 (7 comments by @bzbarsky, @equalsJeffH, @jyasskin, @vijaybh)
-
Throw NotFoundError when no authenticator is available w3c/webauthn#350 (6 comments by @AngeloKai, @jcjones, @jyasskin, @rlin1, @vijaybh)
-
fix webauthn ref in -webauthn-registries to link to webauthn editors' draft w3c/webauthn#390 (2 comments by @equalsJeffH, @selfissued)
-
TR publications
-
1 document published.
Participants
-
1 participant left.
-
atsuhiro tsuchiya (W3C Invited Experts) left.
-
GitHub
w3c/webauthn
-
20 issues opened.
-
Add keyStorage enum to ScopedCredentialOptions w3c/webauthn#367, by @AngeloKai.
-
Credential CBOR w3c/webauthn#366, by @apowers313.
-
Constrain the "reasonable range" of timeouts w3c/webauthn#364, by @jyasskin.
-
Define extension client processing more carefully. w3c/webauthn#363, by @jyasskin.
-
define what to do if both normalizedAlgorithm and cryptoParameters are empty w3c/webauthn#361, by @equalsJeffH.
-
Explain how Token Binding IDs get associated with an HTML context. w3c/webauthn#360, by @jyasskin.
-
Editorial: use more elaborate variable names w3c/webauthn#359, by @annevk.
-
Eliminate duplicate terminology w3c/webauthn#358, by @jyasskin.
-
User Verification definition needs to be refined w3c/webauthn#357, by @gmandyam.
-
Add reference to FIDO ECDAA spec. w3c/webauthn#355, by @rlin1.
-
Fetch intergration for WebAuthn API w3c/webauthn#354, by @AngeloKai.
-
Track rename issues to maintain consistency w3c/webauthn#353, by @AngeloKai.
-
References to "algorithm" and "alg" should be same string w3c/webauthn#351, by @jovasco.
-
Add getAuthenticatorInfo to the Authenticator Model section w3c/webauthn#349, by @AngeloKai.
-
Add "willMakeCredentialWorkWithTheseConstraints()" method to the API w3c/webauthn#345, by @kpaulh.
-
Examples show a DOMString passed to challenge, but it's a BufferSource w3c/webauthn#341, by @jyasskin.
-
`rpID` origin relaxation? w3c/webauthn#338, by @mikewest.
-
Expose standard authenticator fields in JS objects, vs. binary w3c/webauthn#337, by @bifurcation.
-
-
31 issues closed.
-
Editorial: use more elaborate variable names w3c/webauthn#359.
-
Add reference to FIDO ECDAA spec. w3c/webauthn#355.
-
Clarify wording on authenticator selection w3c/webauthn#207.
-
Unclear how ClientData is created in makeCredential() w3c/webauthn#320.
-
Timeouts should be in ms not seconds w3c/webauthn#299.
-
timeoutSeconds options should just be timeout in ms? w3c/webauthn#324.
-
Examples show a DOMString passed to challenge, but it's a BufferSource w3c/webauthn#341.
-
Should WebAuthnAttestation attributes have constructors? w3c/webauthn#313.
-
Should use "RS1" instead of "RSA1_5" w3c/webauthn#304.
-
Whitespace around < > in Web IDL is unusual w3c/webauthn#335.
-
5.2.2. Generating a signature w3c/webauthn#332.
-
differentiate assertion signatures and attestation signatures w3c/webauthn#118.
-
Clarify uses of ClientData w3c/webauthn#209.
-
Define a U2F attestation format w3c/webauthn#214.
-
TPM attestation format spec is incomplete w3c/webauthn#226.
-
explicitly denote RSA signature scheme w3c/webauthn#239.
-
certifyinfo needs to be specified w3c/webauthn#242.
-
Can the "attestation" of a WebAuthnAttestation be a non-object? w3c/webauthn#289.
-
WebAPI: FIDO Authenticator model - clarifications needed w3c/webauthn#12.
-
Add section describing verification of a WebAuthnAssertion w3c/webauthn#102.
-
WebAPI: credential binding to a user account w3c/webauthn#13.
-
Simplifying attestation, take two w3c/webauthn#244.
-
Clarify names for crypto algs, e.g. RS256 w3c/webauthn#123.
-
Explainer or more examples? w3c/webauthn#330.
