Web Authentication Working Group - Activity in 2019
No matches.
Participants
-
1 participant joined.
-
James Barclay (W3C Invited Experts) joined.
-
GitHub
w3c/webauthn
-
2 issues opened.
-
Remove requirement for Authenticators to store PublicKeyCredentialRpEntity name w3c/webauthn#1352, by @ve7jtb.
-
4 issues received 11 new comments.
-
Why does WebAuthn require a challenge when asking the client to register a new credential? w3c/webauthn#1355 (4 comments by @e3b0c442, @johnnyodonnell, @nickmooney)
-
WebAuthN error at: WebAuthNAuthenticatorMakeCredentialRemoteSessionCheck w3c/webauthn#1349 (3 comments by @akshayku, @unagori)
-
Add a way to use webauthn without Javascript w3c/webauthn#1255 (3 comments by @DavidSchinazi, @ignaloidas, @tigt)
-
-
2 pull requests opened.
-
Add a WebDriver Extension Capability w3c/webauthn#1353, by @nsatragno.
-
4 pull requests merged.
-
Reformat and rename AuthenticatorBiometricPerfBounds w3c/webauthn#1345.
-
Use the new name for Coordinates w3c/webauthn#1344.
-
'loc' extension: cite permissions and geolocation specs w3c/webauthn#1342.
-
Fix typo w3c/webauthn#1341.
-
-
7 pull requests received 23 new comments.
-
Remove the requirement accept and store a 64-byte minimum length for a name member’s value w3c/webauthn#1354 (3 comments by @equalsJeffH, @ve7jtb)
-
Add to sec cons a brief discussion of the sec properties accrued by authnr & client platform proximity w3c/webauthn#1333 (2 comments by @agl, @nickmooney)
-
WIP: revise webauthn registries internet-draft per reviews w3c/webauthn#1343 (1 comment by @equalsJeffH)
TR publications
-
1 document published.
GitHub
w3c/webauthn
-
6 issues opened.
-
Add a capability to the WebAuthn WebDriver extension w3c/webauthn#1351, by @nsatragno.
-
WebAuthN error at: WebAuthNAuthenticatorMakeCredentialRemoteSessionCheck w3c/webauthn#1349, by @unagori.
-
Ignore transport hints in excludeCredentials? w3c/webauthn#1348, by @emlun.
-
Considerations on using WebAuthn in cross-origin iframes and Storage Access API w3c/webauthn#1347, by @alanwaketan.
-
exclude/allowCredentials state different defaults in definition vs description w3c/webauthn#1346, by @emlun.
-
-
4 issues closed.
-
WebAuthN error at: WebAuthNAuthenticatorMakeCredentialRemoteSessionCheck w3c/webauthn#1349.
-
-
1 issue reopened.
-
Refer to IntersectionObserver from the Security Considerations w3c/webauthn#1105, by @equalsJeffH.
-
-
11 issues received 27 new comments.
-
Refer to IntersectionObserver from the Security Considerations w3c/webauthn#1105 (8 comments by @equalsJeffH, @jcjones, @kenrb, @rmondello, @szager-chromium)
-
Prohibit Create Credential from cross-origin iframes w3c/webauthn#1336 (7 comments by @agl, @btidor-stripe, @jcjones, @kenrb)
-
Add a way to use webauthn without Javascript w3c/webauthn#1255 (2 comments by @equalsJeffH, @gartov)
-
WebAuthN error at: WebAuthNAuthenticatorMakeCredentialRemoteSessionCheck w3c/webauthn#1349 (2 comments by @akshayku, @unagori)
-
Requiring user activation to call WebAuthn API w3c/webauthn#1293 (2 comments by @equalsJeffH, @jcjones)
-
Considerations on using WebAuthn in cross-origin iframes and Storage Access API w3c/webauthn#1347 (1 comment by @nadalin)
-
way to return a platform specific Name for the thing that gets registered. w3c/webauthn#1304 (1 comment by @rlin1)
-
Integrate with Feature Policy and possibly Permissions and define appropriate identifier value for WebAuthn w3c/webauthn#911 (1 comment by @equalsJeffH)
-
enrichen registration and authentication ceremonies definitions w3c/webauthn#1099 (1 comment by @equalsJeffH)
-
Define protocol for parsing authenticator credentials when None attestation statement format is present w3c/webauthn#1339 (1 comment by @emlun)
-
-
7 pull requests opened.
-
<div> cannot appear within <figure> w3c/webauthn#1350, by @plehegar.
-
Reformat and rename AuthenticatorBiometricPerfBounds w3c/webauthn#1345, by @saschanaz.
-
Use the new name for Coordinates w3c/webauthn#1344, by @saschanaz.
-
WIP: revise webauthn registries internet-draft per reviews w3c/webauthn#1343, by @equalsJeffH.
-
'loc' extension: cite permissions and geolocation specs w3c/webauthn#1342, by @equalsJeffH.
-
reverting and restoring automation section et al... w3c/webauthn#1340, by @equalsJeffH.
-
-
4 pull requests merged.
-
<div> cannot appear within <figure> w3c/webauthn#1350.
-
add indication of cross-origin operation in `collectedClientData` w3c/webauthn#1276.
-
reverting and restoring automation section et al... w3c/webauthn#1340.
-
Reduce duplicated terminology w3c/webauthn#1334.
-
-
10 pull requests received 26 new comments.
-
reverting and restoring automation section et al... w3c/webauthn#1340 (7 comments by @agl, @emlun, @equalsJeffH)
-
'loc' extension: cite permissions and geolocation specs w3c/webauthn#1342 (4 comments by @emlun, @equalsJeffH)
-
Add to sec cons a brief discussion of the sec properties accrued by authnr & client platform proximity w3c/webauthn#1333 (3 comments by @equalsJeffH, @nadalin)
-
add indication of cross-origin operation in `collectedClientData` w3c/webauthn#1276 (2 comments by @emlun, @nadalin)
-
Add explanatory note to step 3 in authenticatorMakeCredential w3c/webauthn#1326 (1 comment by @emlun)
-
Lifecycle
-
1 charter started.
-
Chartered until 31 December 2021.
-
Participants
-
2 participants left.
-
Nicholas Steele (1Password) left.
-
James Barclay (W3C Invited Experts) left.
-
-
1 organization joined.
-
Cisco joined.
-
-
2 organizations left.
-
Privakey, Inc. left.
-
Trust1Team left.
-
GitHub
w3c/webauthn
-
7 issues opened.
-
Prohibit Create Credential from cross-origin iframes w3c/webauthn#1336, by @jcjones.
-
RP guidance for `invalidStateError` returned from `[[Create]]()` w3c/webauthn#1331, by @equalsJeffH.
-
update timeout values in examples (due to new timeout value recommendations) ? w3c/webauthn#1318, by @equalsJeffH.
-
cccccclllifvgblhcutfdjckfbcdnvvjbvuvicekccft w3c/webauthn#1315, by @thomaskonrad.
-
Underspecified client output in `exts` extension w3c/webauthn#1314, by @emlun.
-
Privacy leak via credential IDs also applies to resident credentials w3c/webauthn#1311, by @maxhata.
-
Clarify Relying Party Server or Server w3c/webauthn#1309, by @kasecato.
-
-
18 issues closed.
-
Specify if clients are expected to follow redirects for icon URLs w3c/webauthn#1285.
-
Consider rewording restrictions around origin w3c/webauthn#1297.
-
Consider whether browsers should truncate `name` and `displayName`. w3c/webauthn#1296.
-
explicitly mention running over TLS in WebAuthn API intro w3c/webauthn#1201.
-
add explanatory note to step 3 in authenticatorMakeCredential Operation w3c/webauthn#1133.
-
add term "batch attestation" synonymous with "basic attestation"... w3c/webauthn#1260.
-
enhance spec roadmap section w3c/webauthn#1100.
-
update CDDL reference w3c/webauthn#1206.
-
Low timeout bounds for inline bio enrollment of FIDO2 keys w3c/webauthn#1286.
-
cccccclllifvgblhcutfdjckfbcdnvvjbvuvicekccft w3c/webauthn#1315.
-
Certain issues in client extension pass-through specification w3c/webauthn#1273.
-
Clarify Relying Party Server or Server w3c/webauthn#1309.
-
finish up on "provide transport info during registration" w3c/webauthn#1188.
-
Privacy risk from revealing allowed credentials w3c/webauthn#1246.
-
Privacy leak via credential IDs also applies to resident credentials w3c/webauthn#1311.
-
-
24 issues received 50 new comments.
