Web Authentication Working Group - Activity in 2018
No matches.
GitHub
w3c/webauthn
-
7 issues opened.
-
Propose extension: Delegation of Authentication w3c/webauthn#1125, by @bvandersloot.
-
Lack of support for modern ECC w3c/webauthn#1124, by @MichalStaruch.
-
Clarify what value goes into appid extension input w3c/webauthn#1117, by @emlun.
-
Q: Authenticators displaying data? w3c/webauthn#1116, by @yanosz.
-
Should clients enforce challenge length? w3c/webauthn#1115, by @yackermann.
-
-
3 issues closed.
-
Should clients enforce challenge length? w3c/webauthn#1115.
-
Typo clientExtensions should be authenticatorExtensions w3c/webauthn#1089.
-
Q: Authenticators displaying data? w3c/webauthn#1116.
-
-
5 issues received 14 new comments.
-
Should clients enforce challenge length? w3c/webauthn#1115 (6 comments by @emlun, @plehegar, @yackermann)
-
Clarify relationships between "uv"/"up" of the CTAP spec and "userVerification"/"userPresence" w3c/webauthn#1123 (3 comments by @akshayku, @emlun)
-
spec is missing baseline posture that credential source is bound to a particular authenticator w3c/webauthn#1122 (2 comments by @emlun, @equalsJeffH)
-
-
5 pull requests opened.
-
Singularize a "Relying Parties'" to "Relying Party's" w3c/webauthn#1126, by @emlun.
-
Add the Entity Attestation Token w3c/webauthn#1121, by @gmandyam.
-
Fix typo in credential registration steps w3c/webauthn#1120, by @nicksteele.
-
Match text for identical verification steps w3c/webauthn#1119, by @nicksteele.
-
Note that appid should be set to the previously used AppID w3c/webauthn#1118, by @emlun.
-
-
2 pull requests merged.
-
Match text for identical verification steps w3c/webauthn#1119.
-
Fix typos in get() algorithm w3c/webauthn#1092.
-
-
4 pull requests received 8 new comments.
-
In safetynet attestation "nonce" is base64, not base64url w3c/webauthn#1093 (2 comments by @yackermann)
-
Clarify user identification in RP assertion verification operation w3c/webauthn#1082 (2 comments by @jcjones)
Participants
-
2 participants joined.
-
James Barclay (W3C Invited Experts) joined.
-
RAE HAYWARD (W3C Invited Experts) joined.
-
-
1 participant left.
-
Jeff Hodges (Google LLC) left.
-
-
1 organization joined.
-
Ping Identity joined.
-
GitHub
w3c/webauthn
-
3 issues opened.
-
Clarify use case described in section 1.2.2 w3c/webauthn#1114, by @ngtlin.
-
Clarify relationship of UP/UV flags in authenticator data structure w3c/webauthn#1112, by @emlun.
-
Relying Party Session w3c/webauthn#1111, by @milesstoetzner.
-
-
7 issues closed.
-
Clarify relationship of UP/UV flags in authenticator data structure w3c/webauthn#1112.
-
Typo in Figure 1? w3c/webauthn#1084.
-
Clarify language in Section 13 'Security Considerations' w3c/webauthn#1097.
-
Clarify description of compliant authenticators in Introduction w3c/webauthn#1096.
-
Clarify use case described in section 1.2.2 w3c/webauthn#1114.
-
Relying Party Session w3c/webauthn#1111.
-
-
8 issues received 13 new comments.
-
Clarify description of compliant authenticators in Introduction w3c/webauthn#1096 (1 comment by @jcjones)
-
`CredentialRequestOptions` make otherwise valid values invalid in an undesirable way w3c/webauthn#750 (1 comment by @equalsJeffH)
-
Clarify which user to authenticate if userHandle is not present w3c/webauthn#1078 (1 comment by @emlun)
-
1 pull request opened.
-
Clarify UP and UV flags in authenticator data section w3c/webauthn#1113, by @emlun.
-
-
5 pull requests merged.
-
Clarify UP and UV flags in authenticator data section w3c/webauthn#1113.
-
Fix typo in Figure 1 w3c/webauthn#1085.
-
Refine FIDO Security Considerations language w3c/webauthn#1110.
-
Refine introduction to compliant authenticators w3c/webauthn#1109.
-
-
2 pull requests closed.
-
clarification of UP/UV flags in authenticator data structure w3c/webauthn#1108.
-
-
8 pull requests received 18 new comments.
-
Refine introduction to compliant authenticators w3c/webauthn#1109 (7 comments by @emlun, @equalsJeffH)
-
clarification of UP/UV flags in authenticator data structure w3c/webauthn#1108 (5 comments by @emlun, @jericks-duo, @wseltzer)
-
Fix #1096 - Try some language to clarify in the intro that userspace is OK too w3c/webauthn#1104 (1 comment by @jcjones)
-
Clarify user identification in RP assertion verification operation w3c/webauthn#1082 (1 comment by @emlun)
-
Participants
-
1 participant joined.
-
Nicholas Steele (1Password) joined.
-
-
1 participant left.
-
Keiji Takeda (W3C) left.
-
-
1 organization joined.
-
Sovrin Foundation joined.
-
GitHub
w3c/webauthn
-
10 issues opened.
-
Authenticator disconnect event w3c/webauthn#1107, by @dsanders11.
-
Is there a community for webauthn implementation discussion? w3c/webauthn#1106, by @junderw.
-
Refer to IntersectionObserver from the Security Considerations w3c/webauthn#1105, by @jcjones.
-
Example icon doesnt resolve anymore w3c/webauthn#1102, by @yackermann.
-
move sample scenarios section up to be after use cases section w3c/webauthn#1101, by @equalsJeffH.
-
enhance spec roadmap section w3c/webauthn#1100, by @equalsJeffH.
-
enrichen registration and authentication ceremonies definitions w3c/webauthn#1099, by @equalsJeffH.
-
Remove uses of MAY from non-normative introductory text w3c/webauthn#1098, by @brentfulgham.
-
Clarify language in Section 13 'Security Considerations' w3c/webauthn#1097, by @brentfulgham.
-
Clarify description of compliant authenticators in Introduction w3c/webauthn#1096, by @bfulgham.
-
-
6 issues closed.
-
Is there a community for webauthn implementation discussion? w3c/webauthn#1106.
-
Remove uses of MAY from non-normative introductory text w3c/webauthn#1098.
-
Example icon doesnt resolve anymore w3c/webauthn#1102.
-
update token binding reference to ref the actual RFC w3c/webauthn#1086.
-
Adding the way to get trust anchors for CTAP1/U2F authenticators w3c/webauthn#1063.
-
Revise same-origin as ancestor requirements w3c/webauthn#1001.
-
-
1 issue reopened.
-
Leap of Faith not only for Self and None Attestation Types w3c/webauthn#1088, by @milesstoetzner.
-
-
19 issues received 61 new comments.
-
Leap of Faith not only for Self and None Attestation Types w3c/webauthn#1088 (11 comments by @emlun, @equalsJeffH, @milesstoetzner)
-
`CredentialRequestOptions` make otherwise valid values invalid in an undesirable way w3c/webauthn#750 (8 comments by @agl, @bzbarsky, @emlun, @equalsJeffH)
-
Clarify description of compliant authenticators in Introduction w3c/webauthn#1096 (7 comments by @brentfulgham, @equalsJeffH, @rlin1, @samuelweiler)
-
Is there a community for webauthn implementation discussion? w3c/webauthn#1106 (5 comments by @dsanders11, @equalsJeffH, @junderw)
-
Recovering from Device Loss w3c/webauthn#931 (4 comments by @alextaka, @emlun, @equalsJeffH, @watahani)
-
Remove uses of MAY from non-normative introductory text w3c/webauthn#1098 (4 comments by @emlun, @hober, @wseltzer)
-
Example icon doesnt resolve anymore w3c/webauthn#1102 (4 comments by @equalsJeffH, @wseltzer, @yackermann)
-
Refer to IntersectionObserver from the Security Considerations w3c/webauthn#1105 (1 comment by @jcjones)
-
Adding the way to get trust anchors for CTAP1/U2F authenticators w3c/webauthn#1063 (1 comment by @christiaanbrand)
-
Integrate with Feature Policy and possibly Permissions and define appropriate identifier value for WebAuthn w3c/webauthn#911 (1 comment by @rlin1)
-
Clarify language in Section 13 'Security Considerations' w3c/webauthn#1097 (1 comment by @equalsJeffH)
-
Consider allowing RPs to indicate that they want platform authenticators to be synced across devices w3c/webauthn#969 (1 comment by @rlin1)
-
Authenticator selection extension needs to define snapshotting behavior w3c/webauthn#294 (1 comment by @equalsJeffH)
-
-
10 pull requests opened.
-
Refine FIDO Security Considerations language w3c/webauthn#1110, by @selfissued.
-
Refine introduction to compliant authenticators w3c/webauthn#1109, by @selfissued.
-
clarification of UP/UV flags in authenticator data structure w3c/webauthn#1108, by @jericks-duo.
-
Fix #1096 - Try some language to clarify in the intro that userspace is OK too w3c/webauthn#1104, by @jcjones.
-
May->might w3c/webauthn#1103, by @wseltzer.
-
Rewrite security consideration on attestation and MitM attacks w3c/webauthn#1095, by @emlun.
-
Add the word "OPTIONAL" to `userVerification` field to match surrounding style. w3c/webauthn#1094, by @lgarron.
-
In safetynet attestation "nonce" is base64, not base64url w3c/webauthn#1093, by @yackermann.
-
Fix typos in get() algorithm w3c/webauthn#1092, by @emlun.
-
Use "user handle mapped to user" language in user identification step w3c/webauthn#1091, by @emlun.
-
-
2 pull requests merged.
-
May->might w3c/webauthn#1103.
-
update token binding citation w3c/webauthn#1087.
-
-
9 pull requests received 28 new comments.
-
Rewrite security consideration on attestation and MitM attacks w3c/webauthn#1095 (6 comments by @emlun, @equalsJeffH, @selfissued)
-
Provide transport information during registration. w3c/webauthn#1050 (3 comments by @jcjones, @rlin1)
-
Add the word "OPTIONAL" to `userVerification` field to match surrounding style. w3c/webauthn#1094 (3 comments by @equalsJeffH, @lgarron, @wseltzer)
-
Clarify user identification in RP assertion verification operation w3c/webauthn#1082 (3 comments by @emlun)
-
Fix #1096 - Try some language to clarify in the intro that userspace is OK too w3c/webauthn#1104 (2 comments by @emlun, @jcjones)
-
In safetynet attestation "nonce" is base64, not base64url w3c/webauthn#1093 (2 comments by @equalsJeffH, @Kieun)
-
Participants
-
1 participant left.
-
Dmitri Zagidulin (W3C Invited Experts) left.
-
-
1 organization joined.
-
Visa joined.
-
GitHub
w3c/webauthn
-
17 issues opened.
-
No way to specify transports during registration step w3c/webauthn#1090, by @ynojima.
-
Typo clientExtensions should be authenticatorExtensions w3c/webauthn#1089, by @milesstoetzner.
-
Leap of Faith not only for Self and None Attestation Types w3c/webauthn#1088, by @milesstoetzner.
-
update token binding reference to ref the actual RFC w3c/webauthn#1086, by @equalsJeffH.
-
Typo in Figure 1? w3c/webauthn#1084, by @xfq.
-
Typo in Android SafetyNet verification procedure w3c/webauthn#1080, by @emlun.
-
Clarify which user to authenticate if userHandle is not present w3c/webauthn#1078, by @milesstoetzner.
-
Section 10: extensions are OPTIONAL w3c/webauthn#1076, by @samuelweiler.
-
Wrong Registration Ceremony Privacy Reference w3c/webauthn#1068, by @milesstoetzner.
-
Packed attestation statement format supports all types but None ? w3c/webauthn#1065, by @equalsJeffH.
-
Verify signature first in RP operations? w3c/webauthn#1064, by @emlun.
-
Adding the way to get trust anchors for CTAP1/U2F authenticators w3c/webauthn#1063, by @Kieun.
-
Missing steps of checking pubKeyCredParams during registration step at RP server w3c/webauthn#1061, by @Kieun.
-
No way to verify requireResidentKey during registration step at RP side w3c/webauthn#1060, by @Kieun.
-
Update Figure 1 to follow up the spec modification w3c/webauthn#1059, by @Kieun.
-
Editorial: WebAuthn or WebAuthN w3c/webauthn#1056, by @apowers313.
-
About the canonical CBOR encoding form w3c/webauthn#1051, by @peteroupc.
-
-
21 issues closed.
-
No way to specify transports during registration step w3c/webauthn#1090.
-
Section 10: extensions are OPTIONAL w3c/webauthn#1076.
-
FIDO U2F supports Attestation CA (AttCA)? w3c/webauthn#1042.
-
Explain how Token Binding IDs get associated with an HTML context. w3c/webauthn#360.
-
Typo in Android SafetyNet verification procedure w3c/webauthn#1080.
-
Authenticator selection extension needs to define snapshotting behavior w3c/webauthn#294.
-
cognitive-accessibility consideration w3c/webauthn#733.
-
Mobile support w3c/webauthn#1045.
-
Ensure hard-coded step references in RP ops are correct w3c/webauthn#796.
-
address needs of various webauthn spec audiences w3c/webauthn#585.
-
Wrong Registration Ceremony Privacy Reference w3c/webauthn#1068.
-
some RPs may wish to allow multiple registrations to same user account w3c/webauthn#403.
-
Update Figure 1 to follow up the spec modification w3c/webauthn#1059.
-
Pre-registration discovery for roaming authenticators w3c/webauthn#920.
-
Packed attestation statement format supports all types but None ? w3c/webauthn#1065.
-
Editorial: WebAuthn or WebAuthN w3c/webauthn#1056.
-
User agent / key management [authenticator] interoperability requirements? w3c/webauthn#1020.
-
Security threat: Username enumeration w3c/webauthn#1014.
-
Adopt consistent case for section headings w3c/webauthn#1040.
-
About the canonical CBOR encoding form w3c/webauthn#1051.
-
-
3 issues reopened.
-
Clarify which user to authenticate if userHandle is not present w3c/webauthn#1078, by @emlun.
-
FIDO U2F supports Attestation CA (AttCA)? w3c/webauthn#1042, by @emlun.
-
Document wide review w3c/webauthn#106, by @YubicoDemo.
-
-
24 issues received 72 new comments.