-
-
2 issues reopened.
-
Spec should not mandate behavior of server w3c/webauthn#88, by @equalsJeffH.
-
Whitespace around < > in Web IDL is unusual w3c/webauthn#335, by @nadalin.
-
-
43 issues received 110 new comments.
-
"NotAllowedError" is in WebIDL editors draft but not in WebIDL Level 1 w3c/webauthn#305 (9 comments by @AngeloKai, @equalsJeffH, @jyasskin)
-
I don't understand how to create a ClientData in makeCredential w3c/webauthn#273 (7 comments by @annevk, @bzbarsky, @jyasskin, @vijaybh)
-
Editorial: use more elaborate variable names w3c/webauthn#359 (6 comments by @AngeloKai, @annevk, @equalsJeffH, @jyasskin)
-
What does normalizedParameters actually contain in makeCredential? w3c/webauthn#265 (6 comments by @bzbarsky, @equalsJeffH)
-
The W3C HTML spec is broken, and probably shouldn't be referenced w3c/webauthn#257 (5 comments by @jyasskin, @tabatkins)
-
Track rename issues to maintain consistency w3c/webauthn#353 (5 comments by @AngeloKai, @equalsJeffH, @vijaybh)
-
Add clearer definition of API use cases to the spec w3c/webauthn#334 (5 comments by @equalsJeffH, @nadalin, @rlin1)
-
What does "If normalizedAlgorithm is empty" mean? w3c/webauthn#266 (4 comments by @equalsJeffH, @jyasskin)
-
Whitespace around < > in Web IDL is unusual w3c/webauthn#335 (4 comments by @equalsJeffH, @foolip, @jyasskin, @zcorpan)
-
"rp" isn't a widely enough known acronym?, should be relyingParty instead? w3c/webauthn#325 (3 comments by @equalsJeffH, @nadalin)
-
User Verification definition needs to be refined w3c/webauthn#357 (3 comments by @equalsJeffH, @gmandyam, @vijaybh)
-
There is no "current settings object" in algorithm steps that are executing in parallel w3c/webauthn#254 (3 comments by @equalsJeffH, @jyasskin)
-
Spec should not mandate behavior of server w3c/webauthn#88 (3 comments by @apowers313, @equalsJeffH)
-
Add "willMakeCredentialWorkWithTheseConstraints()" method to the API w3c/webauthn#345 (2 comments by @equalsJeffH, @vijaybh)
-
Throw "NotFoundError" when internal authenticator is not available or not found w3c/webauthn#302 (2 comments by @equalsJeffH, @vijaybh)
-
Exception handling in cryptoParameters processing needs to be clarified w3c/webauthn#264 (2 comments by @AngeloKai, @vijaybh)
-
References to "algorithm" and "alg" should be same string w3c/webauthn#351 (2 comments by @jovasco, @zcorpan)
-
Unclear how ClientData is created in makeCredential() w3c/webauthn#320 (2 comments by @annevk, @vijaybh)
-
detail-level issues in signature format, attestation format(s), attestation statement w3c/webauthn#233 (2 comments by @equalsJeffH, @vijaybh)
-
Add cloud transport option to transport hint w3c/webauthn#331 (2 comments by @equalsJeffH, @nadalin)
-
overall security considerations section or document w3c/webauthn#322 (2 comments by @equalsJeffH, @nadalin)
-
Explain how Token Binding IDs get associated with an HTML context. w3c/webauthn#360 (1 comment by @equalsJeffH)
-
WebAuthn available to Workers? aka "silent authentication" w3c/webauthn#199 (1 comment by @equalsJeffH)
-
Silent/touchless Authn? clarification of bit 0 in AuthenticatorData w3c/webauthn#22 (1 comment by @equalsJeffH)
-
Is _rpId_ supposed to look like an origin serialization, or like a hostname? w3c/webauthn#259 (1 comment by @jyasskin)
-
WebAPI: FIDO Authenticator model - clarifications needed w3c/webauthn#12 (1 comment by @equalsJeffH)
-
Examples show a DOMString passed to challenge, but it's a BufferSource w3c/webauthn#341 (1 comment by @vijaybh)
-
Expose standard authenticator fields in JS objects, vs. binary w3c/webauthn#337 (1 comment by @bifurcation)
-
-
12 pull requests opened.