-
Clarify how a user can authenticate from multiple devices w3c/webauthn#151 (5 comments by @bdewater, @billchenchina, @MasterKale, @paramsinghvc)
-
Explicitly prohibit use of WebAuthn from non-visible cross-origin iframes w3c/webauthn#1303 (4 comments by @agl, @jcjones, @rmondello)
-
cccccclllifvgblhcutfdjckfbcdnvvjbvuvicekccft w3c/webauthn#1315 (3 comments by @nicksteele, @thomaskonrad)
-
Supply an “intention" member in PublicKeyCredentialCreationOptions dictionary w3c/webauthn#1292 (3 comments by @equalsJeffH, @jcjones)
-
Clarify relation between requireUserVerification values for MakeCredential and GetAssertion w3c/webauthn#1305 (3 comments by @agl, @fmeum, @nadalin)
-
Refer to IntersectionObserver from the Security Considerations w3c/webauthn#1105 (2 comments by @jcjones, @rlin1)
-
Integrate with Feature Policy and possibly Permissions and define appropriate identifier value for WebAuthn w3c/webauthn#911 (2 comments by @equalsJeffH, @jcjones)
-
Clearly define the way how RP handles the extensions w3c/webauthn#1258 (2 comments by @emlun, @Kieun)
-
Consider allowing RPs to indicate that they want platform authenticators to be synced across devices w3c/webauthn#969 (2 comments by @emlun, @Jamesernator)
-
Removing “lightning” from AuthenticatorTransport w3c/webauthn#1294 (2 comments by @alanwaketan, @equalsJeffH)
-
Requiring user activation to call WebAuthn API w3c/webauthn#1293 (2 comments by @alanwaketan, @equalsJeffH)
-
Specify if clients are expected to follow redirects for icon URLs w3c/webauthn#1285 (1 comment by @jcjones)
-
Add to sec cons a brief discussion of the sec properties accrued by authnr & client platform proximity w3c/webauthn#1257 (1 comment by @equalsJeffH)
-
Low timeout bounds for inline bio enrollment of FIDO2 keys w3c/webauthn#1286 (1 comment by @akshayku)
-
Privacy leak via credential IDs also applies to resident credentials w3c/webauthn#1311 (1 comment by @emlun)
-
Consider whether browsers should truncate `name` and `displayName`. w3c/webauthn#1296 (1 comment by @nadalin)
-
-
23 pull requests opened.
-
Re-merge PR #1324 w3c/webauthn#1338, by @emlun.
-
Fix #1285 - Remove icons from PublicKeyCredentialEntity w3c/webauthn#1337, by @jcjones.
-
name the protocol w3c/webauthn#1335, by @equalsJeffH.
-
Reduce duplicated terminology w3c/webauthn#1334, by @emlun.
-
Update note in RP definition to indicate that non-WebAuthn FIDO clien… w3c/webauthn#1332, by @sbweeden.
-
Enrichen registration and authentication ceremonies definitions w3c/webauthn#1330, by @emlun.
-
Align with RFC8288, update .txt & .html to be actual rendered versions of .xml w3c/webauthn#1329, by @equalsJeffH.
-
feature policy integration: add link to "allowed to use" w3c/webauthn#1328, by @equalsJeffH.
-
Explicitly mention running over TLS in WebAuthn API intro w3c/webauthn#1327, by @emlun.
-
Add explanatory note to step 3 in authenticatorMakeCredential w3c/webauthn#1326, by @emlun.
-
Add batch attestation as alias of basic attestation w3c/webauthn#1325, by @emlun.
-
Use CSS numbering for table references too w3c/webauthn#1324, by @emlun.
-
Create a way to reference the following figure w3c/webauthn#1323, by @agl.
-
revise draft-hodges-webauthn-registries per AD review and initiate work on rev -03 w3c/webauthn#1322, by @equalsJeffH.
-
Enhance spec roadmap section w3c/webauthn#1321, by @emlun.
-
Update CDDL reference w3c/webauthn#1320, by @emlun.
-
Update timeout examples to better agree with guidelines w3c/webauthn#1319, by @emlun.
-
Timeout considerations w3c/webauthn#1317, by @akshayku.
-
Truncate strings for authenticators where needed. w3c/webauthn#1316, by @agl.
-
Clarify assumptions about single-user authenticator and relation to UV w3c/webauthn#1313, by @emlun.
-
Clarify that RP is split into server and script w3c/webauthn#1312, by @emlun.
-
ack Nina (automation/webdriver) w3c/webauthn#1310, by @equalsJeffH.
-
-
24 pull requests merged.
-
Fix #1285 - Remove icons from PublicKeyCredentialEntity w3c/webauthn#1337.
-
name the protocol w3c/webauthn#1335.
-
Update note in RP definition to indicate that non-WebAuthn FIDO clien… w3c/webauthn#1332.
-
Re-merge PR #1324 w3c/webauthn#1338.
-
Use CSS numbering for table references too w3c/webauthn#1324.
-
Create a way to reference the following figure w3c/webauthn#1323.
-
Truncate strings for authenticators where needed. w3c/webauthn#1316.
-
Update timeout examples to better agree with guidelines w3c/webauthn#1319.
-
Explicitly mention running over TLS in WebAuthn API intro w3c/webauthn#1327.
-
Add explanatory note to step 3 in authenticatorMakeCredential w3c/webauthn#1326.
-
Add batch attestation as alias of basic attestation w3c/webauthn#1325.
-
Clarify assumptions about single-user authenticator and relation to UV w3c/webauthn#1313.
-
Enhance spec roadmap section w3c/webauthn#1321.
-
Update CDDL reference w3c/webauthn#1320.
-
feature policy integration: add link to "allowed to use" w3c/webauthn#1328.
-
Timeout considerations w3c/webauthn#1317.
-
Clarify that RP is split into server and script w3c/webauthn#1312.
-
Recommend RPs to store transport hints w3c/webauthn#1299.
-
Add privacy considerations about credential IDs w3c/webauthn#1250.
-
ack Nina (automation/webdriver) w3c/webauthn#1310.
-
Add a WebDriver Virtual Authenticator extension w3c/webauthn#1256.
-
-
21 pull requests received 108 new comments.
-
Truncate strings for authenticators where needed. w3c/webauthn#1316 (25 comments by @agl, @emlun, @equalsJeffH, @jcjones)
-
Clarify assumptions about single-user authenticator and relation to UV w3c/webauthn#1313 (20 comments by @akshayku, @emlun, @equalsJeffH, @fmeum)
-
Update note in RP definition to indicate that non-WebAuthn FIDO clien… w3c/webauthn#1332 (5 comments by @agl, @emlun, @equalsJeffH, @jcjones, @sbweeden)
-
Add to sec cons a brief discussion of the sec properties accrued by authnr & client platform proximity w3c/webauthn#1333 (5 comments by @emlun, @equalsJeffH)
-
Add explanatory note to step 3 in authenticatorMakeCredential w3c/webauthn#1326 (5 comments by @emlun, @equalsJeffH)
-
Fix #1285 - Remove icons from PublicKeyCredentialEntity w3c/webauthn#1337 (4 comments by @equalsJeffH, @jcjones)
-
Update timeout examples to better agree with guidelines w3c/webauthn#1319 (4 comments by @akshayku, @emlun)
-
add indication of cross-origin operation in `collectedClientData` w3c/webauthn#1276 (2 comments by @equalsJeffH)
-
Add note about use of floating point in extensions passed through that clients do not recognize w3c/webauthn#1307 (2 comments by @equalsJeffH, @peteroupc)
-
Enrichen registration and authentication ceremonies definitions w3c/webauthn#1330 (1 comment by @emlun)
-
Align with RFC8288, update .txt & .html to be actual rendered versions of .xml w3c/webauthn#1329 (1 comment by @equalsJeffH)
-
revise draft-hodges-webauthn-registries per AD review and initiate work on rev -03 w3c/webauthn#1322 (1 comment by @equalsJeffH)
-
Participants
-
1 organization left.
-
Bloomberg left.
-
GitHub
w3c/webauthn
-
11 issues opened.
-
Conflict between WebAuthn and CTAP2 handling of userVerification mapping w3c/webauthn#1306, by @fmeum.
-
way to return a platform specific Name for the thing that gets registered. w3c/webauthn#1304, by @rlin1.
-
Explicitly prohibit use of WebAuthn from non-visible cross-origin iframes w3c/webauthn#1303, by @jcjones.
-
Length restriction on user handles has no processing model associated with it w3c/webauthn#1302, by @bzbarsky.
-
Consider rewording restrictions around origin w3c/webauthn#1297, by @sbweeden.
-
Consider whether browsers should truncate `name` and `displayName`. w3c/webauthn#1296, by @agl.
-
Removing “lightning” from AuthenticatorTransport w3c/webauthn#1294, by @alanwaketan.
-
Requiring user activation to call WebAuthn API w3c/webauthn#1293, by @alanwaketan.
-
Supply an “intention" member in PublicKeyCredentialCreationOptions dictionary w3c/webauthn#1292, by @alanwaketan.
-
Minor cleanups from PR 1270 review w3c/webauthn#1291, by @emlun.
-
-
6 issues closed.
-
Divide Security/Privacy Considerations into subsections by audience? w3c/webauthn#1039.
-
Browsers adding extensions. w3c/webauthn#1287.
-
Missing RP ops step: initialise signature counter w3c/webauthn#1282.
-
rename "webauthn" feature policy token to "publickey-credentials" w3c/webauthn#1277.
-
Poor documentation of how authnr aspects (platform, UV, RK) interact w3c/webauthn#1231.
-
webauthn should have the ability to cross platform w3c/webauthn#1290.