-
Mobile support w3c/webauthn#1045 (9 comments by @akshayku, @charlag, @emlun, @equalsJeffH, @jcjones, @rlin1)
-
Editorial: WebAuthn or WebAuthN w3c/webauthn#1056 (9 comments by @agl, @emlun, @equalsJeffH, @nadalin, @rlin1, @selfissued)
-
Authenticator selection extension needs to define snapshotting behavior w3c/webauthn#294 (5 comments by @akshayku, @bzbarsky, @equalsJeffH, @jcjones)
-
Clarify which user to authenticate if userHandle is not present w3c/webauthn#1078 (5 comments by @emlun, @milesstoetzner)
-
NULL or DOMException w3c/webauthn#876 (5 comments by @akshayku, @equalsJeffH, @selfissued, @YubicoDemo)
-
Section 10: extensions are OPTIONAL w3c/webauthn#1076 (4 comments by @jcjones, @selfissued, @YubicoDemo)
-
Ensure hard-coded step references in RP ops are correct w3c/webauthn#796 (4 comments by @emlun, @equalsJeffH)
-
No way to verify requireResidentKey during registration step at RP side w3c/webauthn#1060 (4 comments by @emlun, @Kieun)
-
Explain how Token Binding IDs get associated with an HTML context. w3c/webauthn#360 (2 comments by @equalsJeffH, @selfissued)
-
cognitive-accessibility consideration w3c/webauthn#733 (2 comments by @equalsJeffH, @JohnRochfordUMMS)
-
Ambiguous/wrong instructions in Android Key Attestation Statement Format verification procedure w3c/webauthn#1022 (2 comments by @arnar, @nadalin)
-
Update Figure 1 to follow up the spec modification w3c/webauthn#1059 (2 comments by @emlun, @equalsJeffH)
-
`CredentialRequestOptions` make otherwise valid values invalid in an undesirable way w3c/webauthn#750 (1 comment by @bzbarsky)
-
Packed attestation statement format supports all types but None ? w3c/webauthn#1065 (1 comment by @equalsJeffH)
-
Unspecified CBOR encoding of high-valued integer numbers due to unspecified threshold w3c/webauthn#1044 (1 comment by @agl)
-
-
23 pull requests opened.
-
update token binding citation w3c/webauthn#1087, by @equalsJeffH.
-
Fix typo in Figure 1 w3c/webauthn#1085, by @emlun.
-
Fix #1076 - Don't confuse extension optionality in Sec 10 w3c/webauthn#1083, by @jcjones.
-
Clarify user identification in RP assertion verification operation w3c/webauthn#1082, by @emlun.
-
Un-revert change from 8e5f2e0 reverted in daf9522 w3c/webauthn#1079, by @emlun.
-
note that obtaining a token binding ID is a client platform-specific operation w3c/webauthn#1077, by @equalsJeffH.
-
Issue #294 - Add a non-normative comment about snapshotting BufferSources w3c/webauthn#1074, by @jcjones.
-
Issue #1045 - Add Platform-Specific Implementation Guidance w3c/webauthn#1073, by @jcjones.
-
Clarify use of authorization lists in Android Key Attestation w3c/webauthn#1072, by @arnar.
-
Make implementation-specificness of attestn.verif. return values more explicit w3c/webauthn#1071, by @emlun.
-
Spell out that values expressing attestation type are implementation specific w3c/webauthn#1070, by @emlun.
-
Fix #1068: Fix a reference to privacy considerations w3c/webauthn#1069, by @emlun.
-
fix: defelopers -> developers w3c/webauthn#1067, by @samouss.
-
enumerate actual supported attstn types for packed attestation statement format w3c/webauthn#1066, by @equalsJeffH.
-
Fix #1059: Update figure 1 to agree with figure 2 on clientDataJSON naming w3c/webauthn#1062, by @emlun.
-
use 'attacker' instead of 'user' w3c/webauthn#1058, by @samuelweiler.
-
Add Credential Loss and Key Mobility section to security considerations w3c/webauthn#1057, by @emlun.
-
Adopt consistent case for section headings w3c/webauthn#1055, by @emlun.
-
Highlight Basic/AttCA ambiguity in definitions and verification procedures w3c/webauthn#1054, by @emlun.
-
PR 1052 review suggestion w3c/webauthn#1053, by @emlun.
-
fix #403: user handle - account relationship w3c/webauthn#1052, by @equalsJeffH.
-
-
21 pull requests merged.
-
Fix #1076 - Don't confuse extension optionality in Sec 10 w3c/webauthn#1083.
-
Un-revert change from 8e5f2e0 reverted in daf9522 w3c/webauthn#1079.
-
Fix typo w3c/webauthn#1081.
-
Clarify use of authorization lists in Android Key Attestation w3c/webauthn#1072.
-
Issue #294 - Add a non-normative comment about snapshotting BufferSources w3c/webauthn#1074.
-
cognitive w3c/webauthn#1075.
-
Issue #1045 - Add Platform-Specific Implementation Guidance w3c/webauthn#1073.
-
Fix #1068: Fix a reference to privacy considerations w3c/webauthn#1069.
-
Highlight Basic/AttCA ambiguity in definitions and verification procedures w3c/webauthn#1054.
-
fix #403: user handle - account relationship w3c/webauthn#1052.
-
Fix #1059: Update figure 1 to agree with figure 2 on clientDataJSON naming w3c/webauthn#1062.
-
fix: defelopers -> developers w3c/webauthn#1067.
-
add 'spec roadmap' section w3c/webauthn#375.
-
Add Credential Loss and Key Mobility section to security considerations w3c/webauthn#1057.
-
Add Username Enumeration section to privacy considerations w3c/webauthn#1036.
-
Adopt consistent case for section headings w3c/webauthn#1055.
-
use 'attacker' instead of 'user' w3c/webauthn#1058.
-
-
1 pull request closed.
-
PR 1052 review suggestion w3c/webauthn#1053.
-
-
22 pull requests received 152 new comments.
-
Provide transport information during registration. w3c/webauthn#1050 (36 comments by @agl, @akshayku, @christiaanbrand, @emlun, @equalsJeffH, @jcjones, @nadalin, @npdoty, @tomrittervg)
-
Highlight Basic/AttCA ambiguity in definitions and verification procedures w3c/webauthn#1054 (32 comments by @emlun, @equalsJeffH, @nadalin, @selfissued)
-
Clarify use of authorization lists in Android Key Attestation w3c/webauthn#1072 (10 comments by @akshayku, @arnar, @emlun, @equalsJeffH)
-
fix #403: user handle - account relationship w3c/webauthn#1052 (10 comments by @emlun, @equalsJeffH, @nadalin)
-
Add Username Enumeration section to privacy considerations w3c/webauthn#1036 (8 comments by @emlun, @equalsJeffH, @samuelweiler, @selfissued)
-
Make implementation-specificness of attestn.verif. return values more explicit w3c/webauthn#1071 (6 comments by @emlun, @equalsJeffH)
-
Clarify user identification in RP assertion verification operation w3c/webauthn#1082 (5 comments by @emlun, @equalsJeffH)
-
Add Credential Loss and Key Mobility section to security considerations w3c/webauthn#1057 (5 comments by @emlun, @equalsJeffH, @nadalin, @selfissued)
-
Fix #1076 - Don't confuse extension optionality in Sec 10 w3c/webauthn#1083 (4 comments by @akshayku, @emlun, @nadalin, @samuelweiler)
-
Fix #1068: Fix a reference to privacy considerations w3c/webauthn#1069 (3 comments by @emlun, @equalsJeffH)
-
Fix #1059: Update figure 1 to agree with figure 2 on clientDataJSON naming w3c/webauthn#1062 (3 comments by @emlun, @nadalin)
-
Issue #294 - Add a non-normative comment about snapshotting BufferSources w3c/webauthn#1074 (2 comments by @jcjones)
-
Issue #1045 - Add Platform-Specific Implementation Guidance w3c/webauthn#1073 (1 comment by @jcjones)
-
Spell out that values expressing attestation type are implementation specific w3c/webauthn#1070 (1 comment by @emlun)
-
TR publications
-
1 document published.
-
Web Authentication: An API for accessing Public Key Credentials Level 1 published as a Candidate Recommendation Snapshot. History of Web Authentication: An API for accessing Public Key Credentials Level 1
-
Participants
-
3 participants joined.
-
Brett McDowell (W3C Invited Experts) joined.
-
Jeff Hodges (Google LLC) joined.
-
Philippe Le Hegaret (W3C) joined.
-
-
1 organization joined.
-
Privakey, Inc. joined.
-
GitHub
w3c/webauthn
-
16 issues opened.
-
export definitions? w3c/webauthn#1049, by @equalsJeffH.
-
Using a smart phone as an authenticator with WebAuthn w3c/webauthn#1046, by @maranjavatraining.
-
Mobile support w3c/webauthn#1045, by @charlag.
-
Unspecified CBOR encoding of high-valued integer numbers due to unspecified threshold w3c/webauthn#1044, by @peteroupc.
-
`authData` in attestation vs `authenticatorData` in assertion naming? w3c/webauthn#1043, by @subyraman.
-
FIDO U2F supports Attestation CA (AttCA)? w3c/webauthn#1042, by @Kieun.
-
Adopt consistent case for section headings w3c/webauthn#1040, by @emlun.
-
Divide Security/Privacy Considerations into subsections by audience? w3c/webauthn#1039, by @emlun.
-
Either UV or UP should be enough w3c/webauthn#1037, by @yackermann.
-
appid extension output is inaccurate in some corner cases w3c/webauthn#1034, by @emlun.
-
Second CR not referenced from https://w3c.github.io/webauthn/ w3c/webauthn#1028, by @selfissued.
-
None hardware/device option - as for ssl client certificates w3c/webauthn#1027, by @pRiVi.
-
Credential counter must initialise as 1 w3c/webauthn#1025, by @yackermann.
-
User agent / key management [authenticator] interoperability requirements? w3c/webauthn#1020, by @mhano.
-
-
20 issues closed.
-
`authData` in attestation vs `authenticatorData` in assertion naming? w3c/webauthn#1043.
-
Using a smart phone as an authenticator with WebAuthn w3c/webauthn#1046.
-
AppID extension: protocol version number? w3c/webauthn#972.
-
bikeshed now catching existing lint in master->index.bs w3c/webauthn#936.
-
Public key rules for "packed" attestation type w3c/webauthn#981.
-
Either UV or UP should be enough w3c/webauthn#1037.
-
Minor typo in Android Key Attestation Format w3c/webauthn#1019.
-
Second CR not referenced from https://w3c.github.io/webauthn/ w3c/webauthn#1028.
-
providing info about authenticator availability / attachments w3c/webauthn#764.
-
None hardware/device option - as for ssl client certificates w3c/webauthn#1027.
-
Bad instructions in Android SafetyNet attestation validation steps w3c/webauthn#1018.
-
Tighten security scope by port w3c/webauthn#873.
-
Credential counter must initialise as 1 w3c/webauthn#1025.
-
Minor typo - FAR should be FRR w3c/webauthn#1015.
-
JSON-serialized client data is wrong w3c/webauthn#712.
-
-
1 issue reopened.
-
`authData` in attestation vs `authenticatorData` in assertion naming? w3c/webauthn#1043, by @emlun.
-
-
34 issues received 89 new comments.
-
Either UV or UP should be enough w3c/webauthn#1037 (10 comments by @akshayku, @apowers313, @emlun, @nadalin, @sbweeden, @selfissued, @yackermann)
-
`publicKey` member name in `CredentialCreationRequestOptions` should be `"public-key"`, or vice-versa? w3c/webauthn#1004 (8 comments by @agl, @bzbarsky, @equalsJeffH)
-
None hardware/device option - as for ssl client certificates w3c/webauthn#1027 (6 comments by @emlun, @pRiVi, @yackermann)
-
Ambiguous/wrong instructions in Android Key Attestation Statement Format verification procedure w3c/webauthn#1022 (5 comments by @arnar, @nadalin, @sbweeden)
-
Clarification of valid rpIdHash value requested in section 7 when using AppID extension w3c/webauthn#980 (5 comments by @agl, @emlun, @sbweeden, @selfissued)
-
`authData` in attestation vs `authenticatorData` in assertion naming? w3c/webauthn#1043 (4 comments by @apowers313, @emlun, @equalsJeffH, @subyraman)
-
Divide Security/Privacy Considerations into subsections by audience? w3c/webauthn#1039 (4 comments by @emlun, @equalsJeffH, @nadalin)
-
User agent / key management [authenticator] interoperability requirements? w3c/webauthn#1020 (4 comments by @emlun, @equalsJeffH, @nadalin)
-
Using a smart phone as an authenticator with WebAuthn w3c/webauthn#1046 (3 comments by @emlun, @equalsJeffH, @jcjones)
-
providing info about authenticator availability / attachments w3c/webauthn#764 (3 comments by @emlun, @subyraman)
-
Android-key attestation format should include guidance on checks for timestampMs in the jws payload w3c/webauthn#1035 (3 comments by @nadalin, @sbweeden)
-
address needs of various webauthn spec audiences w3c/webauthn#585 (2 comments by @apowers313, @nadalin)
-
Public key rules for "packed" attestation type w3c/webauthn#981 (2 comments by @equalsJeffH, @nadalin)
-
Indicate resident key credential "preferred" during registration and find out what the authenticator offered w3c/webauthn#991 (1 comment by @ve7jtb)
-
Authenticator selection extension needs to define snapshotting behavior w3c/webauthn#294 (1 comment by @emlun)
-
Determining length of `attestedCredentialData` when authenticator extensions present. w3c/webauthn#1012 (1 comment by @equalsJeffH)
-
Bad instructions in Android SafetyNet attestation validation steps w3c/webauthn#1018 (1 comment by @arnar)
-
Partial dictionaries for extension outputs may be incorrect use of WebIDL w3c/webauthn#988 (1 comment by @agl)
-
-
15 pull requests opened.
-
Provide transport information during registration. w3c/webauthn#1050, by @agl.
-
PR 1031: Bound Credential <dfn> w3c/webauthn#1048, by @emlun.
-
change JeffH's affilitation w3c/webauthn#1047, by @equalsJeffH.
-
Add privacy considerations about UV, PII and User Handle w3c/webauthn#1041, by @emlun.
-
[Spelling] Added missing "be" w3c/webauthn#1038, by @abergs.
-
Add Username Enumeration section to privacy considerations w3c/webauthn#1036, by @emlun.
-
Note that the appid extension changes RP ID hash w3c/webauthn#1033, by @agl.
-
Add note about actual implementations of appid. w3c/webauthn#1032, by @agl.
-
Define "bound" for credentials and use the term "scoped" where appropriate w3c/webauthn#1031, by @emlun.
-
Fix some minor editorial issues w3c/webauthn#1030, by @emlun.
-
add link to 2nd CR version w3c/webauthn#1029, by @samuelweiler.
-
Add bikeshed update to bikeshed Dockerfile w3c/webauthn#1026, by @emlun.
-
Use final name for "serialize JSON to bytes" w3c/webauthn#1024, by @domenic.
-
fix #1012 determine Attested Credential Data length w3c/webauthn#1023, by @equalsJeffH.