-
updated the reference to FIDO ECDAA w3c/webauthn#356, by @rlin1.
-
Make hashAlg a "recognized algorithm name". w3c/webauthn#352, by @jyasskin.
-
Throw NotFoundError when no authenticator is available w3c/webauthn#350, by @AngeloKai.
-
Add gesture verification parameter to option in both makeC and getA w3c/webauthn#348, by @AngeloKai.
-
Make makeCredential() more precise. w3c/webauthn#347, by @jyasskin.
-
Rename Account and ClientData fixes #312 w3c/webauthn#344, by @kpaulh.
-
Make BufferSource parameters actually BufferSources. w3c/webauthn#343, by @jyasskin.
-
allow u2f attestation to be chained w3c/webauthn#342, by @leshi.
-
Fix #335: Remove extraneous whitespace in IDL parameterized types and operations. w3c/webauthn#340, by @jyasskin.
-
Highlight the examples as JavaScript and remove non-functional .highlight classes. w3c/webauthn#339, by @jyasskin.
-
Fix up several linking mistakes. w3c/webauthn#336, by @jyasskin.
-
9 pull requests merged.
-
Fix up several linking mistakes. w3c/webauthn#336.
-
updated the reference to FIDO ECDAA w3c/webauthn#356.
-
Renamed timeoutSeconds to timeoutMilliseconds w3c/webauthn#333.
-
Make BufferSource parameters actually BufferSources. w3c/webauthn#343.
-
allow u2f attestation to be chained w3c/webauthn#342.
-
1 pull request closed.
-
Inline and clarify the "Relaxing the Same-Origin Restriction" algorithm w3c/webauthn#314.
-
-
13 pull requests received 171 new comments.
-
Make makeCredential() more precise. w3c/webauthn#347 (64 comments by @annevk, @equalsJeffH, @jyasskin, @vijaybh)
-
Clean up attestation, abstract it from UA, fix TPM format, add U2F format w3c/webauthn#321 (45 comments by @equalsJeffH, @vijaybh)
-
Add gesture verification parameter to option in both makeC and getA w3c/webauthn#348 (28 comments by @AngeloKai, @balfanz, @equalsJeffH, @jyasskin, @vijaybh)
-
Bug #256 - Clarify call of the "Relaxing the Same-Origin Restriction" algorithm w3c/webauthn#319 (9 comments by @equalsJeffH, @jcjones, @jyasskin)
-
Throw NotFoundError when no authenticator is available w3c/webauthn#350 (6 comments by @jyasskin, @vijaybh)
-
Make hashAlg a "recognized algorithm name". w3c/webauthn#352 (4 comments by @equalsJeffH, @jyasskin, @vijaybh)
-
refine user verification and authz gesture definitions, add Test of User Presence w3c/webauthn#365 (1 comment by @equalsJeffH)
-
Inline and clarify the "Relaxing the Same-Origin Restriction" algorithm w3c/webauthn#314 (1 comment by @jcjones)
-
Participants
-
1 participant left.
-
Harry Halpin (W3C) left.
-
GitHub
w3c/webauthn
-
15 issues opened.
-
Whitespace around < > in Web IDL is unusual w3c/webauthn#335, by @foolip.
-
Add clearer definition of API use cases to the spec w3c/webauthn#334, by @AngeloKai.
-
5.2.2. Generating a signature w3c/webauthn#332, by @jehrensvard.
-
Add cloud transport option to transport hint w3c/webauthn#331, by @AngeloKai.
-
Explainer or more examples? w3c/webauthn#330, by @bfgeek.
-
Too generic names? w3c/webauthn#329, by @bfgeek.
-
"ScopedCred" enum should be "scoped-cred" w3c/webauthn#328, by @bfgeek.
-
excludeList and allowList should be excludeCredentials and allowCredentials w3c/webauthn#327, by @bfgeek.
-
hashAlg -> hashAlgorithm? w3c/webauthn#326, by @bfgeek.
-
"rp" isn't a widely enough known acronym?, should be relyingParty instead? w3c/webauthn#325, by @bfgeek.
-
timeoutSeconds options should just be timeout in ms? w3c/webauthn#324, by @bfgeek.
-
tokenBinding member of ClientData should be tokenBindingId w3c/webauthn#323, by @equalsJeffH.
-
overall security considerations section or document w3c/webauthn#322, by @equalsJeffH.