-
-
17 issues received 72 new comments.
-
Removing “lightning” from AuthenticatorTransport w3c/webauthn#1294 (26 comments by @agl, @alanwaketan, @christiaanbrand, @dwaite, @emlun, @equalsJeffH, @jcjones, @Kieun, @othermaciej, @ve7jtb)
-
Supply an “intention" member in PublicKeyCredentialCreationOptions dictionary w3c/webauthn#1292 (10 comments by @agl, @akshayku, @alanwaketan, @equalsJeffH, @Kieun, @lgarron, @othermaciej, @ve7jtb)
-
Consider rewording restrictions around origin w3c/webauthn#1297 (8 comments by @agl, @equalsJeffH, @nadalin, @sbweeden, @yackermann)
-
Requiring user activation to call WebAuthn API w3c/webauthn#1293 (6 comments by @akshayku, @alanwaketan, @equalsJeffH, @Kieun, @rlin1)
-
Certain issues in client extension pass-through specification w3c/webauthn#1273 (3 comments by @nadalin, @selfissued)
-
Explicitly prohibit use of WebAuthn from non-visible cross-origin iframes w3c/webauthn#1303 (2 comments by @akshayku, @nadalin)
-
Length restriction on user handles has no processing model associated with it w3c/webauthn#1302 (2 comments by @bzbarsky, @equalsJeffH)
-
Specify authenticator attachment for authentication operation w3c/webauthn#1267 (1 comment by @christiaanbrand)
-
How do I use a smart phone as an authenticator when the web application is running on a laptop/desktop? w3c/webauthn#954 (1 comment by @MatteoWebDeveloper)
-
Consider whether browsers should truncate `name` and `displayName`. w3c/webauthn#1296 (1 comment by @lgarron)
-
Low timeout bounds for inline bio enrollment of FIDO2 keys w3c/webauthn#1286 (1 comment by @akshayku)
-
add indication of embedded and cross-origin operation in `collectedClientData` w3c/webauthn#1271 (1 comment by @bdewater)
-
Integrate with Feature Policy and possibly Permissions and define appropriate identifier value for WebAuthn w3c/webauthn#911 (1 comment by @cyberphone)
-
-
6 pull requests opened.
-
fix publickey-credentials feature identifier tag w3c/webauthn#1301, by @equalsJeffH.
-
WIP: More explicitly document use cases. w3c/webauthn#1300, by @agl.
-
Recommend RPs to store transport hints w3c/webauthn#1299, by @emlun.
-
Divide security/privacy considerations into subsections by audience w3c/webauthn#1298, by @emlun.
-
(Deja vu) webauthn => publickey-credentials w3c/webauthn#1295, by @Malvoz.
-
7 pull requests merged.
-
fix publickey-credentials feature identifier tag w3c/webauthn#1301.
-
Divide security/privacy considerations into subsections by audience w3c/webauthn#1298.
-
Initial proposal to fix #1287 w3c/webauthn#1289.
-
(Deja vu) webauthn => publickey-credentials w3c/webauthn#1295.
-
Add RP ops step of storing new credential counter w3c/webauthn#1288.
-
Improve authenticator taxonomy section w3c/webauthn#1270.
-
-
10 pull requests received 98 new comments.
-
Add privacy considerations about credential IDs w3c/webauthn#1250 (19 comments by @akshayku, @emlun, @equalsJeffH, @maxhata)
-
Add a WebDriver Virtual Authenticator extension w3c/webauthn#1256 (13 comments by @akshayku, @AutomatedTester, @equalsJeffH, @jabazorius, @jcjones, @nsatragno)
-
Add note about use of floating point in extensions passed through that clients do not recognize w3c/webauthn#1307 (3 comments by @emlun, @peteroupc)
-
Divide security/privacy considerations into subsections by audience w3c/webauthn#1298 (3 comments by @emlun, @equalsJeffH)
-
rename feature-identifier token: webauthn -> publickey-credentials (fix #1277) w3c/webauthn#1284 (2 comments by @equalsJeffH, @rlin1)
Participants
-
3 organizations joined.
-
NTT, Inc. joined.
-
Certus Cybersecurity Solutions LLC joined.
-
LY Corporation joined.
-
-
1 organization left.
-
PayGate left.
-
GitHub
w3c/webauthn
-
13 issues opened.
-
webauthn should have the ability to cross platform w3c/webauthn#1290, by @ghost.
-
Browsers adding extensions. w3c/webauthn#1287, by @ve7jtb.
-
Low timeout bounds for inline bio enrollment of FIDO2 keys w3c/webauthn#1286, by @akshayku.
-
Specify if clients are expected to follow redirects for icon URLs w3c/webauthn#1285, by @lgarron.
-
What if the user has no displayName? w3c/webauthn#1283, by @lgarron.
-
Missing RP ops step: initialise signature counter w3c/webauthn#1282, by @emlun.
-
w3c/webauthn w3c/webauthn#1281, by @razinda8.
-
Section 8.6 step 6 clarification (Correct Hash algorithm) w3c/webauthn#1279, by @tomciopp.
-
rename "webauthn" feature policy token to "publickey-credentials" w3c/webauthn#1277, by @equalsJeffH.
-
Misleading key order in attestation object diagram w3c/webauthn#1274, by @emlun.
-
Certain issues in client extension pass-through specification w3c/webauthn#1273, by @peteroupc.
-
add indication of embedded and cross-origin operation in `collectedClientData` w3c/webauthn#1271, by @equalsJeffH.
-
cccccclbltngdcnrtvuhucgeijhcdkdhdgftijurnglb w3c/webauthn#1269, by @damienbod.
-
-
9 issues closed.
-
What if the user has no displayName? w3c/webauthn#1283.
-
Add two new transport types to section 5.10.4 w3c/webauthn#1261.
-
change AuthenticatorTransport to be other than an `enum` w3c/webauthn#1268.
-
Section 8.6 step 6 clarification (Correct Hash algorithm) w3c/webauthn#1279.
-
Misleading key order in attestation object diagram w3c/webauthn#1274.
-
w3c/webauthn w3c/webauthn#1281.
-
link to android key attestation certificate extension schema w3c/webauthn#1265.
-
Floating-point values in the CTAP2 canonical CBOR encoding form w3c/webauthn#1263.
-
cccccclbltngdcnrtvuhucgeijhcdkdhdgftijurnglb w3c/webauthn#1269.
-
-
19 issues received 70 new comments.
-
Specify authenticator attachment for authentication operation w3c/webauthn#1267 (18 comments by @arshadnoor, @equalsJeffH, @Kieun, @maxhata, @rlin1, @ve7jtb)
-
Certain issues in client extension pass-through specification w3c/webauthn#1273 (7 comments by @dwaite, @peteroupc, @selfissued)
-
Specify if clients are expected to follow redirects for icon URLs w3c/webauthn#1285 (5 comments by @dwaite, @emlun, @jcjones, @lgarron)
-
Section 8.6 step 6 clarification (Correct Hash algorithm) w3c/webauthn#1279 (5 comments by @agl, @bdewater, @emlun, @tomciopp)
-
What if the user has no displayName? w3c/webauthn#1283 (4 comments by @agl, @emlun, @lgarron, @nadalin)
-
Misleading key order in attestation object diagram w3c/webauthn#1274 (3 comments by @emlun, @equalsJeffH)
-
Add a way to use webauthn without Javascript w3c/webauthn#1255 (3 comments by @equalsJeffH, @ignaloidas, @yackermann)
-
Floating-point values in the CTAP2 canonical CBOR encoding form w3c/webauthn#1263 (3 comments by @equalsJeffH, @peteroupc)
-
How do I use a smart phone as an authenticator when the web application is running on a laptop/desktop? w3c/webauthn#954 (3 comments by @emlun, @mehakzahra1)
-
Low timeout bounds for inline bio enrollment of FIDO2 keys w3c/webauthn#1286 (2 comments by @agl, @jcjones)
-
rename "webauthn" feature policy token to "publickey-credentials" w3c/webauthn#1277 (2 comments by @equalsJeffH)
-
Unspecified CBOR encoding of high-valued integer numbers due to unspecified threshold w3c/webauthn#1044 (2 comments by @peteroupc)
-
-
9 pull requests opened.
-
Initial proposal to fix #1287 w3c/webauthn#1289, by @sbweeden.
-
Add RP ops step of storing new credential counter w3c/webauthn#1288, by @emlun.
-
rename feature-identifier token: webauthn -> publickey-credentials (fix #1277) w3c/webauthn#1284, by @equalsJeffH.
-
Clarify the U2F attestation verification. w3c/webauthn#1280, by @agl.
-
updated attstation object figure for proper CBOR key ordering w3c/webauthn#1278, by @equalsJeffH.
-
add indication of cross-origin operation in `collectedClientData` w3c/webauthn#1276, by @equalsJeffH.
-
Fix #1268 Type transport strings as DOMStrings. w3c/webauthn#1275, by @agl.
-
Add note about decoding U2F keyhandles. w3c/webauthn#1272, by @agl.
-
Improve authenticator taxonomy section w3c/webauthn#1270, by @emlun.