-
Clarify that SafetyNet response uses base64url w3c/webauthn#1021, by @arnar.
-
-
15 pull requests merged.
-
Add privacy considerations about UV, PII and User Handle w3c/webauthn#1041.
-
Define "bound" for credentials and use the term "scoped" where appropriate w3c/webauthn#1031.
-
PR 1031: Bound Credential <dfn> w3c/webauthn#1048.
-
change JeffH's affilitation w3c/webauthn#1047.
-
Add note about actual implementations of appid. w3c/webauthn#1032.
-
Note that the appid extension changes RP ID hash w3c/webauthn#1033.
-
Fix some minor editorial issues w3c/webauthn#1030.
-
fix #1012 determine Attested Credential Data length w3c/webauthn#1023.
-
[Spelling] Added missing "be" w3c/webauthn#1038.
-
add link to 2nd CR version w3c/webauthn#1029.
-
Use final name for "serialize JSON to bytes" w3c/webauthn#1024.
-
Clarify that SafetyNet response uses base64url w3c/webauthn#1021.
-
Add bikeshed update to bikeshed Dockerfile w3c/webauthn#1026.
-
fix #1015 FAR should be FRR w3c/webauthn#1016.
-
fix #712 JSON-serialized client data is wrong w3c/webauthn#1017.
-
-
1 pull request closed.
-
Include an AuthenticatorTransport when creating a new credential. w3c/webauthn#882.
-
-
19 pull requests received 94 new comments.
-
Add Username Enumeration section to privacy considerations w3c/webauthn#1036 (28 comments by @emlun, @equalsJeffH, @nadalin)
-
Add privacy considerations about UV, PII and User Handle w3c/webauthn#1041 (20 comments by @emlun, @equalsJeffH, @nadalin, @selfissued)
-
Define "bound" for credentials and use the term "scoped" where appropriate w3c/webauthn#1031 (8 comments by @emlun, @equalsJeffH, @nadalin)
-
Use final name for "serialize JSON to bytes" w3c/webauthn#1024 (4 comments by @domenic, @emlun, @nadalin)
-
Include an AuthenticatorTransport when creating a new credential. w3c/webauthn#882 (3 comments by @agl)
-
Add note about actual implementations of appid. w3c/webauthn#1032 (3 comments by @agl, @nadalin, @selfissued)
-
GitHub
w3c/webauthn
-
22 issues opened.
-
Minor typo in Android Key Attestation Format w3c/webauthn#1019, by @sbweeden.
-
Bad instructions in Android SafetyNet attestation validation steps w3c/webauthn#1018, by @sbweeden.
-
Minor typo - FAR should be FRR w3c/webauthn#1015, by @shivak.
-
Security threat: Username enumeration w3c/webauthn#1014, by @SecretPigeon.
-
SafetyNet response as an extension w3c/webauthn#1011, by @gmandyam.
-
Clarify authenticator behaviour when not implementing signature counter w3c/webauthn#1008, by @emlun.
-
Revise same-origin as ancestor requirements w3c/webauthn#1001, by @apowers313.
-
Clarify behaviour of rawId and id fields for resident key credentials w3c/webauthn#1000, by @yackermann.
-
coalesce HTML references? w3c/webauthn#996, by @equalsJeffH.
-
add captions for tables and id attrs so we can link to them w3c/webauthn#990, by @equalsJeffH.
-
Partial dictionaries for extension outputs may be incorrect use of WebIDL w3c/webauthn#988, by @emlun.
-
add abort path to createCredential alg to match that added to getAssertion alg w3c/webauthn#985, by @equalsJeffH.
-
Decoding TPM `certInfo` and `pubArea`? w3c/webauthn#984, by @subyraman.
-
authenticatorGetAssertion has no ConstraintError step for requireUserVerification w3c/webauthn#983, by @emlun.
-
What does "the extension was acted upon" mean for the AppID extension? w3c/webauthn#982, by @emlun.
-
Public key rules for "packed" attestation type w3c/webauthn#981, by @sbweeden.
-
MUST authenticators still perform self attestation? w3c/webauthn#978, by @emlun.
-
-
24 issues closed.
-
Clarify behaviour of rawId and id fields for resident key credentials w3c/webauthn#1000.
-
introductory abort language missing from [[Get]]() section w3c/webauthn#939.
-
Clarify authenticator behaviour when not implementing signature counter w3c/webauthn#1008.
-
Allow clients to stop the `get` flow when certain conditions are met w3c/webauthn#905.
-
add captions for tables and id attrs so we can link to them w3c/webauthn#990.
-
What does "the extension was acted upon" mean for the AppID extension? w3c/webauthn#982.
-
Display name content rules? w3c/webauthn#593.
-
Constrain the "reasonable range" of timeouts w3c/webauthn#364.
-
Privacy across OS accounts w3c/webauthn#96.
-
CTAP-speaking authenticators use integer-valued CBOR map keys w3c/webauthn#864.
-
authenticator taxonomy w3c/webauthn#422.
-
Grammar error in Sec 13.1 w3c/webauthn#866.
-
do not totally lose the term "WebAuthn Relying Party" w3c/webauthn#180.
-
Decoding TPM `certInfo` and `pubArea`? w3c/webauthn#984.
-
credential id privacy w3c/webauthn#140.
-
-
1 issue reopened.
-
41 issues received 170 new comments.
-
`CredentialRequestOptions` make otherwise valid values invalid in an undesirable way w3c/webauthn#750 (23 comments by @bzbarsky, @emlun, @equalsJeffH)
-
SafetyNet response as an extension w3c/webauthn#1011 (15 comments by @apowers313, @gmandyam, @ve7jtb, @yackermann)
-
truncation to 64-byte upper limit doesn't mention character boundaries w3c/webauthn#973 (15 comments by @agl, @akshayku, @aphillips, @asmusf, @emlun, @equalsJeffH, @nadalin, @stpeter)
-
What does "the extension was acted upon" mean for the AppID extension? w3c/webauthn#982 (10 comments by @agl, @akshayku, @emlun, @equalsJeffH, @selfissued)
-
Decoding TPM `certInfo` and `pubArea`? w3c/webauthn#984 (8 comments by @apowers313, @emlun, @nadalin, @subyraman, @yackermann)
-
NULL or DOMException w3c/webauthn#876 (7 comments by @akshayku, @equalsJeffH, @nadalin, @selfissued)
-
Clarify behaviour of rawId and id fields for resident key credentials w3c/webauthn#1000 (7 comments by @emlun, @equalsJeffH, @yackermann)
-
AppID extension: protocol version number? w3c/webauthn#972 (6 comments by @agl, @apowers313, @nadalin, @selfissued, @yackermann)
-
Tighten security scope by port w3c/webauthn#873 (5 comments by @annevk, @emlun, @equalsJeffH, @nadalin)
-
`publicKey` member name in `CredentialCreationRequestOptions` should be `"public-key"`, or vice-versa? w3c/webauthn#1004 (5 comments by @akshayku, @bzbarsky, @equalsJeffH)
-
Determining length of `attestedCredentialData` when authenticator extensions present. w3c/webauthn#1012 (4 comments by @equalsJeffH, @futureimperfect)
-
Revise same-origin as ancestor requirements w3c/webauthn#1001 (4 comments by @apowers313, @equalsJeffH, @mikewest, @ve7jtb)
-
authenticatorGetAssertion has no ConstraintError step for requireUserVerification w3c/webauthn#983 (4 comments by @emlun, @nadalin)
-
Integrate with Feature Policy and possibly Permissions and define appropriate identifier value for WebAuthn w3c/webauthn#911 (3 comments by @equalsJeffH, @nadalin)
-
Partial dictionaries for extension outputs may be incorrect use of WebIDL w3c/webauthn#988 (3 comments by @bzbarsky, @equalsJeffH)
-
Allow clients to stop the `get` flow when certain conditions are met w3c/webauthn#905 (3 comments by @akshayku, @equalsJeffH, @nadalin)
-
Transaction authorization extensions are registration and authentication extension? w3c/webauthn#621 (3 comments by @akshayku, @equalsJeffH, @nadalin)
-
add captions for tables and id attrs so we can link to them w3c/webauthn#990 (3 comments by @emlun, @nadalin)
-
Public key rules for "packed" attestation type w3c/webauthn#981 (3 comments by @akshayku, @emlun, @sbweeden)
-
Requesting ability to detect if there is an authenticator available which is capable of resident key credential w3c/webauthn#987 (3 comments by @akshayku, @equalsJeffH)
-
Bad instructions in Android SafetyNet attestation validation steps w3c/webauthn#1018 (2 comments by @sbweeden, @yackermann)
-
add abort path to createCredential alg to match that added to getAssertion alg w3c/webauthn#985 (2 comments by @equalsJeffH, @nadalin)
-
Clarify WebAuthn spec to allow us to return an error to RP when it makes sense w3c/webauthn#953 (2 comments by @emlun, @equalsJeffH)
-
Indicate resident key credential "preferred" during registration and find out what the authenticator offered w3c/webauthn#991 (2 comments by @emlun, @nadalin)
-
Explain how Token Binding IDs get associated with an HTML context. w3c/webauthn#360 (1 comment by @equalsJeffH)
-
Clarify authenticator behaviour when not implementing signature counter w3c/webauthn#1008 (1 comment by @akshayku)
-
need description & illustrations of overall flow: authnr <--> platform API <--> RP w3c/webauthn#24 (1 comment by @equalsJeffH)
-
Authenticator selection extension needs to define snapshotting behavior w3c/webauthn#294 (1 comment by @equalsJeffH)
-
some RPs may wish to allow multiple registrations to same user account w3c/webauthn#403 (1 comment by @emlun)
-
Consider allowing RPs to indicate that they want platform authenticators to be synced across devices w3c/webauthn#969 (1 comment by @nadalin)
-
-
20 pull requests opened.
-
fix #712 JSON-serialized client data is wrong w3c/webauthn#1017, by @equalsJeffH.
-
fix #1015 FAR should be FRR w3c/webauthn#1016, by @equalsJeffH.
-
update acks w3c/webauthn#1013, by @equalsJeffH.
-
Propose SafetyNet as an extension w3c/webauthn#1010, by @gmandyam.
-
Clarify behaviour for authnrs not implementing signature counter w3c/webauthn#1009, by @emlun.
-
fix #24: add reg & authn flow diagrams w3c/webauthn#1007, by @equalsJeffH.
-
fix #939 add intro abort language to #getAssertion w3c/webauthn#1006, by @equalsJeffH.
-
fix 985 add abort path to createCredential alg w3c/webauthn#1005, by @equalsJeffH.
-
Removed old optional counter step to remove confusions w3c/webauthn#1003, by @yackermann.
-
Make transaction authorization extensions authentication exts only w3c/webauthn#1002, by @emlun.
-
fix 933: authnr does not enforce RP ID being eTLD+1 of RP's origin w3c/webauthn#999, by @equalsJeffH.
-
Precisize "platform" and "device" terminology w3c/webauthn#998, by @emlun.
-
Replace local/remote storage terms with client/server side w3c/webauthn#997, by @emlun.
-
Disambiguate appid extension output behaviour w3c/webauthn#995, by @emlun.
-
Add table numbers and captions w3c/webauthn#994, by @emlun.
-
Replace resident key terminology as proposed in #905 w3c/webauthn#993, by @emlun.
-
Remove undefined macro reference [RP ID] w3c/webauthn#992, by @emlun.
-
Add recommendation of scoping platform credentials to OS accounts w3c/webauthn#989, by @emlun.
-
fix 864: Note regarding CTAP2 integer keys vs webauthn string keys w3c/webauthn#986, by @equalsJeffH.
-
Authenticator taxonomy: Authenticator types w3c/webauthn#979, by @emlun.
-
-
23 pull requests merged.
-
update acks w3c/webauthn#1013.
-
fix #24: add reg & authn flow diagrams w3c/webauthn#1007.
-
fix #939 add intro abort language to #getAssertion w3c/webauthn#1006.
-
fix 985 add abort path to createCredential alg w3c/webauthn#1005.
-
Clarify behaviour for authnrs not implementing signature counter w3c/webauthn#1009.
-
Precisize "platform" and "device" terminology w3c/webauthn#998.
-
Make transaction authorization extensions authentication exts only w3c/webauthn#1002.
-
Replace local/remote storage terms with client/server side w3c/webauthn#997.
-
fix 933: authnr does not enforce RP ID being eTLD+1 of RP's origin w3c/webauthn#999.
-
Add table numbers and captions w3c/webauthn#994.
-
Add two abort paths for getting an assertion w3c/webauthn#906.
-
Fix #593: employ PRECIS RFC8264 et al for 'name'-ish domstring values w3c/webauthn#951.
-
Replace resident key terminology as proposed in #905 w3c/webauthn#993.
-
Authenticator taxonomy: Authenticator types w3c/webauthn#979.
-
Disambiguate appid extension output behaviour w3c/webauthn#995.
-
fix 364 timeout reasonable range w3c/webauthn#971.
-
Add recommendation of scoping platform credentials to OS accounts w3c/webauthn#989.
-
fix 864: Note regarding CTAP2 integer keys vs webauthn string keys w3c/webauthn#986.
-
Authenticator taxonomy: Attachment modality (replaces #842) w3c/webauthn#956.
-
fix #866: clarify sentence wrt challenges w3c/webauthn#977.
-
fix #180: do not totally lose the term "WebAuthn Relying Party" w3c/webauthn#974.
-
-
3 pull requests closed.
-
Removed old optional counter step to remove confusions w3c/webauthn#1003.
-
Fix #593 - Refer to RFC 8266 for RP-controlled UI strings w3c/webauthn#878.
-
Remove undefined macro reference [RP ID] w3c/webauthn#992.
-
-
24 pull requests received 134 new comments.