-
Unclear how ClientData is created in makeCredential() w3c/webauthn#320, by @annevk.
-
-
5 issues closed.
-
Consider removing the "n" in "WebAuthnAttestation", etc w3c/webauthn#311.
-
Can we get rid of the "Web" prefix for WebAuthnAttestation, etc? w3c/webauthn#310.
-
facet should be USVString w3c/webauthn#175.
-
Move `allowList` from optional to default on `getAssertion` w3c/webauthn#221.
-
-
21 issues received 36 new comments.
-
callerOrigin isn't actually the origin of the caller; it's the origin of the callee w3c/webauthn#271 (4 comments by @AngeloKai, @domenic, @equalsJeffH)
-
What ensures any semblance of interop for WebAuthnExtensions? w3c/webauthn#290 (3 comments by @AngeloKai, @jcjones, @leshi)
-
"ScopedCred" enum should be "scoped-cred" w3c/webauthn#328 (3 comments by @bfgeek, @equalsJeffH, @vijaybh)
-
Consider using CDDL (CBOR data definition language) to define CBOR-encoded data structures w3c/webauthn#318 (3 comments by @equalsJeffH, @vijaybh)
-
timeoutSeconds options should just be timeout in ms? w3c/webauthn#324 (3 comments by @bfgeek, @equalsJeffH, @vijaybh)
-
Please coordinate with the HTML spec to extract the relevant bits of the document.domain setter so you can call them w3c/webauthn#256 (2 comments by @bzbarsky, @jwatt)
-
RSA credential public key encoding in "attestation data" incorrectly specified? w3c/webauthn#240 (2 comments by @equalsJeffH, @rlin1)
-
detail-level issues in signature format, attestation format(s), attestation statement w3c/webauthn#233 (2 comments by @equalsJeffH, @rlin1)
-
Should WebAuthnAttestation attributes have constructors? w3c/webauthn#313 (2 comments by @equalsJeffH)
-
TAG review feedback: Align Credential interface with Credential Management? w3c/webauthn#60 (1 comment by @RByers)
-
Propose procedure for adding to attestation/extension registry w3c/webauthn#303 (1 comment by @equalsJeffH)
-
Consider removing the "n" in "WebAuthnAttestation", etc w3c/webauthn#311 (1 comment by @equalsJeffH)
-
Can we get rid of the "Web" prefix for WebAuthnAttestation, etc? w3c/webauthn#310 (1 comment by @equalsJeffH)
-
Is there a reason "WebAuthnAssertion" is not "WebAuthenticationAssertion"? w3c/webauthn#288 (1 comment by @equalsJeffH)
-
Move `allowList` from optional to default on `getAssertion` w3c/webauthn#221 (1 comment by @vijaybh)
-
-
3 pull requests opened.
-
Renamed timeoutSeconds to timeoutMilliseconds w3c/webauthn#333, by @AngeloKai.
-
Clean up attestation, abstract it from UA, fix TPM format, add U2F format w3c/webauthn#321, by @vijaybh.
-
Bug #256 - Clarify call of the "Relaxing the Same-Origin Restriction" algorithm w3c/webauthn#319, by @jcjones.
-
-
2 pull requests merged.
-
Renaming WebAuthn -> Authentication w3c/webauthn#317.
-
Reference the Encoding spec's UTF-8 Encode definition w3c/webauthn#315.
-
-
6 pull requests received 81 new comments.
-
Clean up attestation, abstract it from UA, fix TPM format, add U2F format w3c/webauthn#321 (58 comments by @equalsJeffH, @vijaybh)
-
Inline and clarify the "Relaxing the Same-Origin Restriction" algorithm w3c/webauthn#314 (12 comments by @AngeloKai, @annevk, @domenic, @equalsJeffH, @jcjones)
-
Renaming WebAuthn -> Authentication w3c/webauthn#317 (5 comments by @AngeloKai, @equalsJeffH, @jcjones, @leshi, @wseltzer)
-
Bug #256 - Clarify call of the "Relaxing the Same-Origin Restriction" algorithm w3c/webauthn#319 (3 comments by @bzbarsky, @jcjones)
-
Reference the Encoding spec's UTF-8 Encode definition w3c/webauthn#315 (2 comments by @equalsJeffH, @jcjones)
-