-
-
6 pull requests merged.
-
Add lightning transport w3c/webauthn#1264.
-
Fix #1268 Type transport strings as DOMStrings. w3c/webauthn#1275.
-
Clarify the U2F attestation verification. w3c/webauthn#1280.
-
updated attstation object figure for proper CBOR key ordering w3c/webauthn#1278.
-
Add note about decoding U2F keyhandles. w3c/webauthn#1272.
-
link directly to android key attestation schema w3c/webauthn#1266.
-
-
8 pull requests received 40 new comments.
-
Fix #1268 Type transport strings as DOMStrings. w3c/webauthn#1275 (9 comments by @agl, @emlun, @equalsJeffH, @jcjones)
-
Add a WebDriver Virtual Authenticator extension w3c/webauthn#1256 (9 comments by @AutomatedTester, @emlun, @jcjones, @nsatragno)
-
add indication of cross-origin operation in `collectedClientData` w3c/webauthn#1276 (6 comments by @agl, @emlun, @ve7jtb)
-
Add note about decoding U2F keyhandles. w3c/webauthn#1272 (6 comments by @agl, @baloo, @equalsJeffH, @peteroupc)
-
link directly to android key attestation schema w3c/webauthn#1266 (2 comments by @emlun, @equalsJeffH)
-
Participants
-
1 participant joined.
-
David Turner (W3C Invited Experts) joined.
-
-
2 organizations left.
-
Orange left.
-
Opera Software AS left.
-
GitHub
w3c/webauthn
-
12 issues opened.
-
change AuthenticatorTransport to be other than an `enum` w3c/webauthn#1268, by @equalsJeffH.
-
Specify authenticator attachment for authentication operation w3c/webauthn#1267, by @Kieun.
-
link to android key attestation certificate extension schema w3c/webauthn#1265, by @equalsJeffH.
-
Floating-point values in the CTAP2 canonical CBOR encoding form w3c/webauthn#1263, by @peteroupc.
-
Add two new transport types to section 5.10.4 w3c/webauthn#1261, by @ve7jtb.
-
add term "batch attestation" synonymous with "basic attestation"... w3c/webauthn#1260, by @equalsJeffH.
-
Clearly define the way how RP handles the extensions w3c/webauthn#1258, by @Kieun.
-
Add a way to use webauthn without Javascript w3c/webauthn#1255, by @ignaloidas.
-
The user-verification default of “preferred” is catching most sites out. w3c/webauthn#1253, by @agl.
-
PublicKeyCredentialUserEntity.id's length limit ought to be (also) stated... w3c/webauthn#1252, by @equalsJeffH.
-
-
11 issues closed.
-
Supported features detection from the browser w3c/webauthn#1202.
-
Add notion of forbidding resident credential creation w3c/webauthn#1149.
-
Can't exclude U2F credentals w3c/webauthn#1235.
-
The user-verification default of “preferred” is catching most sites out. w3c/webauthn#1253.
-
Re-focus resident key descriptions on allowCredentials aspect w3c/webauthn#1197.
-
Editorial improvements to use cases section w3c/webauthn#1247.
-
PublicKeyCredentialUserEntity.id's length limit ought to be (also) stated... w3c/webauthn#1252.
-
20 issues received 54 new comments.
-
Add a way to use webauthn without Javascript w3c/webauthn#1255 (10 comments by @ddevault, @emlun, @equalsJeffH, @gartov, @ignaloidas, @lgarron)
-
navigator.credentials.get() option to suppress chrome UI popup if allowCredentials is not present in the authenticator w3c/webauthn#1251 (6 comments by @emlun, @Kieun, @kmlhossen, @npesic)
-
Add explicit description on what should be done in incognito/private browsing mode w3c/webauthn#1174 (5 comments by @agl, @akshayku, @equalsJeffH)
-
Authenticators that do not recognize any handles shouldn't just be dropped on the floor w3c/webauthn#863 (4 comments by @equalsJeffH, @jcjones, @kpaulh)
-
Privacy risk from revealing allowed credentials w3c/webauthn#1246 (4 comments by @emlun, @equalsJeffH, @manger)
-
Floating-point values in the CTAP2 canonical CBOR encoding form w3c/webauthn#1263 (3 comments by @dwaite, @equalsJeffH, @peteroupc)
-
The user-verification default of “preferred” is catching most sites out. w3c/webauthn#1253 (3 comments by @agl, @emlun, @equalsJeffH)
-
Unspecified CBOR encoding of high-valued integer numbers due to unspecified threshold w3c/webauthn#1044 (2 comments by @jcjones, @peteroupc)
-
Supported features detection from the browser w3c/webauthn#1202 (2 comments by @emlun, @equalsJeffH)
-
Add notion of forbidding resident credential creation w3c/webauthn#1149 (2 comments by @agl, @equalsJeffH)
-
Add to sec cons a brief discussion of the sec properties accrued by authnr & client platform proximity w3c/webauthn#1257 (2 comments by @emlun, @nickmooney)
-
Provide API for indicating whether the platform has attached(bound) authenticator or not w3c/webauthn#1218 (1 comment by @equalsJeffH)
-
Refer to IntersectionObserver from the Security Considerations w3c/webauthn#1105 (1 comment by @jcjones)
-
Specify authenticator attachment for authentication operation w3c/webauthn#1267 (1 comment by @equalsJeffH)
-
link to android key attestation certificate extension schema w3c/webauthn#1265 (1 comment by @equalsJeffH)
-
Consider allowing RPs to indicate that they want platform authenticators to be synced across devices w3c/webauthn#969 (1 comment by @equalsJeffH)
-
-
8 pull requests opened.
-
link directly to android key attestation schema w3c/webauthn#1266, by @equalsJeffH.
-
Add lightning transport w3c/webauthn#1264, by @ve7jtb.
-
Add lightning to Transports w3c/webauthn#1262, by @ve7jtb.
-
make UV requirement default 'discouraged' w3c/webauthn#1259, by @equalsJeffH.
-
Add a WebDriver Virtual Authenticator extension w3c/webauthn#1256, by @nsatragno.
-
Move user handle requirements to user.id definition w3c/webauthn#1254, by @emlun.
-
Add privacy considerations about credential IDs w3c/webauthn#1250, by @emlun.
-
Re-focus resident key definitions around allowCredentials aspect w3c/webauthn#1249, by @emlun.
-
-
4 pull requests merged.
-
Add “appidExclude” extension. w3c/webauthn#1244.
-
Re-focus resident key definitions around allowCredentials aspect w3c/webauthn#1249.
-
Apply edits suggested in PR #1242 review w3c/webauthn#1248.
-
Move user handle requirements to user.id definition w3c/webauthn#1254.
-
-
3 pull requests closed.
-
make UV requirement default 'discouraged' w3c/webauthn#1259.
-
Browser capability detection. w3c/webauthn#1219.
-
Add lightning to Transports w3c/webauthn#1262.
-
-
6 pull requests received 55 new comments.
-
Add a WebDriver Virtual Authenticator extension w3c/webauthn#1256 (19 comments by @agl, @emlun, @equalsJeffH, @jcjones, @nsatragno)
-
Re-focus resident key definitions around allowCredentials aspect w3c/webauthn#1249 (15 comments by @emlun, @equalsJeffH)
-
Add privacy considerations about credential IDs w3c/webauthn#1250 (9 comments by @emlun, @equalsJeffH, @manger)
-
Browser capability detection. w3c/webauthn#1219 (5 comments by @akshayku, @emlun, @equalsJeffH, @leshi)
-
TR publications
-
1 document published.
-
Web Authentication:An API for accessing Public Key Credentials Level 2 published as a First Public Working Draft. History of Web Authentication:An API for accessing Public Key Credentials Level 2
-
GitHub
w3c/webauthn
-
7 issues opened.
-
Editorial improvements to use cases section w3c/webauthn#1247, by @emlun.
-
Privacy risk from revealing allowed credentials w3c/webauthn#1246, by @manger.
-
Create a WebDriver Virtual Authenticator extension to allow automated testing w3c/webauthn#1236, by @nsatragno.
-
Can't exclude U2F credentals w3c/webauthn#1235, by @agl.
-
correctly refer to FIDO JavaScript APIs spec w3c/webauthn#1233, by @equalsJeffH.
-
Poor documentation of how authnr aspects (platform, UV, RK) interact w3c/webauthn#1231, by @emlun.
-
Document that U2F key handle = credential ID w3c/webauthn#1229, by @emlun.
-
-
14 issues closed.
-
cleanup: mark & structure biblio references consistently w3c/webauthn#872.
-
coalesce HTML references? w3c/webauthn#996.
-
move sample scenarios section up to be after use cases section w3c/webauthn#1101.
-
Where is the code implementation for roaming authenticators? w3c/webauthn#1221.
-
correctly refer to FIDO JavaScript APIs spec w3c/webauthn#1233.
-
Refine User Verification description w3c/webauthn#1162.
-
Document that U2F key handle = credential ID w3c/webauthn#1229.
-
Extensible data structure for Authenticator Data w3c/webauthn#1220.