-
Authenticator taxonomy: Authenticator types w3c/webauthn#979 (49 comments by @emlun, @equalsJeffH, @nadalin, @selfissued)
-
Precisize "platform" and "device" terminology w3c/webauthn#998 (31 comments by @emlun, @equalsJeffH, @nadalin, @selfissued)
-
Authenticator taxonomy: Attachment modality (replaces #842) w3c/webauthn#956 (11 comments by @emlun, @equalsJeffH, @nadalin)
-
Fix #593: employ PRECIS RFC8264 et al for 'name'-ish domstring values w3c/webauthn#951 (5 comments by @equalsJeffH, @stpeter)
-
fix #493: be explicit about "same user" is verified at get() time as was verified at create() time w3c/webauthn#976 (5 comments by @emlun, @equalsJeffH)
-
fix #24: add reg & authn flow diagrams w3c/webauthn#1007 (3 comments by @apowers313, @equalsJeffH, @nadalin)
-
Removed old optional counter step to remove confusions w3c/webauthn#1003 (3 comments by @emlun, @yackermann)
-
Add recommendation of scoping platform credentials to OS accounts w3c/webauthn#989 (3 comments by @emlun, @equalsJeffH, @nadalin)
-
fix 864: Note regarding CTAP2 integer keys vs webauthn string keys w3c/webauthn#986 (3 comments by @emlun, @nadalin)
-
fix #866: clarify sentence wrt challenges w3c/webauthn#977 (3 comments by @emlun, @equalsJeffH, @nadalin)
-
Add two abort paths for getting an assertion w3c/webauthn#906 (2 comments by @equalsJeffH, @nadalin)
-
Clarify behaviour for authnrs not implementing signature counter w3c/webauthn#1009 (1 comment by @nadalin)
-
Make transaction authorization extensions authentication exts only w3c/webauthn#1002 (1 comment by @ve7jtb)
-
Fix #593 - Refer to RFC 8266 for RP-controlled UI strings w3c/webauthn#878 (1 comment by @equalsJeffH)
-
fix #180: do not totally lose the term "WebAuthn Relying Party" w3c/webauthn#974 (1 comment by @nadalin)
-
fix #517: add rationale wrt only "valid domain" format is allowed for "effective domain" w3c/webauthn#975 (1 comment by @nadalin)
-
Participants
-
1 participant joined.
-
Yuriy Ackermann (W3C Invited Experts) joined.
-
GitHub
w3c/webauthn
-
22 issues opened.
-
truncation to 64-byte upper limit doesn't mention character boundaries w3c/webauthn#973, by @aphillips.
-
AppID extension: protocol version number? w3c/webauthn#972, by @apowers313.
-
SafetyNet Attestation Clarifications w3c/webauthn#968, by @apowers313.
-
Define meaning of "Scope" w3c/webauthn#964, by @apryamostanov.
-
Note on "RP ID" is confusing w3c/webauthn#963, by @engedy.
-
Attestation validation issues w3c/webauthn#950, by @apowers313.
-
appid extension: value when not acted upon? w3c/webauthn#948, by @apowers313.
-
use `<xmp>` uniformly for WebIDL fragments? w3c/webauthn#943, by @equalsJeffH.
-
introductory abort language missing from [[Get]]() section w3c/webauthn#939, by @equalsJeffH.
-
clean up RFC2119 language again w3c/webauthn#938, by @equalsJeffH.
-
bikeshed now catching existing lint in master->index.bs w3c/webauthn#936, by @equalsJeffH.
-
#sec-authenticator-data section implies authnr enforces RP ID being eTLD+1 w3c/webauthn#933, by @equalsJeffH.
-
clarify generation of rpIdHash w3c/webauthn#932, by @equalsJeffH.
-
Recovering from Device Loss w3c/webauthn#931, by @equalsJeffH.
-
Icon format / conversion w3c/webauthn#930, by @apowers313.
-
TPM section is missing TPMT_PUBLIC validation steps w3c/webauthn#929, by @yackermann.
-
What is FIDO client???? aka: UAF & WebAuthn? w3c/webauthn#928, by @pkuntal.
-
WebAuthn Client w3c/webauthn#927, by @pkuntal.
-
-
27 issues closed.
-
Unused terms w3c/webauthn#833.
-
appid extension: value when not acted upon? w3c/webauthn#948.
-
normalize RFC2119 language w3c/webauthn#182.
-
clean up RFC2119 language again w3c/webauthn#938.
-
Note on "RP ID" is confusing w3c/webauthn#963.
-
Attestation validation issues w3c/webauthn#950.
-
Define meaning of "Scope" w3c/webauthn#964.
-
Describe attacks on privacy that are allowed/prevented w3c/webauthn#382.
-
Add getAuthenticatorInfo to the Authenticator Model section w3c/webauthn#349.
-
Fetch intergration for WebAuthn API w3c/webauthn#354.
-
further details for authenticatorCancel operation w3c/webauthn#116.
-
Silent/touchless Authn? clarification of bit 0 in AuthenticatorData w3c/webauthn#22.
-
Meaning of missing tokenBinding in ClientCollectedData? w3c/webauthn#907.
-
Icon format / conversion w3c/webauthn#930.
-
Clarify how a user can authenticate from multiple devices w3c/webauthn#151.
-
clarify generation of rpIdHash w3c/webauthn#932.
-
use `<xmp>` uniformly for WebIDL fragments? w3c/webauthn#943.
-
Delete per RP ID Signature counters w3c/webauthn#871.
-
Allow hot-plugged authenticators? w3c/webauthn#613.
-
What is FIDO client???? aka: UAF & WebAuthn? w3c/webauthn#928.
-
WebAuthn Client w3c/webauthn#927.
-
-
1 issue reopened.
-
Allow hot-plugged authenticators? w3c/webauthn#613, by @emlun.
-
-
45 issues received 153 new comments.
-
Attestation validation issues w3c/webauthn#950 (13 comments by @apowers313, @arshadnoor, @emlun, @gmandyam, @yackermann)
-
Consider allowing RPs to indicate that they want platform authenticators to be synced across devices w3c/webauthn#969 (11 comments by @emlun, @equalsJeffH, @Kieun, @ptoomey3, @rlin1)
-
What is FIDO client???? aka: UAF & WebAuthn? w3c/webauthn#928 (10 comments by @akshayku, @emlun, @equalsJeffH, @pkuntal, @yackermann)
-
Clarify WebAuthn spec to allow us to return an error to RP when it makes sense w3c/webauthn#953 (9 comments by @emlun, @equalsJeffH, @nadalin, @selfissued)
-
appid extension: value when not acted upon? w3c/webauthn#948 (8 comments by @apowers313, @emlun, @equalsJeffH, @selfissued)
-
bikeshed now catching existing lint in master->index.bs w3c/webauthn#936 (8 comments by @emlun, @equalsJeffH)
-
truncation to 64-byte upper limit doesn't mention character boundaries w3c/webauthn#973 (5 comments by @aphillips, @emlun, @equalsJeffH)
-
SafetyNet Attestation Clarifications w3c/webauthn#968 (5 comments by @emlun, @equalsJeffH, @yackermann)
-
How do I use a smart phone as an authenticator when the web application is running on a laptop/desktop? w3c/webauthn#954 (5 comments by @emlun, @roblapp, @selfissued)
-
need description & illustrations of overall flow: authnr <--> platform API <--> RP w3c/webauthn#24 (4 comments by @apowers313, @equalsJeffH)
-
#sec-authenticator-data section implies authnr enforces RP ID being eTLD+1 w3c/webauthn#933 (4 comments by @emlun, @equalsJeffH, @nadalin, @selfissued)
-
Add clearer definition of API use cases to the spec w3c/webauthn#334 (3 comments by @christiaanbrand, @equalsJeffH, @nadalin)
-
TPM section is missing TPMT_PUBLIC validation steps w3c/webauthn#929 (3 comments by @akshayku, @selfissued, @yackermann)
-
Allow clients to stop the `get` flow when certain conditions are met w3c/webauthn#905 (3 comments by @emlun, @equalsJeffH)
-
Authenticator selection extension needs to define snapshotting behavior w3c/webauthn#294 (2 comments by @bzbarsky, @equalsJeffH)
-
`CredentialRequestOptions` make otherwise valid values invalid in an undesirable way w3c/webauthn#750 (2 comments by @bzbarsky, @equalsJeffH)
-
CTAP-speaking authenticators use integer-valued CBOR map keys w3c/webauthn#864 (2 comments by @equalsJeffH)
-
introductory abort language missing from [[Get]]() section w3c/webauthn#939 (2 comments by @equalsJeffH, @selfissued)
-
Add getAuthenticatorInfo to the Authenticator Model section w3c/webauthn#349 (2 comments by @AngeloKai)
-
Silent/touchless Authn? clarification of bit 0 in AuthenticatorData w3c/webauthn#22 (2 comments by @AngeloKai)
-
Integrate with Feature Policy and possibly Permissions and define appropriate identifier value for WebAuthn w3c/webauthn#911 (2 comments by @equalsJeffH, @selfissued)
-
document why only "valid domain" format is allowed for "effective domain" w3c/webauthn#517 (1 comment by @equalsJeffH)
-
Microsoft edge Webauthn APIs makecredential throws DOMException 9 (Not SupportedError) w3c/webauthn#965 (1 comment by @emlun)
-
cleanup: mark & structure biblio references consistently w3c/webauthn#872 (1 comment by @selfissued)
-
isUserVerifyingPlatformAuthenticatorAvailable() timeout really 10 minutes? w3c/webauthn#575 (1 comment by @equalsJeffH)
-
-
29 pull requests opened.
-
fix #866: clarify sentence wrt challenges w3c/webauthn#977, by @equalsJeffH.
-
fix #180: do not totally lose the term "WebAuthn Relying Party" w3c/webauthn#974, by @equalsJeffH.
-
fix 364 timeout reasonable range w3c/webauthn#971, by @equalsJeffH.
-
revise RP ID definition and Note w3c/webauthn#970, by @equalsJeffH.
-
ignored extn does not return a value w3c/webauthn#967, by @equalsJeffH.
-
Added TPM verification clarifications w3c/webauthn#966, by @yackermann.
-
Allow client to return NotAllowedError early if success is impossible w3c/webauthn#962, by @emlun.
-
Correct usage of RFC 2119 keywords again w3c/webauthn#961, by @selfissued.
-
Tone back trust assumption in authn ceremony structures section w3c/webauthn#960, by @emlun.
-
Mention rate limiting in UV definition w3c/webauthn#959, by @emlun.
-
Address review comment w3c/webauthn#958, by @emlun.
-
Introduce WebAuthn Client Device term w3c/webauthn#957, by @emlun.
-
Authenticator taxonomy: Attachment modality (replaces #842) w3c/webauthn#956, by @emlun.
-
Introduce WebAuthn Client Device term w3c/webauthn#955, by @emlun.
-
Improve clarity of |x5c| in packed and tpm attstmt verification procedures w3c/webauthn#952, by @emlun.
-
Fix #593: employ PRECIS RFC8264 et al for 'name'-ish domstring values w3c/webauthn#951, by @equalsJeffH.
-
Replace <pre class="idl">s with <xmp>s w3c/webauthn#949, by @emlun.
-
Update web-platform-tests URLs w3c/webauthn#947, by @foolip.
-
Add experimental Travis build with no Bikeshed cache w3c/webauthn#946, by @emlun.
-
Review of PR #944 w3c/webauthn#945, by @emlun.
-
improve #936: existing linking lint w3c/webauthn#944, by @equalsJeffH.
-
Add Dockerfile with Bikeshed installed w3c/webauthn#942, by @emlun.
-
Specify extension types in listing instead of prose w3c/webauthn#941, by @emlun.
-
PR #900 post-merge review changes w3c/webauthn#940, by @emlun.
-
Note that the icon URL may be a data: URL w3c/webauthn#937, by @agl.
-
Per Credential Signature Counters w3c/webauthn#935, by @akshayku.
-
fix issue #932 clarify rpIdHash generation, minor editorial linking w3c/webauthn#934, by @equalsJeffH.
-
-
28 pull requests merged.
-
Tone back trust assumption in authn ceremony structures section w3c/webauthn#960.
-
ignored extn does not return a value w3c/webauthn#967.
-
Correct usage of RFC 2119 keywords again w3c/webauthn#961.
-
revise RP ID definition and Note w3c/webauthn#970.
-
Document prevention of attacks on privacy w3c/webauthn#899.
-
Specify extension types in listing instead of prose w3c/webauthn#941.
-
Mention rate limiting in UV definition w3c/webauthn#959.
-
Introduce WebAuthn Client Device term w3c/webauthn#957.
-
Address review comment w3c/webauthn#958.
-
Eliminate the “not-supported” option for tokenBinding.status w3c/webauthn#914.
-
Add example of new device enrollment via roaming authenticator w3c/webauthn#884.
-
Note that the icon URL may be a data: URL w3c/webauthn#937.
-
fix issue #932 clarify rpIdHash generation, minor editorial linking w3c/webauthn#934.
-
Replace <pre class="idl">s with <xmp>s w3c/webauthn#949.
-
Add experimental Travis build with no Bikeshed cache w3c/webauthn#946.
-
Add Dockerfile with Bikeshed installed w3c/webauthn#942.
-
Update web-platform-tests URLs w3c/webauthn#947.
-
improve #936: existing linking lint w3c/webauthn#944.
-
Per Credential Signature Counters w3c/webauthn#935.
-
Review of PR #944 w3c/webauthn#945.
-
PR #900 post-merge review changes w3c/webauthn#940.
-
Finish up hot-plugging algorithm language w3c/webauthn#900.
-
Fixed example with incorrect allowCredential. Improved existing examples w3c/webauthn#888.
-
Trim unnecessary step from appId extension w3c/webauthn#910.
-
Adopt definition list markdown notation for dfn blocks w3c/webauthn#901.
-
Remove (probably) outdated inline issue 2 w3c/webauthn#908.
-
-
4 pull requests closed.
-
Allow client to return NotAllowedError early if success is impossible w3c/webauthn#962.
-
Merge {#sample-scenarios} section with the {#usecase} section w3c/webauthn#501.
-
WIP: Authenticator taxonomy w3c/webauthn#842.
-
Introduce WebAuthn Client Device term w3c/webauthn#955.
-
-
38 pull requests received 292 new comments.
-
Document prevention of attacks on privacy w3c/webauthn#899 (55 comments by @emlun, @equalsJeffH, @jyasskin, @nadalin)
-
Allow client to return NotAllowedError early if success is impossible w3c/webauthn#962 (24 comments by @emlun, @equalsJeffH, @selfissued)
-
Fix #593: employ PRECIS RFC8264 et al for 'name'-ish domstring values w3c/webauthn#951 (24 comments by @aphillips, @emlun, @equalsJeffH, @selfissued, @stpeter)
-
Add example of new device enrollment via roaming authenticator w3c/webauthn#884 (24 comments by @emlun, @equalsJeffH)
-
Add two abort paths for getting an assertion w3c/webauthn#906 (16 comments by @agl, @emlun, @equalsJeffH, @nadalin)
-
Added TPM verification clarifications w3c/webauthn#966 (15 comments by @apowers313, @emlun, @equalsJeffH, @yackermann)
-
Merge {#sample-scenarios} section with the {#usecase} section w3c/webauthn#501 (8 comments by @AngeloKai, @equalsJeffH, @nadalin)
-
Specify extension types in listing instead of prose w3c/webauthn#941 (8 comments by @emlun, @equalsJeffH, @nadalin, @selfissued)
-
Add Dockerfile with Bikeshed installed w3c/webauthn#942 (7 comments by @emlun, @equalsJeffH, @nadalin)
-
Tone back trust assumption in authn ceremony structures section w3c/webauthn#960 (6 comments by @emlun, @equalsJeffH)
-
Remove mention of a timeout for isUserVerifyingPlatformAuthenticatorAvailable w3c/webauthn#904 (6 comments by @agl, @equalsJeffH, @nadalin)
-
Eliminate the “not-supported” option for tokenBinding.status w3c/webauthn#914 (5 comments by @agl, @emlun, @equalsJeffH, @nadalin)
-
Authenticator taxonomy: Attachment modality (replaces #842) w3c/webauthn#956 (4 comments by @emlun, @equalsJeffH)
-
Add experimental Travis build with no Bikeshed cache w3c/webauthn#946 (4 comments by @emlun, @equalsJeffH, @jcjones, @nadalin)
-
ignored extn does not return a value w3c/webauthn#967 (3 comments by @emlun, @equalsJeffH, @nadalin)
-
fix issue #932 clarify rpIdHash generation, minor editorial linking w3c/webauthn#934 (3 comments by @emlun, @equalsJeffH, @nadalin)
-
Fixed example with incorrect allowCredential. Improved existing examples w3c/webauthn#888 (3 comments by @emlun, @nadalin, @wseltzer)
-
fix #180: do not totally lose the term "WebAuthn Relying Party" w3c/webauthn#974 (2 comments by @emlun, @equalsJeffH)
-
Improve clarity of |x5c| in packed and tpm attstmt verification procedures w3c/webauthn#952 (1 comment by @nadalin)
-
Participants
-
1 organization left.