-
Enforce specific user verification methods w3c/webauthn#1211.
-
double check language regarding requiring authorization gesture w3c/webauthn#1215.
-
Clean up Bikeshed warnings w3c/webauthn#1224.
-
-
23 issues received 54 new comments.
-
Add notion of forbidding resident credential creation w3c/webauthn#1149 (12 comments by @akshayku, @christiaanbrand, @dwaite, @Kieun, @nadalin, @sbweeden, @ve7jtb)
-
Enforce specific user verification methods w3c/webauthn#1211 (6 comments by @akshayku, @emlun, @hgomi53, @Kieun, @selfissued)
-
How do I use a smart phone as an authenticator when the web application is running on a laptop/desktop? w3c/webauthn#954 (5 comments by @GitPointer, @nhtransis, @Trojan295)
-
Extensible data structure for Authenticator Data w3c/webauthn#1220 (3 comments by @equalsJeffH, @Kieun)
-
Divide Security/Privacy Considerations into subsections by audience? w3c/webauthn#1039 (3 comments by @bdewater, @jcjones)
-
Add explicit description on what should be done in incognito/private browsing mode w3c/webauthn#1174 (2 comments by @kreichgauer, @nadalin)
-
Q: Regarding Security Concerns Surrounding WebAuthn: Don't Implement ECDAA (Yet) w3c/webauthn#1196 (2 comments by @jcjones, @selfissued)
-
Unspecified CBOR encoding of high-valued integer numbers due to unspecified threshold w3c/webauthn#1044 (2 comments by @nadalin, @selfissued)
-
Provide API for indicating whether the platform has attached(bound) authenticator or not w3c/webauthn#1218 (1 comment by @emlun)
-
enrichen registration and authentication ceremonies definitions w3c/webauthn#1099 (1 comment by @jcjones)
-
Authenticators that do not recognize any handles shouldn't just be dropped on the floor w3c/webauthn#863 (1 comment by @nadalin)
-
move sample scenarios section up to be after use cases section w3c/webauthn#1101 (1 comment by @equalsJeffH)
-
WebAuthn available to Workers? aka "silent authentication" w3c/webauthn#199 (1 comment by @equalsJeffH)
-
Poor documentation of how authnr aspects (platform, UV, RK) interact w3c/webauthn#1231 (1 comment by @bdewater)
-
Consider allowing RPs to indicate that they want platform authenticators to be synced across devices w3c/webauthn#969 (1 comment by @emlun)
-
-
15 pull requests opened.
-
Apply edits suggested in PR #1242 review w3c/webauthn#1248, by @emlun.
-
enhance/polish Appidexclude extension definition w3c/webauthn#1245, by @equalsJeffH.
-
Add “appidExclude” extension. w3c/webauthn#1244, by @agl.
-
coalesce HTML refs w3c/webauthn#1243, by @equalsJeffH.
-
move the scenarios section up with the use cases section w3c/webauthn#1242, by @equalsJeffH.
-
bikeshed cleanup: refs w3c/webauthn#1241, by @equalsJeffH.
-
bikeshed cleanup: remove all trailing whitespace w3c/webauthn#1240, by @equalsJeffH.
-
Correctly refer to the FIDO U2F JavaScript API and informatively refe… w3c/webauthn#1239, by @futureimperfect.
-
Clarify that a single user might be several persons w3c/webauthn#1238, by @emlun.
-
Use "authorization gesture" term in authenticator operations w3c/webauthn#1237, by @emlun.
-
Re-merge PR #1165 w3c/webauthn#1234, by @emlun.
-
Pass through other assertion formats w3c/webauthn#1232, by @rlin1.
-
Add guidance on using U2F key handles with appid extension w3c/webauthn#1230, by @emlun.
-
Add alt text w3c/webauthn#1228, by @wseltzer.
-
Add Rec to previous version w3c/webauthn#1227, by @wseltzer.
-
-
14 pull requests merged.
-
bikeshed cleanup: refs w3c/webauthn#1241.
-
coalesce HTML refs w3c/webauthn#1243.
-
move the scenarios section up with the use cases section w3c/webauthn#1242.
-
Correctly refer to the FIDO U2F JavaScript API and informatively refe… w3c/webauthn#1239.
-
Clarify that a single user might be several persons w3c/webauthn#1238.
-
bikeshed cleanup: remove all trailing whitespace w3c/webauthn#1240.
-
Add guidance on using U2F key handles with appid extension w3c/webauthn#1230.
-
Use "authorization gesture" term in authenticator operations w3c/webauthn#1237.
-
Add RP ops step of verifying credential key algorithm w3c/webauthn#1223.
-
Clean up RP operations w3c/webauthn#1222.
-
Re-merge PR #1165 w3c/webauthn#1234.
-
Clean up Bikeshed warnings w3c/webauthn#1225.
-
Polish definitions of credential key pair, private/public key w3c/webauthn#1226.
-
Add alt text w3c/webauthn#1228.
-
-
2 pull requests closed.
-
enhance/polish Appidexclude extension definition w3c/webauthn#1245.
-
Add Rec to previous version w3c/webauthn#1227.
-
-
14 pull requests received 122 new comments.
-
Browser capability detection. w3c/webauthn#1219 (44 comments by @agl, @akshayku, @dwaite, @emlun, @equalsJeffH, @jafisher-microsoft, @jcjones, @Kieun, @leshi, @rlin1, @sbweeden)
-
Clarify that a single user might be several persons w3c/webauthn#1238 (9 comments by @emlun, @equalsJeffH)
-
Add guidance on using U2F key handles with appid extension w3c/webauthn#1230 (9 comments by @emlun, @equalsJeffH)
-
move the scenarios section up with the use cases section w3c/webauthn#1242 (8 comments by @emlun, @equalsJeffH)
-
Pass through other assertion formats w3c/webauthn#1232 (7 comments by @agl, @akshayku, @rlin1, @ve7jtb)
-
Polish definitions of credential key pair, private/public key w3c/webauthn#1226 (2 comments by @emlun, @equalsJeffH)
-
Correctly refer to the FIDO U2F JavaScript API and informatively refe… w3c/webauthn#1239 (1 comment by @nadalin)
-
Add registration/authentication extensions for cloud-assisted BLE w3c/webauthn#909 (1 comment by @arnar)
-
Participants
-
1 organization joined.
-
Discover Financial Services LLC joined.
-
-
2 organizations left.
-
Intuit left.
-
New Zealand Government left.
-
GitHub
w3c/webauthn
-
10 issues opened.
-
Clean up Bikeshed warnings w3c/webauthn#1224, by @emlun.
-
Where is the code implementation for roaming authenticators? w3c/webauthn#1221, by @mduffy215.
-
Extensible data structure for Authenticator Data w3c/webauthn#1220, by @Kieun.
-
Provide API for indicating whether the platform has attached(bound) authenticator or not w3c/webauthn#1218, by @Kieun.
-
Polish client device definition w3c/webauthn#1216, by @emlun.
-
double check language regarding requiring authorization gesture w3c/webauthn#1215, by @equalsJeffH.
-
Enforce specific user verification methods w3c/webauthn#1211, by @Kieun.
-
add feature detection blurb... w3c/webauthn#1208, by @equalsJeffH.
-
update CDDL reference w3c/webauthn#1206, by @equalsJeffH.
-
-
12 issues closed.
-
Verify signature first in RP operations? w3c/webauthn#1064.
-
Move aaguidList from extensions to AuthenticatorSelectionCriteria w3c/webauthn#478.
-
Polish client device definition w3c/webauthn#1216.
-
truncation to 64-byte upper limit doesn't mention character boundaries w3c/webauthn#973.
-
choose consistent section id prefix w3c/webauthn#704.
-
Clarify the name `AuthenticationExtensions...` w3c/webauthn#1166.
-
Rearrange terminology aliases so the first one reflects sort order w3c/webauthn#1194.
-
No way to verify requireResidentKey during registration step at RP side w3c/webauthn#1060.
-
Leap of Faith not only for Self and None Attestation Types w3c/webauthn#1088.
-
-
21 issues received 56 new comments.