-
Ministerio do Planejamento Orcamento e Gestao left.
-
GitHub
w3c/webauthn
-
17 issues opened.
-
Recommend that RPs store the signature algorithm? w3c/webauthn#926, by @subyraman.
-
How can i use biometric sensor auth w3c/webauthn#925, by @GraxMonzo.
-
Location extension description is inconsistent with processing w3c/webauthn#923, by @emlun.
-
Adopt consistent formatting for Boolean values w3c/webauthn#921, by @emlun.
-
Pre-registration discovery for roaming authenticators w3c/webauthn#920, by @skylerberg.
-
cccccchvcjfnifurecklfftifkidhcuhdnrtgrrrfciv w3c/webauthn#919, by @skylerberg.
-
Webauthn for proxy authentication w3c/webauthn#917, by @simkim.
-
Windows Hello support w3c/webauthn#916, by @yumingcao-okta.
-
Serialise a number w3c/webauthn#915, by @jakearchibald.
-
Possibility of client-only implementation of authenticator extensions? w3c/webauthn#912, by @dwaite.
-
Meaning of missing tokenBinding in ClientCollectedData? w3c/webauthn#907, by @dwaite.
-
Allow clients to stop the `get` flow when certain conditions are met w3c/webauthn#905, by @agl.
-
Client-generated challenges w3c/webauthn#902, by @davedoesdev.
-
update FIDO spec references to link to latest revisions w3c/webauthn#898, by @equalsJeffH.
-
Replace [[FIDOReg]] with [[FIDO-Registry]]? w3c/webauthn#894, by @emlun.
-
Reference FIDO Registry for raw EC public key format w3c/webauthn#891, by @emlun.
-
-
26 issues closed.
-
Recommend that RPs store the signature algorithm? w3c/webauthn#926.
-
How can i use biometric sensor auth w3c/webauthn#925.
-
update FIDO spec references to link to latest revisions w3c/webauthn#898.
-
Possibility of client-only implementation of authenticator extensions? w3c/webauthn#912.
-
Adopt consistent formatting for Boolean values w3c/webauthn#921.
-
Location extension description is inconsistent with processing w3c/webauthn#923.
-
Webauthn for proxy authentication w3c/webauthn#917.
-
Windows Hello support w3c/webauthn#916.
-
cccccchvcjfnifurecklfftifkidhcuhdnrtgrrrfciv w3c/webauthn#919.
-
Serialise a number w3c/webauthn#915.
-
Client-generated challenges w3c/webauthn#902.
-
Replace [[FIDOReg]] with [[FIDO-Registry]]? w3c/webauthn#894.
-
RP guidelines should allow RP to not check attestation w3c/webauthn#576.
-
Propose procedure for adding to attestation/extension registry w3c/webauthn#303.
-
Review of WD08 w3c/webauthn#831.
-
Move {#sample-scenarios} (currently Section 10) to the top of the doc w3c/webauthn#301.
-
Reference FIDO Registry for raw EC public key format w3c/webauthn#891.
-
Description of CollectedClientData is outdated w3c/webauthn#870.
-
cleanup: interstital blank line w3c/webauthn#875.
-
Missing 'transports' description w3c/webauthn#852.
-
RP UP verification instruction is weird w3c/webauthn#848.
-
Clarify U2F attestation verification w3c/webauthn#857.
-
Clarify examples: 1.1.1. Registration / 1.1.2. Authentication w3c/webauthn#874.
-
-
2 issues reopened.
-
Client-generated challenges w3c/webauthn#902, by @emlun.
-
Privacy section may wish to discuss recommended user-agent responses to leaks w3c/webauthn#454, by @emlun.
-
-
35 issues received 103 new comments.
-
Meaning of missing tokenBinding in ClientCollectedData? w3c/webauthn#907 (11 comments by @agl, @arnar, @dwaite, @emlun, @equalsJeffH, @jcjones, @kpaulh, @selfissued)
-
isUserVerifyingPlatformAuthenticatorAvailable() timeout really 10 minutes? w3c/webauthn#575 (11 comments by @akshayku, @christiaanbrand, @emlun, @equalsJeffH, @kpaulh, @nadalin)
-
Replace [[FIDOReg]] with [[FIDO-Registry]]? w3c/webauthn#894 (8 comments by @emlun, @equalsJeffH, @rlin1, @selfissued)
-
Possibility of client-only implementation of authenticator extensions? w3c/webauthn#912 (6 comments by @arnar, @dwaite, @equalsJeffH, @nadalin, @selfissued)
-
Platform authenticators and key stores w3c/webauthn#851 (5 comments by @emlun, @equalsJeffH, @selfissued)
-
Pre-registration discovery for roaming authenticators w3c/webauthn#920 (4 comments by @emlun, @equalsJeffH, @jcjones, @selfissued)
-
update FIDO spec references to link to latest revisions w3c/webauthn#898 (4 comments by @emlun, @equalsJeffH, @rlin1)
-
Allow clients to stop the `get` flow when certain conditions are met w3c/webauthn#905 (4 comments by @agl, @emlun, @nadalin)
-
Recommend that RPs store the signature algorithm? w3c/webauthn#926 (3 comments by @emlun, @equalsJeffH, @subyraman)
-
Privacy section may wish to discuss recommended user-agent responses to leaks w3c/webauthn#454 (3 comments by @agl, @emlun)
-
Integrate with Feature Policy and possibly Permissions and define appropriate identifier value for WebAuthn w3c/webauthn#911 (2 comments by @jcjones, @selfissued)
-
CTAP-speaking authenticators use integer-valued CBOR map keys w3c/webauthn#864 (2 comments by @equalsJeffH, @selfissued)
-
some RPs may wish to allow multiple registrations to same user account w3c/webauthn#403 (2 comments by @emlun, @equalsJeffH)
-
Reference FIDO Registry for raw EC public key format w3c/webauthn#891 (2 comments by @emlun, @yackermann)
-
Location extension description is inconsistent with processing w3c/webauthn#923 (1 comment by @gmandyam)
-
Add clearer definition of API use cases to the spec w3c/webauthn#334 (1 comment by @christiaanbrand)
-
Propose procedure for adding to attestation/extension registry w3c/webauthn#303 (1 comment by @selfissued)
-
document preventions of RP-driven de-anonymization attempts in privacy-cons w3c/webauthn#743 (1 comment by @emlun)
-
Move {#sample-scenarios} (currently Section 10) to the top of the doc w3c/webauthn#301 (1 comment by @selfissued)
-
-
20 pull requests opened.
-
Modify Location Extension description w3c/webauthn#924, by @gmandyam.
-
Fix formatting of Boolean values and type name w3c/webauthn#922, by @emlun.
-
Eliminate the “not-supported” option for tokenBinding.status w3c/webauthn#914, by @agl.
-
Update FIDO references to newer documents w3c/webauthn#913, by @emlun.
-
Trim unnecessary step from appId extension w3c/webauthn#910, by @kpaulh.
-
Add registration/authentication extensions for cloud-assisted BLE w3c/webauthn#909, by @kpaulh.
-
Remove (probably) outdated inline issue 2 w3c/webauthn#908, by @emlun.
-
Add two abort paths for getting an assertion w3c/webauthn#906, by @agl.
-
Remove mention of a timeout for isUserVerifyingPlatformAuthenticatorAvailable w3c/webauthn#904, by @agl.
-
Add an “internal” AuthenticatorTransport. w3c/webauthn#903, by @agl.
-
Adopt definition list markdown notation for dfn blocks w3c/webauthn#901, by @emlun.
-
Finish up hot-plugging algorithm language w3c/webauthn#900, by @emlun.
-
Document prevention of attacks on privacy w3c/webauthn#899, by @emlun.
-
Replace [[FIDOReg]] with [[FIDO-Registry]] w3c/webauthn#897, by @emlun.
-
Track initial COSE algorithm registrations made for WebAuthn w3c/webauthn#896, by @selfissued.
-
draft-jones-webauthn-cose-algorithms-01 w3c/webauthn#895, by @selfissued.
-
Reference [[FIDO-Registry]] for raw EC public key format w3c/webauthn#893, by @emlun.
-
Use |authData| in both RP operations w3c/webauthn#892, by @emlun.
-
fix non-`null` breakage by using plain "non-null" w3c/webauthn#890, by @equalsJeffH.
-
-
21 pull requests merged.
-
Update FIDO references to newer documents w3c/webauthn#913.
-
Fix formatting of Boolean values and type name w3c/webauthn#922.
-
Modify Location Extension description w3c/webauthn#924.
-
Add an “internal” AuthenticatorTransport. w3c/webauthn#903.
-
Replace [[FIDOReg]] with [[FIDO-Registry]] w3c/webauthn#897.
-
Add RP conformance section on ignoring attestation w3c/webauthn#829.
-
Track initial COSE algorithm registrations made for WebAuthn w3c/webauthn#896.
-
draft-jones-webauthn-cose-algorithms-01 w3c/webauthn#895.
-
Reference [[FIDO-Registry]] for raw EC public key format w3c/webauthn#893.
-
Fixed incorrect field size that makes all letters to overlap each other w3c/webauthn#887.
-
Clarify the U2F Attestation format to have a single certificate w3c/webauthn#836.
-
Change "with string-valued keys" to "whose keys are strings" w3c/webauthn#880.
-
Use |authData| in both RP operations w3c/webauthn#892.
-
Add missing description of PublicKeyCredentialDescriptor.transports w3c/webauthn#860.
-
Fix #848: Weirdness in RP UP verification w3c/webauthn#849.
-
Add note about verifying U2F assertion signatures w3c/webauthn#850.
-
Clarify U2F attestation verification instructions w3c/webauthn#861.
-
fix non-`null` breakage by using plain "non-null" w3c/webauthn#890.
-
Clean up cross-spec refs in PR #861 w3c/webauthn#883.
-
30 pull requests received 186 new comments.
-
Include an AuthenticatorTransport when creating a new credential. w3c/webauthn#882 (34 comments by @agl, @akshayku, @christiaanbrand, @emlun, @equalsJeffH, @jcjones, @nadalin, @selfissued)
-
Add example of new device enrollment via roaming authenticator w3c/webauthn#884 (18 comments by @akshayku, @emlun)
-
Fixed example with incorrect allowCredential. Improved existing examples w3c/webauthn#888 (11 comments by @emlun, @equalsJeffH, @selfissued, @yackermann)
-
Fix #593 - Refer to RFC 8266 for RP-controlled UI strings w3c/webauthn#878 (11 comments by @akshayku, @aphillips, @emlun, @equalsJeffH, @jcjones, @stpeter)
-
Add registration/authentication extensions for cloud-assisted BLE w3c/webauthn#909 (9 comments by @kpaulh, @nadalin, @selfissued)
-
Clarify U2F attestation verification instructions w3c/webauthn#861 (9 comments by @emlun, @equalsJeffH, @nadalin, @yackermann)
-
Trim unnecessary step from appId extension w3c/webauthn#910 (8 comments by @emlun, @kpaulh, @nadalin)
-
Add RP conformance section on ignoring attestation w3c/webauthn#829 (8 comments by @emlun, @equalsJeffH, @nadalin)
-
Fixed incorrect field size that makes all letters to overlap each other w3c/webauthn#887 (8 comments by @equalsJeffH, @nadalin, @samuelweiler, @yackermann)
-
Add two abort paths for getting an assertion w3c/webauthn#906 (6 comments by @agl, @emlun, @equalsJeffH, @nadalin)
-
Add missing description of PublicKeyCredentialDescriptor.transports w3c/webauthn#860 (5 comments by @emlun, @equalsJeffH)
-
Ask for tests for normative changes in CONTRIBUTING.md w3c/webauthn#653 (4 comments by @equalsJeffH, @foolip)
-
Reference [[FIDO-Registry]] for raw EC public key format w3c/webauthn#893 (4 comments by @emlun, @equalsJeffH, @nadalin)
-
Eliminate the “not-supported” option for tokenBinding.status w3c/webauthn#914 (3 comments by @agl, @emlun, @equalsJeffH)
-
Create draft-jones-webauthn-secp256k1 to register secp256k1 curve and algorithm identifiers w3c/webauthn#918 (3 comments by @agl, @selfissued)
-
Remove mention of a timeout for isUserVerifyingPlatformAuthenticatorAvailable w3c/webauthn#904 (2 comments by @agl, @emlun)
-
Clarify that authentication use case example requires pairing the phone first w3c/webauthn#881 (1 comment by @nadalin)
-
Change "with string-valued keys" to "whose keys are strings" w3c/webauthn#880 (1 comment by @nadalin)
-
Clarify the U2F Attestation format to have a single certificate w3c/webauthn#836 (1 comment by @nadalin)
-
Participants
-
1 organization joined.
-
Consensys joined.
-
GitHub
w3c/webauthn
-
18 issues opened.
-
Return the employed AuthenticatorTransport when creating a new credential w3c/webauthn#889, by @equalsJeffH.
-
Does it require a JavaScript library? w3c/webauthn#886, by @matl876.
-
The RS1 IANA COSE Algorithm registration doesn't match the value in the spec w3c/webauthn#885, by @selfissued.
-
Use |authData| instead of |aData| and |adata| in RP assertion verification operation w3c/webauthn#879, by @emlun.
-
NULL or DOMException w3c/webauthn#876, by @AngeloKai.
-
cleanup: interstital blank line w3c/webauthn#875, by @equalsJeffH.
-
Clarify examples: 1.1.1. Registration / 1.1.2. Authentication w3c/webauthn#874, by @binaryanomaly.
-
Tighten security scope by port w3c/webauthn#873, by @annevk.
-
cleanup: mark & structure biblio references consistently w3c/webauthn#872, by @equalsJeffH.
-
Delete per RP ID Signature counters w3c/webauthn#871, by @limpkin.
-
Description of CollectedClientData is outdated w3c/webauthn#870, by @emlun.
-
Obfuscate Safetynet nonce w3c/webauthn#868, by @leshi.
-
What is the point of `allowCredentials`? w3c/webauthn#867, by @subyraman.
-
Grammar error in Sec 13.1 w3c/webauthn#866, by @sparticvs.
-
Portability of private keys w3c/webauthn#865, by @valentin-huebner.
-
CTAP-speaking authenticators use integer-valued CBOR map keys w3c/webauthn#864, by @equalsJeffH.
-
CTAP alignment: Authenticator ops UP option w3c/webauthn#862, by @emlun.
-
-
9 issues closed.
-
Does it require a JavaScript library? w3c/webauthn#886.
-
assertionChallenge recommendations w3c/webauthn#85.
-
Clarify byte size requirements for UVI w3c/webauthn#823.
-
Obfuscate Safetynet nonce w3c/webauthn#868.
-
Portability of private keys w3c/webauthn#865.
-
CTAP alignment: Authenticator ops UP option w3c/webauthn#862.
-
AttestationResponse vs AssertionResponse w3c/webauthn#854.
-
Add CR link to the editor's draft w3c/webauthn#855.
-
Need to fix abort operation example w3c/webauthn#844.
-
-
1 issue reopened.
-
Obfuscate Safetynet nonce w3c/webauthn#868, by @leshi.
-
-
21 issues received 76 new comments.
-
Authenticators that do not recognize any handles shouldn't just be dropped on the floor w3c/webauthn#863 (11 comments by @christiaanbrand, @emlun, @equalsJeffH, @kpaulh)
-
Delete per RP ID Signature counters w3c/webauthn#871 (9 comments by @agl, @emlun, @equalsJeffH, @limpkin, @rlin1, @selfissued)
-
What is the point of `allowCredentials`? w3c/webauthn#867 (7 comments by @emlun, @equalsJeffH, @kpaulh, @yackermann)
-
Portability of private keys w3c/webauthn#865 (7 comments by @emlun, @Kieun, @limpkin, @selfissued, @valentin-huebner)
-
Clarify examples: 1.1.1. Registration / 1.1.2. Authentication w3c/webauthn#874 (6 comments by @binaryanomaly, @emlun, @equalsJeffH, @Kieun)
-
Description of CollectedClientData is outdated w3c/webauthn#870 (4 comments by @arnar, @emlun, @equalsJeffH)
-
Propose procedure for adding to attestation/extension registry w3c/webauthn#303 (2 comments by @equalsJeffH, @nadalin)
-
Silent/touchless Authn? clarification of bit 0 in AuthenticatorData w3c/webauthn#22 (1 comment by @rlin1)
-
-
13 pull requests opened.
-
Fixed example with incorrect allowCredential. Improved existing examples w3c/webauthn#888, by @yackermann.
-
Fixed incorrect field size that makes all letters to overlap each other w3c/webauthn#887, by @yackermann.
-
Add example of new device enrollment via roaming authenticator w3c/webauthn#884, by @emlun.
-
Clean up cross-spec refs in PR #861 w3c/webauthn#883, by @emlun.
-
Include an AuthenticatorTransport when creating a new credential. w3c/webauthn#882, by @agl.
-
Clarify that authentication use case example requires pairing the phone first w3c/webauthn#881, by @emlun.
-
Change "with string-valued keys" to "whose keys are strings" w3c/webauthn#880, by @emlun.
-
Fix #593 - Refer to RFC 8266 for RP-controlled UI strings w3c/webauthn#878, by @jcjones.
-
Obfuscate Safetynet nonce w3c/webauthn#869, by @leshi.
-
Clarify U2F attestation verification instructions w3c/webauthn#861, by @emlun.
-
Add missing description of PublicKeyCredentialDescriptor.transports w3c/webauthn#860, by @emlun.
-
Allow client to refuse too short challenges w3c/webauthn#859, by @emlun.
-
Add recommendation of challenge length w3c/webauthn#858, by @emlun.
-
-
6 pull requests merged.
-
Add recommendation of challenge length w3c/webauthn#858.
-
UVI modification with CDDL w3c/webauthn#821.
-
Obfuscate Safetynet nonce w3c/webauthn#869.
-
Address review comments by @kieun w3c/webauthn#832.
-
Emphasise that the CollectedClientData can be extended. w3c/webauthn#827.
-
fix 855: add link to CR w3c/webauthn#856.
-
-
1 pull request closed.
-
Allow client to refuse too short challenges w3c/webauthn#859.
-
-
17 pull requests received 115 new comments.
-
Add RP conformance section on ignoring attestation w3c/webauthn#829 (32 comments by @emlun, @equalsJeffH, @rlin1)
-
Add example of new device enrollment via roaming authenticator w3c/webauthn#884 (13 comments by @equalsJeffH)
-
Fix #848: Weirdness in RP UP verification w3c/webauthn#849 (13 comments by @akshayku, @emlun, @equalsJeffH)
-
Include an AuthenticatorTransport when creating a new credential. w3c/webauthn#882 (12 comments by @agl, @christiaanbrand, @equalsJeffH)
-
Add missing description of PublicKeyCredentialDescriptor.transports w3c/webauthn#860 (7 comments by @emlun, @equalsJeffH)
-
Clarify U2F attestation verification instructions w3c/webauthn#861 (5 comments by @emlun, @equalsJeffH, @yackermann)
-
Allow client to refuse too short challenges w3c/webauthn#859 (3 comments by @akshayku, @emlun, @jcjones)
-
Add note about verifying U2F assertion signatures w3c/webauthn#850 (2 comments by @emlun, @equalsJeffH)
-
Clarify that authentication use case example requires pairing the phone first w3c/webauthn#881 (1 comment by @equalsJeffH)
-
Fixed example with incorrect allowCredential. Improved existing examples w3c/webauthn#888 (1 comment by @emlun)
-
Fixed incorrect field size that makes all letters to overlap each other w3c/webauthn#887 (1 comment by @yackermann)
-
Clarify the U2F Attestation format to have a single certificate w3c/webauthn#836 (1 comment by @selfissued)
-
TR publications
-
3 documents published.
-
Web Authentication: An API for accessing Public Key Credentials Level 1 published as a Candidate Recommendation Snapshot. History of Web Authentication: An API for accessing Public Key Credentials Level 1
-
GitHub
w3c/webauthn
-
16 issues opened.
-
Clarify U2F attestation verification w3c/webauthn#857, by @apowers313.
-
Add CR link to the editor's draft w3c/webauthn#855, by @AngeloKai.
-
AttestationResponse vs AssertionResponse w3c/webauthn#854, by @apowers313.
-
AppID / origin w3c/webauthn#853, by @apowers313.
-
Missing 'transports' description w3c/webauthn#852, by @apowers313.
-
Platform authenticators and key stores w3c/webauthn#851, by @idamlaj.
-
RP UP verification instruction is weird w3c/webauthn#848, by @emlun.
-
Write blog post w3c/webauthn#846, by @samuelweiler.
-
Need to fix abort operation example w3c/webauthn#844, by @Kieun.
-
Most recent Process (2018) has a different list for maturity levels w3c/webauthn#841, by @koalie.
-
remove Johan as contributor w3c/webauthn#838, by @samuelweiler.
-
Candidate recommendation exit criteria w3c/webauthn#837, by @samuelweiler.
-
Unused terms w3c/webauthn#833, by @emlun.
-
Review of WD08 w3c/webauthn#831, by @Kieun.
-
-
10 issues closed.
-
Images not visible in published spec w3c/webauthn#784.
-
AppID / origin w3c/webauthn#853.
-
note that "credential public key" is the same as "user's public key" w3c/webauthn#540.
-
Examples should include non-ASCII [editorial] w3c/webauthn#594.
-
ECDAA verification algorithm in TPM Attestation Statement Format w3c/webauthn#433.
-
Write blog post w3c/webauthn#846.
-
Most recent Process (2018) has a different list for maturity levels w3c/webauthn#841.
-
remove Johan as contributor w3c/webauthn#838.
-
-
2 issues reopened.
-
Images not visible in published spec w3c/webauthn#784, by @equalsJeffH.
-
21 issues received 65 new comments.
-
Candidate recommendation exit criteria w3c/webauthn#837 (14 comments by @emlun, @equalsJeffH, @nadalin, @samuelweiler, @selfissued)
-
Images not visible in published spec w3c/webauthn#784 (7 comments by @deniak, @equalsJeffH, @wseltzer)
-
ECDAA verification algorithm in TPM Attestation Statement Format w3c/webauthn#433 (4 comments by @equalsJeffH, @rlin1, @selfissued)
-
vestigial remainders leftover from not completely removing client extension data from client data w3c/webauthn#828 (4 comments by @equalsJeffH, @rlin1, @selfissued)
-
AttestationResponse vs AssertionResponse w3c/webauthn#854 (3 comments by @arnar, @emlun, @equalsJeffH)
-
Assertion signature verification procedure defined in Section 7.2 doesn't fit for the signature generated by FIDO-U2F token. w3c/webauthn#845 (3 comments by @emlun, @ynojima)
-
Most recent Process (2018) has a different list for maturity levels w3c/webauthn#841 (1 comment by @equalsJeffH)
-
-
16 pull requests opened.
-
fix 855: add link to CR w3c/webauthn#856, by @equalsJeffH.
-
Add note about verifying U2F assertion signatures w3c/webauthn#850, by @emlun.
-
Fix #848: Weirdness in RP UP verification w3c/webauthn#849, by @emlun.
-
Fix an example for aborting operations w3c/webauthn#847, by @Kieun.
-
add link to WD-webauthn-20180315 (WD-09) w3c/webauthn#843, by @equalsJeffH.
-
WIP: Authenticator taxonomy w3c/webauthn#842, by @emlun.
-
fix linking errors, ref PublicKeyCredentialCreationOptions rather than… w3c/webauthn#840, by @equalsJeffH.
-
move Johan Verrept from contributors to acknowledgements w3c/webauthn#839, by @samuelweiler.
-
Clarify the U2F Attestation format to have a single certificate w3c/webauthn#836, by @arnar.
-
Remove vestigial reference to CollectedClientData/clientExtensions w3c/webauthn#835, by @selfissued.
-
Add links to two previous working drafts w3c/webauthn#834, by @AngeloKai.
-
Address review comments by @kieun w3c/webauthn#832, by @emlun.
-
Add User Public Key as alias of Credential Public Key w3c/webauthn#830, by @emlun.
-
Add RP conformance section on ignoring attestation w3c/webauthn#829, by @emlun.
-
Emphasise that the CollectedClientData can be extended. w3c/webauthn#827, by @agl.
-
Explicitly recommend generating AAGUIDs randomly. w3c/webauthn#826, by @agl.
-
-
9 pull requests merged.
-
Fix an example for aborting operations w3c/webauthn#847.
-
add link to WD-webauthn-20180315 (WD-09) w3c/webauthn#843.
-
Add User Public Key as alias of Credential Public Key w3c/webauthn#830.
-
Explicitly recommend generating AAGUIDs randomly. w3c/webauthn#826.
-
Add non-ASCII RP display name example w3c/webauthn#825.
-
fix linking errors, ref PublicKeyCredentialCreationOptions rather than… w3c/webauthn#840.
-
move Johan Verrept from contributors to acknowledgements w3c/webauthn#839.
-
Remove vestigial reference to CollectedClientData/clientExtensions w3c/webauthn#835.
-
Add links to two previous working drafts w3c/webauthn#834.
-
-
14 pull requests received 42 new comments.
-
UVI modification with CDDL w3c/webauthn#821 (7 comments by @equalsJeffH, @gmandyam, @nadalin, @rlin1)
-
Emphasise that the CollectedClientData can be extended. w3c/webauthn#827 (7 comments by @agl, @emlun, @equalsJeffH)
-
Add non-ASCII RP display name example w3c/webauthn#825 (6 comments by @emlun, @selfissued, @yackermann)
-
Add RP conformance section on ignoring attestation w3c/webauthn#829 (3 comments by @emlun, @equalsJeffH)
-
Clarify the U2F Attestation format to have a single certificate w3c/webauthn#836 (1 comment by @arnar)
-
move Johan Verrept from contributors to acknowledgements w3c/webauthn#839 (1 comment by @selfissued)
-
Remove vestigial reference to CollectedClientData/clientExtensions w3c/webauthn#835 (1 comment by @rlin1)
-
GitHub
w3c/webauthn
-
21 issues opened.
-
Clarify byte size requirements for UVI w3c/webauthn#823, by @gmandyam.
-
Random prefixes to reduce hash requirement of RSA+SHA-1 to TCR w3c/webauthn#822, by @agl.
-
What's this SPEC for? w3c/webauthn#820, by @xialvjun.
-
Subject-C type in packed cert requirements is incorrect w3c/webauthn#818, by @emlun.
-
Mention FIDO transports extension in X.509 cert requirements? w3c/webauthn#817, by @emlun.
-
RPs cannot show "You've Already Registered This Authenticator" Message w3c/webauthn#806, by @leshi.
-
Clarify how RP should verify extension outputs w3c/webauthn#804, by @emlun.
-
agl doesn't understand extensions w3c/webauthn#803, by @agl.
-
Revert location extension back to approved PR's w3c/webauthn#800, by @gmandyam.
-
Signature format needs to be defined w3c/webauthn#799, by @yackermann.
-
TokenBindingId value doesn't permit the U2F "unused" value w3c/webauthn#798, by @kpaulh.
-
Ensure hard-coded step references in RP ops are correct w3c/webauthn#797, by @emlun.
-
Ensure hard-coded step references in RP ops are correct w3c/webauthn#796, by @emlun.
-
hardcoded step refs in #registering-a-new-credential are incorrect w3c/webauthn#794, by @equalsJeffH.
-
reference "UTF-8 decode" directly rather than "parse JSON from bytes" w3c/webauthn#792, by @equalsJeffH.
-
reference TCG-CMCProfile-AIKCertEnroll missing. w3c/webauthn#786, by @rlin1.
-
Images not visible in published spec w3c/webauthn#784, by @rlin1.
-
§9.5. "Authenticator extension processing" is ambiguous w3c/webauthn#775, by @emlun.
-
s/CTAP canonical CBOR/CTAP2 canonical CBOR/g w3c/webauthn#774, by @apowers313.
-
Rename MakePublicKeyCredentialOptions? w3c/webauthn#773, by @apowers313.