-
Clarify 127.0.0.1 in spec w3c/webauthn#1204 (19 comments by @agl, @emlun, @equalsJeffH, @gmandyam, @ve7jtb)
-
Where is the code implementation for roaming authenticators? w3c/webauthn#1221 (9 comments by @bdewater, @dwaite, @mduffy215)
-
Not necessary to pass AuthenticatorSelectionCriteria members to authenticatorMakeCredential() w3c/webauthn#524 (3 comments by @emlun, @equalsJeffH, @nadalin)
-
Authenticators that do not recognize any handles shouldn't just be dropped on the floor w3c/webauthn#863 (3 comments by @equalsJeffH, @ve7jtb)
-
ensure non-native Signature Assertions are passed-through w3c/webauthn#465 (2 comments by @nadalin, @rlin1)
-
Provide API for indicating whether the platform has attached(bound) authenticator or not w3c/webauthn#1218 (2 comments by @equalsJeffH, @Kieun)
-
Clarify the name `AuthenticationExtensions...` w3c/webauthn#1166 (2 comments by @equalsJeffH, @nadalin)
-
Add explicit description on what should be done in incognito/private browsing mode w3c/webauthn#1174 (1 comment by @leshi)
-
add explanatory note to step 3 in authenticatorMakeCredential Operation w3c/webauthn#1133 (1 comment by @emlun)
-
move sample scenarios section up to be after use cases section w3c/webauthn#1101 (1 comment by @emlun)
-
Move aaguidList from extensions to AuthenticatorSelectionCriteria w3c/webauthn#478 (1 comment by @rlin1)
-
Authenticator selection extension - should makeCredential fail if no specified authenticator can be found? w3c/webauthn#227 (1 comment by @equalsJeffH)
-
double check language regarding requiring authorization gesture w3c/webauthn#1215 (1 comment by @emlun)
-
Integrate with Feature Policy and possibly Permissions and define appropriate identifier value for WebAuthn w3c/webauthn#911 (1 comment by @equalsJeffH)
-
No way to verify requireResidentKey during registration step at RP side w3c/webauthn#1060 (1 comment by @equalsJeffH)
-
-
11 pull requests opened.
-
Polish definitions of credential key pair, private/public key w3c/webauthn#1226, by @emlun.
-
Clean up Bikeshed warnings w3c/webauthn#1225, by @emlun.
-
Add RP ops step of verifying credential key algorithm w3c/webauthn#1223, by @emlun.
-
Clean up RP operations w3c/webauthn#1222, by @emlun.
-
Browser capability detection. w3c/webauthn#1219, by @jafisher-microsoft.
-
Polish client device definition as suggested by @equalsJeffH w3c/webauthn#1217, by @emlun.
-
feature policy integration w3c/webauthn#1214, by @equalsJeffH.
-
Fix typo in PR #1195 w3c/webauthn#1213, by @emlun.
-
Use consistent section id prefixes w3c/webauthn#1212, by @emlun.
-
fix #1166: clarify extension input/output data type names w3c/webauthn#1210, by @equalsJeffH.
-
Rearrange terminology to be ordered by the first of the term aliases w3c/webauthn#1209, by @emlun.
-
-
12 pull requests merged.
-
Revert "Revert change to new TR link" w3c/webauthn#1187.
-
Add considerations for string truncation. w3c/webauthn#1205.
-
feature policy integration w3c/webauthn#1214.
-
Use consistent section id prefixes w3c/webauthn#1212.
-
fix #1166: clarify extension input/output data type names w3c/webauthn#1210.
-
Polish client device definition as suggested by @equalsJeffH w3c/webauthn#1217.
-
Fix typo in PR #1195 w3c/webauthn#1213.
-
Rearrange terminology to be ordered by the first of the term aliases w3c/webauthn#1209.
-
Update Authenticator Definition w3c/webauthn#1195.
-
Initial proposal for modifications to resident key credential requirements w3c/webauthn#1191.
-
Rewrite security consideration on attestation and MitM attacks w3c/webauthn#1095.
-
Add some embellishments to @equalsJeffH's suggestions w3c/webauthn#1203.
-
-
1 pull request closed.
-
Authnr sel matcherprotection w3c/webauthn#477.
-
-
14 pull requests received 89 new comments.
-
Initial proposal for modifications to resident key credential requirements w3c/webauthn#1191 (28 comments by @akshayku, @emlun, @equalsJeffH, @sbweeden)
-
Add considerations for string truncation. w3c/webauthn#1205 (20 comments by @agl, @aphillips, @dwaite, @equalsJeffH)
-
Browser capability detection. w3c/webauthn#1219 (9 comments by @jafisher-microsoft, @jasonf1990, @Kieun, @leshi)
-
Rearrange terminology to be ordered by the first of the term aliases w3c/webauthn#1209 (4 comments by @emlun, @equalsJeffH, @nadalin)
-
Update Authenticator Definition w3c/webauthn#1195 (4 comments by @equalsJeffH, @nadalin, @nicksteele)
-
fix #1166: clarify extension input/output data type names w3c/webauthn#1210 (2 comments by @emlun, @equalsJeffH)
-
Add registration/authentication extensions for cloud-assisted BLE w3c/webauthn#909 (1 comment by @ynojima)
-
Polish client device definition as suggested by @equalsJeffH w3c/webauthn#1217 (1 comment by @emlun)
-
GitHub
w3c/webauthn
-
8 issues opened.
-
Clarify 127.0.0.1 in spec w3c/webauthn#1204, by @gmandyam.
-
Supported features detection from the browser w3c/webauthn#1202, by @Kieun.
-
explicitly mention running over TLS in WebAuthn API intro w3c/webauthn#1201, by @equalsJeffH.
-
Update name, displayname and icon for RP and user w3c/webauthn#1200, by @Kieun.
-
How to get supported client extension w3c/webauthn#1199, by @Kieun.
-
Underspecified RP ID length w3c/webauthn#1198, by @emlun.
-
Re-focus resident key descriptions on allowCredentials aspect w3c/webauthn#1197, by @emlun.
-
Q: Regarding Security Concerns Surrounding WebAuthn: Don't Implement ECDAA (Yet) w3c/webauthn#1196, by @yanosz.
-
-
6 issues closed.
-
Underspecified RP ID length w3c/webauthn#1198.
-
remove "required" on ScopedCredentialDescriptor.id w3c/webauthn#245.
-
Create linkable definition for "WebAuthn Extension(s)" w3c/webauthn#1180.
-
link "attestation statement format" term in Section 8.1 to its definition w3c/webauthn#1179.
-
MUST authenticators still perform self attestation? w3c/webauthn#978.
-
-
17 issues received 52 new comments.
-
How to get supported client extension w3c/webauthn#1199 (8 comments by @agl, @akshayku, @emlun, @equalsJeffH, @Kieun)
-
How do I use a smart phone as an authenticator when the web application is running on a laptop/desktop? w3c/webauthn#954 (8 comments by @CalldiDoctor, @Kieun, @leshi, @nicksteele, @snehaved123)
-
Update name, displayname and icon for RP and user w3c/webauthn#1200 (7 comments by @akshayku, @emlun, @Kieun)
-
Indicate resident key credential "preferred" during registration and find out what the authenticator offered w3c/webauthn#991 (4 comments by @akshayku, @emlun)
-
Integrate with Feature Policy and possibly Permissions and define appropriate identifier value for WebAuthn w3c/webauthn#911 (3 comments by @equalsJeffH, @nadalin)
-
Supported features detection from the browser w3c/webauthn#1202 (3 comments by @emlun, @jasonf1990, @Kieun)
-
remove "required" on ScopedCredentialDescriptor.id w3c/webauthn#245 (2 comments by @equalsJeffH, @jyasskin)
-
Re-focus resident key descriptions on allowCredentials aspect w3c/webauthn#1197 (2 comments by @agl, @akshayku)
-
Q: Regarding Security Concerns Surrounding WebAuthn: Don't Implement ECDAA (Yet) w3c/webauthn#1196 (1 comment by @dwaite)
-
truncation to 64-byte upper limit doesn't mention character boundaries w3c/webauthn#973 (1 comment by @nadalin)
-
No way to verify requireResidentKey during registration step at RP side w3c/webauthn#1060 (1 comment by @emlun)
-
explicitly mention running over TLS in WebAuthn API intro w3c/webauthn#1201 (1 comment by @gmandyam)
-
Authenticators that do not recognize any handles shouldn't just be dropped on the floor w3c/webauthn#863 (1 comment by @akshayku)
-
-
2 pull requests opened.
-
Add considerations for string truncation. w3c/webauthn#1205, by @agl.
-
Add some embellishments to @equalsJeffH's suggestions w3c/webauthn#1203, by @emlun.
-
-
6 pull requests merged.
-
Created linkable definition for WebAuthn Extensions and linked to it … w3c/webauthn#1193.
-
Linked attestation statement format term in Section 8.1 to its defini… w3c/webauthn#1192.
-
Update isUVPAA() scenario to agree with spec w3c/webauthn#1184.
-
Fixed various links, including new TR link w3c/webauthn#1161.
-
Allow authenticators to do None instead of Self attestation w3c/webauthn#1182.
-
Revert change to new TR link w3c/webauthn#1186.
-
-
1 pull request closed.
-
remove "required" from PublicKeyCredentialDescriptor.id w3c/webauthn#500.
-
-
14 pull requests received 203 new comments.
-
Initial proposal for modifications to resident key credential requirements w3c/webauthn#1191 (135 comments by @agl, @akshayku, @emlun, @equalsJeffH, @sbweeden)
-
Rewrite security consideration on attestation and MitM attacks w3c/webauthn#1095 (26 comments by @emlun, @equalsJeffH, @nadalin, @selfissued)
-
Update isUVPAA() scenario to agree with spec w3c/webauthn#1184 (10 comments by @akshayku, @emlun, @equalsJeffH, @nadalin)
-
Update Authenticator Definition w3c/webauthn#1195 (8 comments by @agl, @akshayku, @equalsJeffH, @nicksteele, @selfissued)
-
Add some embellishments to @equalsJeffH's suggestions w3c/webauthn#1203 (7 comments by @emlun, @equalsJeffH)
-
Linked attestation statement format term in Section 8.1 to its defini… w3c/webauthn#1192 (3 comments by @equalsJeffH, @futureimperfect, @nadalin)
-
Add registration/authentication extensions for cloud-assisted BLE w3c/webauthn#909 (3 comments by @ynojima)
-
Allow authenticators to do None instead of Self attestation w3c/webauthn#1182 (2 comments by @emlun, @yackermann)
-
remove "required" from PublicKeyCredentialDescriptor.id w3c/webauthn#500 (1 comment by @equalsJeffH)
-
Created linkable definition for WebAuthn Extensions and linked to it … w3c/webauthn#1193 (1 comment by @nadalin)
-
TR publications
-
1 document published.