-
-
35 issues closed.
-
Add CDDL to every extension w3c/webauthn#679.
-
Authenticator session not possible for BLE w3c/webauthn#649.
-
Include Constants for COSE Algorithm Numbers w3c/webauthn#529.
-
Replace Authenticator Model with CTAP w3c/webauthn#410.
-
Random prefixes to reduce hash requirement of RSA+SHA-1 to TCR w3c/webauthn#822.
-
What's this SPEC for? w3c/webauthn#820.
-
follow Bluetooth and NFC brand usage guidance w3c/webauthn#373.
-
Mention FIDO transports extension in X.509 cert requirements? w3c/webauthn#817.
-
Subject-C type in packed cert requirements is incorrect w3c/webauthn#818.
-
agl doesn't understand extensions w3c/webauthn#803.
-
RPs cannot show "You've Already Registered This Authenticator" Message w3c/webauthn#806.
-
Clarify how RP should verify extension outputs w3c/webauthn#804.
-
Signature format needs to be defined w3c/webauthn#799.
-
TokenBindingId value doesn't permit the U2F "unused" value w3c/webauthn#798.
-
Revert location extension back to approved PR's w3c/webauthn#800.
-
hardcoded step refs in #registering-a-new-credential are incorrect w3c/webauthn#794.
-
UAs can't pass unknown extensions to authenticators w3c/webauthn#738.
-
reference "UTF-8 decode" directly rather than "parse JSON from bytes" w3c/webauthn#792.
-
Recommend RPs to verify UP and UV flags w3c/webauthn#668.
-
reference TCG-CMCProfile-AIKCertEnroll missing. w3c/webauthn#786.
-
Rename MakePublicKeyCredentialOptions? w3c/webauthn#773.
-
§9.5. "Authenticator extension processing" is ambiguous w3c/webauthn#775.
-
s/CTAP canonical CBOR/CTAP2 canonical CBOR/g w3c/webauthn#774.
-
Privacy across Account IDs w3c/webauthn#204.
-
JSON deserialization is not defined w3c/webauthn#713.
-
attestation type identifiers and their use is only implicitly defined w3c/webauthn#746.
-
Processing extensions as JSON w3c/webauthn#770.
-
CTAP/U2F doesn't status indicating the user cancelled the operation w3c/webauthn#658.
-
define "blinding" w3c/webauthn#694.
-
3 issues reopened.
-
Signature format needs to be defined w3c/webauthn#799, by @akshayku.
-
Signature format needs to be defined w3c/webauthn#799, by @samuelweiler.
-
Signature format needs to be defined w3c/webauthn#799, by @yackermann.
-
-
45 issues received 218 new comments.
-
Signature format needs to be defined w3c/webauthn#799 (35 comments by @agl, @akshayku, @apowers313, @equalsJeffH, @jimsch, @jyasskin, @selfissued, @yackermann)
-
JSON-serialized client data is wrong w3c/webauthn#712 (21 comments by @annevk, @emlun, @equalsJeffH, @nadalin, @selfissued)
-
agl doesn't understand extensions w3c/webauthn#803 (20 comments by @agl, @arnar, @emlun, @equalsJeffH, @selfissued)
-
What's this SPEC for? w3c/webauthn#820 (14 comments by @emlun, @equalsJeffH, @js-choi, @selfissued, @stpeter, @xialvjun)
-
Images not visible in published spec w3c/webauthn#784 (8 comments by @equalsJeffH, @rlin1, @wseltzer)
-
Revert location extension back to approved PR's w3c/webauthn#800 (8 comments by @gmandyam, @selfissued)
-
Why is the Token Binding ID a base64url encoded DOMString rather than an ArrayBuffer? w3c/webauthn#807 (7 comments by @agl, @arnar, @kpaulh, @selfissued)
-
Display name content rules? w3c/webauthn#593 (5 comments by @emlun, @jcjones, @selfissued, @stpeter, @zbraniecki)
-
Random prefixes to reduce hash requirement of RSA+SHA-1 to TCR w3c/webauthn#822 (5 comments by @agl, @emlun, @selfissued)
-
Mention FIDO transports extension in X.509 cert requirements? w3c/webauthn#817 (5 comments by @akshayku, @emlun, @nadalin, @selfissued)
-
TokenBindingId value doesn't permit the U2F "unused" value w3c/webauthn#798 (5 comments by @agl, @emlun, @kpaulh)
-
Justify differences in TPM Attestation Verification procedures in WebAuthn versus TCG specifications w3c/webauthn#372 (5 comments by @akshayku, @gmandyam, @selfissued)
-
Subject-C type in packed cert requirements is incorrect w3c/webauthn#818 (4 comments by @emlun, @nadalin, @selfissued)
-
§9.5. "Authenticator extension processing" is ambiguous w3c/webauthn#775 (4 comments by @emlun, @equalsJeffH, @nadalin, @selfissued)
-
Rename MakePublicKeyCredentialOptions? w3c/webauthn#773 (4 comments by @emlun, @nadalin, @selfissued)
-
Packed and U2F Attestation Statements' verifications don't differentiate between Basic and Privacy CA Attestation Types w3c/webauthn#656 (3 comments by @equalsJeffH, @jcjones, @selfissued)
-
providing info about authenticator availability / attachments w3c/webauthn#764 (3 comments by @emlun)
-
follow Bluetooth and NFC brand usage guidance w3c/webauthn#373 (2 comments by @equalsJeffH, @wseltzer)
-
reference "UTF-8 decode" directly rather than "parse JSON from bytes" w3c/webauthn#792 (2 comments by @emlun, @equalsJeffH)
-
s/CTAP canonical CBOR/CTAP2 canonical CBOR/g w3c/webauthn#774 (2 comments by @apowers313, @selfissued)
-
U2F Attestation Statement Format does not define "self attestation" steps w3c/webauthn#745 (2 comments by @emlun, @equalsJeffH)
-
Transaction authorization extensions are registration and authentication extension? w3c/webauthn#621 (1 comment by @selfissued)
-
note that "credential public key" is the same as "user's public key" w3c/webauthn#540 (1 comment by @equalsJeffH)
-
document why only "valid domain" format is allowed for "effective domain" w3c/webauthn#517 (1 comment by @selfissued)
-
ECDAA verification algorithm in TPM Attestation Statement Format w3c/webauthn#433 (1 comment by @equalsJeffH)
-
adopt consistent terms for RP server-side and client-side components w3c/webauthn#80 (1 comment by @nadalin)
-
clarify "authenticator model": RPs may perform feature-based authenticator selection w3c/webauthn#645 (1 comment by @equalsJeffH)
-
update extensions framework to include interfacing with user agent permissions framework w3c/webauthn#133 (1 comment by @selfissued)
-
attestation type identifiers and their use is only implicitly defined w3c/webauthn#746 (1 comment by @equalsJeffH)
-
-
33 pull requests opened.
-
Add non-ASCII RP display name example w3c/webauthn#825, by @emlun.
-
Updates for draft-hodges-webauthn-registries-01 w3c/webauthn#824, by @selfissued.
-
UVI modification with CDDL w3c/webauthn#821, by @gmandyam.
-
Change Subject-C type from UTF8String to PrintableString w3c/webauthn#819, by @emlun.
-
Spelling and grammar corrections w3c/webauthn#815, by @selfissued.
-
Change uses of acme.com to example.com w3c/webauthn#814, by @selfissued.
-
Fix #712: Refer to the JSON object as %JSON% w3c/webauthn#813, by @emlun.
-
Make IANA COSE Algorithms values TBD with requested assignments w3c/webauthn#812, by @selfissued.
-
Remove clientExtensions and authenticatorExtensions from CollectedClientData w3c/webauthn#811, by @selfissued.
-
Plumb CTAP's authorized "already registered" error through to RP w3c/webauthn#809, by @emlun.
-
Fix feature detection. w3c/webauthn#808, by @mikewest.
-
Signature field clarification in attestation statement w3c/webauthn#805, by @akshayku.
-
Switch |tokenBindingId| to a structure. w3c/webauthn#802, by @agl.
-
Location extension corrections w3c/webauthn#801, by @gmandyam.
-
fix #794: RP registration operation inter-step refs w3c/webauthn#795, by @equalsJeffH.
-
fix #792: use utf 8 decode directly w3c/webauthn#793, by @equalsJeffH.
-
Tpm attestation fields clarification w3c/webauthn#791, by @akshayku.
-
renamed authenticator-model to sctn-authenticator-model w3c/webauthn#790, by @rlin1.
-
Add instructions for passing unknown extensions to authenticators w3c/webauthn#789, by @selfissued.
-
update masthead and acknowledgements w3c/webauthn#788, by @equalsJeffH.
-
added reference for TCG-CMCProfile-AIKCertEnroll w3c/webauthn#787, by @rlin1.
-
Fix #713: Refer JSON deserialization to Infra spec w3c/webauthn#785, by @emlun.
-
CTAP2 definition fix w3c/webauthn#783, by @apowers313.
-
fix 645: add discusion of authnr selection to authnr model intro w3c/webauthn#782, by @equalsJeffH.
-
fix 745: remove self attstn from U2F attstn format w3c/webauthn#781, by @equalsJeffH.
-
fix 746: uniformly define attestation type short identifiers w3c/webauthn#780, by @equalsJeffH.
-
Rename MakePublicKeyCredentialOptions to PublicKeyCredentialCreateOptions w3c/webauthn#779, by @selfissued.
-
Align wording between first and second paragraphs in section 9.5 w3c/webauthn#778, by @emlun.
-
fix #204: factor makeCred into reg & authn priv considerations w3c/webauthn#777, by @equalsJeffH.
-
Revise §9.5. "Authenticator extension processing" w3c/webauthn#776, by @emlun.
-
hmac-secret extension w3c/webauthn#772, by @akshayku.
-
-
37 pull requests merged.
-
Updates for draft-hodges-webauthn-registries-01 w3c/webauthn#824.
-
Change Subject-C type from UTF8String to PrintableString w3c/webauthn#819.
-
Spelling and grammar corrections w3c/webauthn#815.
-
Change uses of acme.com to example.com w3c/webauthn#814.
-
Plumb CTAP's authorized "already registered" error through to RP w3c/webauthn#809.
-
Make IANA COSE Algorithms values TBD with requested assignments w3c/webauthn#812.
-
Fix feature detection. w3c/webauthn#808.
-
Signature field clarification in attestation statement w3c/webauthn#805.
-
Switch |tokenBindingId| to a structure. w3c/webauthn#802.
-
fix #794: RP registration operation inter-step refs w3c/webauthn#795.
-
Add instructions for passing unknown extensions to authenticators w3c/webauthn#789.
-
fix #792: use utf 8 decode directly w3c/webauthn#793.
-
Fix #668: Recommend RPs to verify UP and UV flags w3c/webauthn#670.
-
Biometric Criteria Extension w3c/webauthn#510.
-
Tpm attestation fields clarification w3c/webauthn#791.
-
update masthead and acknowledgements w3c/webauthn#788.
-
renamed authenticator-model to sctn-authenticator-model w3c/webauthn#790.
-
Revise §9.5. "Authenticator extension processing" w3c/webauthn#776.
-
CTAP2 definition fix w3c/webauthn#783.
-
fix #204: factor makeCred into reg & authn priv considerations w3c/webauthn#777.
-
fix 645: add discusion of authnr selection to authnr model intro w3c/webauthn#782.
-
Fix #713: Refer JSON deserialization to Infra spec w3c/webauthn#785.
-
fix 745: remove self attstn from U2F attstn format w3c/webauthn#781.
-
fix 746: uniformly define attestation type short identifiers w3c/webauthn#780.
-
Adding CDDL to txAuthSimple w3c/webauthn#724.
-
Align wording between first and second paragraphs in section 9.5 w3c/webauthn#778.
-
fix #658: add user cancelled operation Note w3c/webauthn#760.
-
Fix outdated step references in RP registration algorithm w3c/webauthn#747.
-
Editorial changes from PR #718 w3c/webauthn#752.
-
Define actions for “none” attestation. w3c/webauthn#741.
-
Update CDDL to reflect packed, self-attestation. w3c/webauthn#751.
-
Describe how authenticators unique and find credential sources. w3c/webauthn#623.
-
-
5 pull requests closed.
-
Update session management for BT w3c/webauthn#688.
-
Fix #712: Refer to the JSON object as %JSON% w3c/webauthn#813.
-
Location extension corrections w3c/webauthn#801.
-
added reference for TCG-CMCProfile-AIKCertEnroll w3c/webauthn#787.
-
hmac-secret extension w3c/webauthn#772.
-
-
38 pull requests received 259 new comments.
-
Signature field clarification in attestation statement w3c/webauthn#805 (47 comments by @agl, @akshayku, @equalsJeffH, @selfissued)
-
Add instructions for passing unknown extensions to authenticators w3c/webauthn#789 (24 comments by @agl, @emlun, @equalsJeffH, @nadalin, @selfissued)
-
Change from getClientExtensionResults function to clientExtensionResults attribute w3c/webauthn#810 (18 comments by @agl, @emlun, @nadalin, @selfissued, @ttaubert)
-
Fix #712: Refer to the JSON object as %JSON% w3c/webauthn#813 (15 comments by @annevk, @domenic, @emlun, @equalsJeffH, @nadalin)
-
Adding CDDL to txAuthSimple w3c/webauthn#724 (13 comments by @emlun, @equalsJeffH, @gmandyam, @nadalin, @selfissued)
-
Plumb CTAP's authorized "already registered" error through to RP w3c/webauthn#809 (12 comments by @akshayku, @emlun, @equalsJeffH, @nadalin, @selfissued)
-
Revise §9.5. "Authenticator extension processing" w3c/webauthn#776 (12 comments by @emlun, @gmandyam, @nadalin, @selfissued)
-
Switch |tokenBindingId| to a structure. w3c/webauthn#802 (10 comments by @agl, @akshayku, @emlun, @equalsJeffH)
-
Biometric Criteria Extension w3c/webauthn#510 (8 comments by @emlun, @equalsJeffH, @gmandyam, @nadalin)
-
update masthead and acknowledgements w3c/webauthn#788 (6 comments by @akshayku, @emlun, @equalsJeffH, @jovasco, @nadalin)
-
Rename MakePublicKeyCredentialOptions to PublicKeyCredentialCreateOptions w3c/webauthn#779 (6 comments by @agl, @emlun, @nadalin, @selfissued)
-
Describe how authenticators unique and find credential sources. w3c/webauthn#623 (6 comments by @emlun, @equalsJeffH)
-
fix #204: factor makeCred into reg & authn priv considerations w3c/webauthn#777 (5 comments by @emlun, @equalsJeffH, @nadalin)
-
fix 745: remove self attstn from U2F attstn format w3c/webauthn#781 (5 comments by @agl, @equalsJeffH, @nadalin)
-
Add non-ASCII RP display name example w3c/webauthn#825 (4 comments by @emlun, @selfissued, @stpeter)
-
Remove clientExtensions and authenticatorExtensions from CollectedClientData w3c/webauthn#811 (4 comments by @emlun, @nadalin, @selfissued)
-
Fix #668: Recommend RPs to verify UP and UV flags w3c/webauthn#670 (4 comments by @emlun, @nadalin, @selfissued)
-
Merge {#sample-scenarios} section with the {#usecase} section w3c/webauthn#501 (4 comments by @nadalin, @selfissued)
-
PR #763 untangled: Add consideration of browser permissions framework for extension processing w3c/webauthn#771 (4 comments by @emlun, @gmandyam, @nadalin)
-
Revert clientExtensionResults attribute back to getClientExtensionResults function w3c/webauthn#816 (3 comments by @emlun, @nadalin, @selfissued)
-
added reference for TCG-CMCProfile-AIKCertEnroll w3c/webauthn#787 (3 comments by @apowers313, @rlin1)
-
Fix outdated step references in RP registration algorithm w3c/webauthn#747 (3 comments by @emlun, @nadalin)
-
fix 746: uniformly define attestation type short identifiers w3c/webauthn#780 (1 comment by @nadalin)
-
fix 645: add discusion of authnr selection to authnr model intro w3c/webauthn#782 (1 comment by @nadalin)
-
GitHub
w3c/webauthn
-
14 issues opened.