Participants
-
1 participant left.
-
Adam Powers (Amazon) left.
-
-
1 organization joined.
-
Amazon joined.
-
GitHub
w3c/webauthn
-
14 issues opened.
-
Rearrange terminology aliases so the first one reflects sort order w3c/webauthn#1194, by @emlun.
-
finish up on "provide transport info during registration" w3c/webauthn#1188, by @equalsJeffH.
-
Git merge variants w3c/webauthn#1183, by @emlun.
-
Create linkable definition for "WebAuthn Extension(s)" w3c/webauthn#1180, by @equalsJeffH.
-
link "attestation statement format" term in Section 8.1 to its definition w3c/webauthn#1179, by @equalsJeffH.
-
Standardising support for software authenticators w3c/webauthn#1175, by @filips123.
-
Add explicit description on what should be done in incognito/private browsing mode w3c/webauthn#1174, by @leshi.
-
Add a method to determine whether external CTAP2 security keys are supported w3c/webauthn#1173, by @jcjones.
-
Angelo Liao is no longer an active editor w3c/webauthn#1171, by @selfissued.
-
Error: registration failed: packed attestation: self attestation not implemented w3c/webauthn#1169, by @traviswltrs.
-
Android key attestation missing certificate validation steps w3c/webauthn#1167, by @bdewater.
-
Clarify the name `AuthenticationExtensions...` w3c/webauthn#1166, by @equalsJeffH.
-
-
16 issues closed.
-
AuthenticatorAttachment description is incorrect w3c/webauthn#1153.
-
Git merge variants w3c/webauthn#1183.
-
Android key attestation missing certificate validation steps w3c/webauthn#1167.
-
Maybe upgrade user handle PII prohibition to a MUST w3c/webauthn#1146.
-
SafetyNet Attestation Clarifications w3c/webauthn#968.
-
Refer android-safetynet verification to SafetyNet documentation? w3c/webauthn#1135.
-
Angelo Liao is no longer an active editor w3c/webauthn#1171.
-
Add a method to determine whether external CTAP2 security keys are supported w3c/webauthn#1173.
-
Clarify what value goes into appid extension input w3c/webauthn#1117.
-
Define a attestation format with RFC8152-style signing? w3c/webauthn#1164.
-
appid extension output is inaccurate in some corner cases w3c/webauthn#1034.
-
Make AuthenticatorSelectionCriteria more complete. w3c/webauthn#441.
-
WebAuthn Authenticators are FIDO Authenticators w3c/webauthn#1128.
-
-
25 issues received 74 new comments.
-
Indicate resident key credential "preferred" during registration and find out what the authenticator offered w3c/webauthn#991 (28 comments by @akshayku, @christiaanbrand, @emlun, @leshi, @nadalin, @sbweeden, @selfissued, @ve7jtb)
-
None hardware/device option - as for ssl client certificates w3c/webauthn#1027 (4 comments by @emlun, @filips123)
-
Android key attestation missing certificate validation steps w3c/webauthn#1167 (4 comments by @bdewater, @emlun)
-
Standardising support for software authenticators w3c/webauthn#1175 (3 comments by @akshayku, @filips123, @nicksteele)
-
Add a method to determine whether external CTAP2 security keys are supported w3c/webauthn#1173 (3 comments by @jcjones, @nadalin, @sbweeden)
-
MUST authenticators still perform self attestation? w3c/webauthn#978 (3 comments by @emlun, @leshi, @nadalin)
-
Error: registration failed: packed attestation: self attestation not implemented w3c/webauthn#1169 (2 comments by @emlun)
-
Add notion of forbidding resident credential creation w3c/webauthn#1149 (2 comments by @dwaite, @equalsJeffH)
-
Maybe upgrade user handle PII prohibition to a MUST w3c/webauthn#1146 (2 comments by @akshayku, @emlun)
-
Consistency between scenario "Registration specifically with UVPA" and former removal of confirmation prompt for isUVPAA() w3c/webauthn#1178 (2 comments by @emlun, @SphinxKnight)
-
Authenticators that do not recognize any handles shouldn't just be dropped on the floor w3c/webauthn#863 (2 comments by @emlun, @nadalin)
-
spec is missing baseline posture that credential source is bound to a particular authenticator w3c/webauthn#1122 (1 comment by @nadalin)
-
Integrate with Feature Policy and possibly Permissions and define appropriate identifier value for WebAuthn w3c/webauthn#911 (1 comment by @agl)
-
Refer android-safetynet verification to SafetyNet documentation? w3c/webauthn#1135 (1 comment by @equalsJeffH)
-
Define a attestation format with RFC8152-style signing? w3c/webauthn#1164 (1 comment by @selfissued)
-
Requesting ability to detect if there is an authenticator available which is capable of resident key credential w3c/webauthn#987 (1 comment by @equalsJeffH)
-
-
16 pull requests opened.
-
Update Authenticator Definition w3c/webauthn#1195, by @nicksteele.
-
Created linkable definition for WebAuthn Extensions and linked to it … w3c/webauthn#1193, by @futureimperfect.
-
Linked attestation statement format term in Section 8.1 to its defini… w3c/webauthn#1192, by @futureimperfect.
-
Initial proposal for modifications to resident key credential requirements w3c/webauthn#1191, by @sbweeden.
-
Fix typo in Authentication example w3c/webauthn#1190, by @jtescher.
-
Revert "Revert change to new TR link" w3c/webauthn#1187, by @emlun.
-
Revert change to new TR link w3c/webauthn#1186, by @emlun.
-
Change prohibitions on PII in user handles to MUST. w3c/webauthn#1185, by @agl.
-
Update isUVPAA() scenario to agree with spec w3c/webauthn#1184, by @emlun.
-
Allow authenticators to do None instead of Self attestation w3c/webauthn#1182, by @emlun.
-
fixup registries internet-draft's abstract w3c/webauthn#1181, by @equalsJeffH.
-
update registries draft per issue #1176 w3c/webauthn#1177, by @equalsJeffH.
-
Move Angelo Liao to the Former Editors list w3c/webauthn#1172, by @selfissued.
-
Update SafetyNet attestation description w3c/webauthn#1170, by @leshi.
-
Clarify relationship to trust path in RP registration step 16 w3c/webauthn#1168, by @emlun.
-
Add example of different RP ID and AppID w3c/webauthn#1165, by @emlun.
-
-
12 pull requests merged.
-
Fix typo in Authentication example w3c/webauthn#1190.
-
Fix incorrect AuthenticatorAttachment description w3c/webauthn#1159.
-
Clarify relationship to trust path in RP registration step 16 w3c/webauthn#1168.
-
Change prohibitions on PII in user handles to MUST. w3c/webauthn#1185.
-
Update SafetyNet attestation description w3c/webauthn#1170.
-
fixup registries internet-draft's abstract w3c/webauthn#1181.
-
update registries draft per issue #1176 w3c/webauthn#1177.
-
Move Angelo Liao to the Former Editors list w3c/webauthn#1172.
-
Add example of different RP ID and AppID w3c/webauthn#1165.
-
Note that appid should be set to the previously used AppID w3c/webauthn#1118.
-
Determine appid extension output after authenticator returns w3c/webauthn#1143.
-
Let requireUserPresence always be true in authenticator operations w3c/webauthn#1140.
-
-
5 pull requests closed.
-
Add the Entity Attestation Token w3c/webauthn#1121.
-
Authnr selection aaguidlist w3c/webauthn#479.
-
Add credential type uaf w3c/webauthn#407.
-
Add uaf attestation format w3c/webauthn#408.
-
Authnr sel keyprotection w3c/webauthn#476.
-
-
19 pull requests received 80 new comments.
-
Initial proposal for modifications to resident key credential requirements w3c/webauthn#1191 (33 comments by @emlun, @equalsJeffH, @sbweeden)
-
Update SafetyNet attestation description w3c/webauthn#1170 (14 comments by @apowers313, @arnar, @emlun, @leshi)
-
Fixed various links, including new TR link w3c/webauthn#1161 (5 comments by @equalsJeffH, @jcjones, @plehegar)
-
Add registration/authentication extensions for cloud-assisted BLE w3c/webauthn#909 (3 comments by @equalsJeffH, @jcjones, @nadalin)
-
update registries draft per issue #1176 w3c/webauthn#1177 (3 comments by @equalsJeffH, @gmandyam, @selfissued)
-
Change prohibitions on PII in user handles to MUST. w3c/webauthn#1185 (2 comments by @agl, @equalsJeffH)
-
Clarify relationship to trust path in RP registration step 16 w3c/webauthn#1168 (2 comments by @bdewater, @emlun)
-
Rewrite security consideration on attestation and MitM attacks w3c/webauthn#1095 (1 comment by @equalsJeffH)
-
Participants
-
1 organization joined.