-
Processing extensions as JSON w3c/webauthn#770, by @apowers313.
-
Packed Attestation & Certificates w3c/webauthn#768, by @apowers313.
-
providing info about authenticator availability / attachments w3c/webauthn#764, by @subyraman.
-
Aligning PublicKeyCredentialUserEntity with CTAP w3c/webauthn#757, by @ve7jtb.
-
RP assertion algorithm does not say to validate the credential ID w3c/webauthn#753, by @emlun.
-
PING suggest referencing the FIDO 100k batch requirements w3c/webauthn#749, by @agl.
-
Security considerations section has some areas deserving of more consideration. w3c/webauthn#748, by @agl.
-
attestation type identifiers and their use is only implicitly defined w3c/webauthn#746, by @equalsJeffH.
-
U2F Attestation Statement Format does not define "self attestation" steps w3c/webauthn#745, by @equalsJeffH.
-
User consent for location extension w3c/webauthn#744, by @samuelweiler.
-
document preventions of RP-driven de-anonymization attempts in privacy-cons w3c/webauthn#743, by @equalsJeffH.
-
reference fido privacy principles w3c/webauthn#742, by @equalsJeffH.
-
UAs can't pass unknown extensions to authenticators w3c/webauthn#738, by @jyasskin.
-
-
25 issues closed.
-
Extensions need to define how their parameters convert to/from CBOR w3c/webauthn#626.
-
Per TCG: "privacy CA" is now "Attestation CA" w3c/webauthn#610.
-
Packed Attestation & Certificates w3c/webauthn#768.
-
Aligning PublicKeyCredentialUserEntity with CTAP w3c/webauthn#757.
-
PING suggest referencing the FIDO 100k batch requirements w3c/webauthn#749.
-
"credential ID" not signed over by authenticatorGetAssertion operation w3c/webauthn#394.
-
reference fido privacy principles w3c/webauthn#742.
-
RP assertion algorithm does not say to validate the credential ID w3c/webauthn#753.
-
No description regarding representation of credential Id length w3c/webauthn#570.
-
preventSilentAccess() -- what effect does calling it have? w3c/webauthn#565.
-
Privacy CA not defined or linked w3c/webauthn#647.
-
txAuthSimple does not conform to extension requirements w3c/webauthn#725.
-
User consent for location extension w3c/webauthn#744.
-
Privacy concerns with blacklist/whitelist w3c/webauthn#184.
-
musings wrt webauthn's profile of COSE_Key w3c/webauthn#543.
-
overall security considerations section or document w3c/webauthn#322.
-
various issues with AppId extension w3c/webauthn#491.
-
Contradiction in whether user handle is required w3c/webauthn#720.
-
Consider requiring canonical CBOR throughout w3c/webauthn#455.
-
5 issues reopened.
-
UAs can't pass unknown extensions to authenticators w3c/webauthn#738, by @selfissued.
-
JSON deserialization is not defined w3c/webauthn#713, by @selfissued.
-
JSON deserialization is not defined w3c/webauthn#713, by @emlun.
-
-
33 issues received 103 new comments.
-
Extensions need to define how their parameters convert to/from CBOR w3c/webauthn#626 (15 comments by @bzbarsky, @emlun, @jcjones, @jyasskin, @selfissued)
-
UAs can't pass unknown extensions to authenticators w3c/webauthn#738 (7 comments by @agl, @equalsJeffH, @jyasskin, @selfissued)
-
Privacy concerns with blacklist/whitelist w3c/webauthn#184 (6 comments by @emlun, @equalsJeffH, @nadalin)
-
cognitive-accessibility consideration w3c/webauthn#733 (5 comments by @equalsJeffH, @JohnRochfordUMMS, @wseltzer)
-
FIDO U2F Attestation Statement Format needs to clarify that user handle will be empty w3c/webauthn#715 (5 comments by @emlun, @equalsJeffH, @jcjones)
-
attestation type identifiers and their use is only implicitly defined w3c/webauthn#746 (4 comments by @emlun, @equalsJeffH, @selfissued)
-
Aligning PublicKeyCredentialUserEntity with CTAP w3c/webauthn#757 (4 comments by @emlun, @nadalin, @selfissued)
-
PING suggest referencing the FIDO 100k batch requirements w3c/webauthn#749 (4 comments by @agl, @equalsJeffH, @nadalin, @selfissued)
-
update extensions framework to include interfacing with user agent permissions framework w3c/webauthn#133 (3 comments by @gmandyam, @nadalin, @selfissued)
-
Security considerations section has some areas deserving of more consideration. w3c/webauthn#748 (3 comments by @equalsJeffH)
-
U2F Attestation Statement Format does not define "self attestation" steps w3c/webauthn#745 (2 comments by @agl, @jcjones)
-
providing info about authenticator availability / attachments w3c/webauthn#764 (2 comments by @emlun, @subyraman)
-
CTAP/U2F doesn't status indicating the user cancelled the operation w3c/webauthn#658 (2 comments by @equalsJeffH, @selfissued)
-
clarify "authenticator model": RPs may perform feature-based authenticator selection w3c/webauthn#645 (2 comments by @equalsJeffH, @selfissued)
-
`CredentialRequestOptions` make otherwise valid values invalid in an undesirable way w3c/webauthn#750 (2 comments by @bzbarsky, @equalsJeffH)
-
document preventions of RP-driven de-anonymization attempts in privacy-cons w3c/webauthn#743 (2 comments by @equalsJeffH, @nadalin)
-
txAuthSimple does not conform to extension requirements w3c/webauthn#725 (2 comments by @equalsJeffH, @nadalin)
-
Justify differences in TPM Attestation Verification procedures in WebAuthn versus TCG specifications w3c/webauthn#372 (1 comment by @selfissued)
-
Client arguments should be specified with "partial dictionary AuthenticationExtensions" w3c/webauthn#346 (1 comment by @selfissued)
-
preventSilentAccess() -- what effect does calling it have? w3c/webauthn#565 (1 comment by @selfissued)
-
"credential ID" not signed over by authenticatorGetAssertion operation w3c/webauthn#394 (1 comment by @rlin1)
-
Correct uses of "JSON string" versus "DOMString" and other string terminology usage w3c/webauthn#417 (1 comment by @rlin1)
-
update #credentialcreationoptions-extension & #credentialrequestoptions-extension section titles w3c/webauthn#497 (1 comment by @equalsJeffH)
-
-
24 pull requests opened.
-
Tighten up the specification of packed X.509 certificates. w3c/webauthn#769, by @agl.
-
Reference the FIDO 100k batch sizes. w3c/webauthn#767, by @agl.
-
Security Considerations for Unsigned Credential ID w3c/webauthn#766, by @selfissued.
-
Strongly type client extension inputs and outputs w3c/webauthn#765, by @selfissued.
-
Add consideration of browser permissions framework for extension processing w3c/webauthn#763, by @gmandyam.
-
fix #610 privacy CA now known as attestation CA w3c/webauthn#762, by @equalsJeffH.
-
fix |allowCredentialDescriptorList| warning from L3605 w3c/webauthn#761, by @equalsJeffH.
-
fix #658: add user cancelled operation Note w3c/webauthn#760, by @equalsJeffH.
-
Reference FIDO Privacy Principles w3c/webauthn#759, by @selfissued.
-
Define preventSilentAccess() behavior w3c/webauthn#758, by @selfissued.
-
Define credentialIdLength representation w3c/webauthn#756, by @selfissued.
-
Fix issue #753: Verify user identity in RP authentication operation w3c/webauthn#755, by @emlun.
-
Un-hardcode list item numbers w3c/webauthn#754, by @emlun.
-
Editorial changes from PR #718 w3c/webauthn#752, by @emlun.
-
Update CDDL to reflect packed, self-attestation. w3c/webauthn#751, by @agl.
-
Fix outdated step references in RP registration algorithm w3c/webauthn#747, by @emlun.
-
Define actions for “none” attestation. w3c/webauthn#741, by @agl.
-
Fix #715 - add a conformance class note for FIDO U2F Attesation Types w3c/webauthn#740, by @jcjones.
-
Changed uses of JSON string to USVString w3c/webauthn#739, by @selfissued.
-
Corrected txAuthGeneric client extension input type w3c/webauthn#737, by @selfissued.
-
Change "denies consent" to "does not consent" w3c/webauthn#735, by @emlun.
-
fix #497: add 'Dictionary' to Credential{Creation,Request}Options section titles w3c/webauthn#734, by @equalsJeffH.
-
24 pull requests merged.
-
Strongly type client extension inputs and outputs w3c/webauthn#765.
-
fix #610 privacy CA now known as attestation CA w3c/webauthn#762.
-
Tighten up the specification of packed X.509 certificates. w3c/webauthn#769.
-
Reference the FIDO 100k batch sizes. w3c/webauthn#767.
-
Security Considerations for Unsigned Credential ID w3c/webauthn#766.
-
Reference FIDO Privacy Principles w3c/webauthn#759.
-
Fix issue #753: Verify user identity in RP authentication operation w3c/webauthn#755.
-
Define credentialIdLength representation w3c/webauthn#756.
-
Define preventSilentAccess() behavior w3c/webauthn#758.
-
fix |allowCredentialDescriptorList| warning from L3605 w3c/webauthn#761.
-
Un-hardcode list item numbers w3c/webauthn#754.
-
Corrected txAuthGeneric client extension input type w3c/webauthn#737.
-
Add privacy consideration about terminating getAssertion early w3c/webauthn#687.
-
Change "denies consent" to "does not consent" w3c/webauthn#735.
-
Fix #715 - add a conformance class note for FIDO U2F Attesation Types w3c/webauthn#740.
-
fix 543: improve COSE_Key spec language and add COSE_Key examples w3c/webauthn#732.
-
Changed uses of JSON string to USVString w3c/webauthn#739.
-
fix #322: flesh out Security Considerations (for now) w3c/webauthn#705.
-
Normalize RFC2119 langugage w3c/webauthn#470.
-
Rework the FIDO AppID extension. w3c/webauthn#723.
-
Fix #622: Clarify PublicKeyCredentialEntity name descriptions w3c/webauthn#666.
-
Fix #720: Align user handle management with CTAP w3c/webauthn#730.
-
fix #455: we are using CTAP canonical CBOR encoding form everywhere w3c/webauthn#731.
-
-
3 pull requests closed.
-
Fix typo w3c/webauthn#736.
-
Fix #713: Define JSON deserialization w3c/webauthn#718.
-
29 pull requests received 234 new comments.
-
Define actions for “none” attestation. w3c/webauthn#741 (24 comments by @agl, @emlun, @equalsJeffH, @selfissued)
-
Describe how authenticators unique and find credential sources. w3c/webauthn#623 (23 comments by @emlun, @equalsJeffH, @nadalin, @selfissued)
-
fix 543: improve COSE_Key spec language and add COSE_Key examples w3c/webauthn#732 (20 comments by @agl, @equalsJeffH, @jcjones, @selfissued)
-
fix #610 privacy CA now known as attestation CA w3c/webauthn#762 (19 comments by @agl, @emlun, @equalsJeffH, @jcjones, @selfissued)
-
Add privacy consideration about terminating getAssertion early w3c/webauthn#687 (13 comments by @emlun, @equalsJeffH, @nadalin, @selfissued)
-
fix #658: add user cancelled operation Note w3c/webauthn#760 (12 comments by @emlun, @equalsJeffH, @jcjones, @kpaulh, @selfissued)
-
fix #322: flesh out Security Considerations (for now) w3c/webauthn#705 (10 comments by @agl, @equalsJeffH, @leshi)
-
Adding CDDL to txAuthSimple w3c/webauthn#724 (8 comments by @gmandyam, @jcjones, @nadalin, @selfissued)
-
Define preventSilentAccess() behavior w3c/webauthn#758 (7 comments by @AngeloKai, @emlun, @selfissued)
-
Biometric Criteria Extension w3c/webauthn#510 (7 comments by @akshayku, @emlun, @equalsJeffH, @gmandyam, @selfissued)
-
Fix #720: Align user handle management with CTAP w3c/webauthn#730 (7 comments by @agl, @emlun, @equalsJeffH, @ve7jtb)
-
PR #763 untangled: Add consideration of browser permissions framework for extension processing w3c/webauthn#771 (6 comments by @emlun, @equalsJeffH, @gmandyam)
-
Strongly type client extension inputs and outputs w3c/webauthn#765 (6 comments by @agl, @emlun, @kpaulh, @selfissued)
-
Security Considerations for Unsigned Credential ID w3c/webauthn#766 (5 comments by @emlun, @selfissued)
-
Add consideration of browser permissions framework for extension processing w3c/webauthn#763 (4 comments by @emlun, @selfissued)
-
Fix #622: Clarify PublicKeyCredentialEntity name descriptions w3c/webauthn#666 (4 comments by @akshayku, @equalsJeffH, @jovasco)
-
Changed uses of JSON string to USVString w3c/webauthn#739 (4 comments by @annevk, @bzbarsky, @jcjones, @rlin1)
-
Corrected txAuthGeneric client extension input type w3c/webauthn#737 (3 comments by @agl, @nadalin, @selfissued)
-
Fix #715 - add a conformance class note for FIDO U2F Attesation Types w3c/webauthn#740 (1 comment by @jcjones)
-
remove "required" from PublicKeyCredentialDescriptor.id w3c/webauthn#500 (1 comment by @equalsJeffH)