-
Brave Software Inc. joined.
-
GitHub
w3c/webauthn
-
10 issues opened.
-
Define a attestation format with RFC8152-style signing? w3c/webauthn#1164, by @holycleugh.
-
Refine User Verification description w3c/webauthn#1162, by @Kieun.
-
Travis build is broken w3c/webauthn#1160, by @emlun.
-
WebAuthn API for Browser (like Chrome) extension w3c/webauthn#1158, by @Kieun.
-
Provide a tutorial on creating Authenticators w3c/webauthn#1157, by @KOLANICH.
-
update working draft to be "level 2" w3c/webauthn#1155, by @equalsJeffH.
-
AuthenticatorAttachment description is incorrect w3c/webauthn#1153, by @emlun.
-
Where is the reference implementation for WebAuthn? w3c/webauthn#1152, by @mduffy215.
-
-
25 issues closed.
-
Candidate recommendation exit criteria w3c/webauthn#837.
-
Propose extension: Delegation of Authentication w3c/webauthn#1125.
-
Travis build is broken w3c/webauthn#1160.
-
What is the point of `allowCredentials`? w3c/webauthn#867.
-
Authenticator disconnect event w3c/webauthn#1107.
-
update working draft to be "level 2" w3c/webauthn#1155.
-
Add required matcher protection to AuthenticatorSelectionCriteria w3c/webauthn#447.
-
Add required key protection to AuthenticatorSelectionCriteria w3c/webauthn#446.
-
Add biometric accuracy to AuthenticatorSelectionCriteria w3c/webauthn#445.
-
Protect against TLS MiTM by including TLS cert chain in signature w3c/webauthn#391.
-
Is android-safetynet attestation trust path limited to one cert? w3c/webauthn#1132.
-
WebAuthn API for Browser (like Chrome) extension w3c/webauthn#1158.
-
RP ops registration step 16 is missing a case for None attestation w3c/webauthn#1136.
-
Provide a tutorial on creating Authenticators w3c/webauthn#1157.
-
Platform authenticators and key stores w3c/webauthn#851.
-
Attestation privacy advice creates large scale security risks w3c/webauthn#1127.
-
update editor's draft to link to newly published Prop Rec w3c/webauthn#1138.
-
Lack of support for modern ECC w3c/webauthn#1124.
-
update @equalJeffH's affiliation w3c/webauthn#1137.
-
Ensure hard-coded step references in RP ops are correct w3c/webauthn#797.
-
TPM attestation format & EdDSA & hash alg w3c/webauthn#1148.
-
Where is the reference implementation for WebAuthn? w3c/webauthn#1152.
-
-
32 issues received 85 new comments.
-
Provide a tutorial on creating Authenticators w3c/webauthn#1157 (15 comments by @holycleugh, @KOLANICH, @ve7jtb, @yackermann)
-
How do I use a smart phone as an authenticator when the web application is running on a laptop/desktop? w3c/webauthn#954 (9 comments by @emlun, @ToruAoyagi, @ve7jtb, @yackermann)
-
TPM attestation format & EdDSA & hash alg w3c/webauthn#1148 (7 comments by @agl, @nadalin, @rlin1, @yackermann)
-
Propose extension: Delegation of Authentication w3c/webauthn#1125 (5 comments by @emlun, @equalsJeffH, @nadalin, @ve7jtb)
-
Add notion of forbidding resident credential creation w3c/webauthn#1149 (4 comments by @emlun, @equalsJeffH, @ve7jtb)
-
SafetyNet Attestation Clarifications w3c/webauthn#968 (3 comments by @bdewater, @emlun, @yackermann)
-
No way to identify authenticator type whether is is platform or roaming if RP does not specify the type during registration w3c/webauthn#1163 (3 comments by @emlun, @Kieun)
-
Support for apps acting as platform authenticators for authenticating in mobile browsers w3c/webauthn#1150 (3 comments by @emlun, @equalsJeffH, @holycleugh)
-
Where is the reference implementation for WebAuthn? w3c/webauthn#1152 (3 comments by @mduffy215, @nadalin, @yackermann)
-
undefined terms and terms we really ought to define w3c/webauthn#462 (2 comments by @emlun, @equalsJeffH)
-
Protect against TLS MiTM by including TLS cert chain in signature w3c/webauthn#391 (2 comments by @agl, @mrts)
-
AuthenticatorAttachment description is incorrect w3c/webauthn#1153 (2 comments by @emlun, @equalsJeffH)
-
Clarify relationships between "uv"/"up" of the CTAP spec and "userVerification"/"userPresence" w3c/webauthn#1123 (2 comments by @equalsJeffH, @selfissued)
-
Unspecified CBOR encoding of high-valued integer numbers due to unspecified threshold w3c/webauthn#1044 (2 comments by @agl, @selfissued)
-
Add required matcher protection to AuthenticatorSelectionCriteria w3c/webauthn#447 (1 comment by @nadalin)
-
Add required key protection to AuthenticatorSelectionCriteria w3c/webauthn#446 (1 comment by @nadalin)
-
No way to verify requireResidentKey during registration step at RP side w3c/webauthn#1060 (1 comment by @sbweeden)
-
-
4 pull requests opened.
-
Fixed various links, including new TR link w3c/webauthn#1161, by @plehegar.
-
Fix incorrect AuthenticatorAttachment description w3c/webauthn#1159, by @emlun.
-
update spec to Level 2 w3c/webauthn#1156, by @equalsJeffH.
-
update JeffH's affiliation w3c/webauthn#1154, by @equalsJeffH.
-
-
9 pull requests merged.
-
Add examples of authenticator types to Authenticator definition w3c/webauthn#1131.
-
Fix android-safetynet trust path w3c/webauthn#1142.
-
Add "Webauthn Authenticator" definition alias w3c/webauthn#1130.
-
Use "user handle mapped to user" language in user identification step w3c/webauthn#1091.
-
Add None attestation case to RP ops registration step 16 w3c/webauthn#1145.
-
Provide transport information during registration. w3c/webauthn#1050.
-
Recommend minimal basic attestation batches w3c/webauthn#1141.
-
update spec to Level 2 w3c/webauthn#1156.
-
update JeffH's affiliation w3c/webauthn#1154.
-
-
1 pull request closed.
-
Make appid extension always return true w3c/webauthn#1144.
-
-
13 pull requests received 30 new comments.
-
Provide transport information during registration. w3c/webauthn#1050 (6 comments by @agl, @emlun, @equalsJeffH, @tomrittervg)
-
Add examples of authenticator types to Authenticator definition w3c/webauthn#1131 (5 comments by @emlun, @nadalin, @selfissued)
-
Let requireUserPresence always be true in authenticator operations w3c/webauthn#1140 (4 comments by @akshayku, @emlun)
-
Rewrite security consideration on attestation and MitM attacks w3c/webauthn#1095 (3 comments by @agl, @emlun, @selfissued)
-
Use "user handle mapped to user" language in user identification step w3c/webauthn#1091 (2 comments by @emlun, @selfissued)
-
Add registration/authentication extensions for cloud-assisted BLE w3c/webauthn#909 (1 comment by @nadalin)
-
Determine appid extension output after authenticator returns w3c/webauthn#1143 (1 comment by @nadalin)
-
TR publications
-
1 document published.
-
Web Authentication:An API for accessing Public Key CredentialsLevel 1 published as a Proposed Recommendation. History of Web Authentication:An API for accessing Public Key CredentialsLevel 1
-
Participants
-
1 organization left.
-
Qualcomm Innovation Center, Inc left.
-
GitHub
w3c/webauthn
-
13 issues opened.
-
Add notion of forbidding resident credential creation w3c/webauthn#1149, by @equalsJeffH.
-
TPM attestation format & EdDSA & hash alg w3c/webauthn#1148, by @tanguilp.
-
add notion of "enterprise" attestation w3c/webauthn#1147, by @equalsJeffH.
-
Maybe upgrade user handle PII prohibition to a MUST w3c/webauthn#1146, by @agl.
-
Redirected Icon Validation w3c/webauthn#1139, by @akshayku.
-
update editor's draft to link to newly published Prop Rec w3c/webauthn#1138, by @equalsJeffH.
-
update @equalJeffH's affiliation w3c/webauthn#1137, by @equalsJeffH.
-
RP ops registration step 16 is missing a case for None attestation w3c/webauthn#1136, by @emlun.
-
Refer android-safetynet verification to SafetyNet documentation? w3c/webauthn#1135, by @emlun.
-
add explanatory note to step 3 in authenticatorMakeCredential Operation w3c/webauthn#1133, by @equalsJeffH.
-
Is android-safetynet attestation trust path limited to one cert? w3c/webauthn#1132, by @emlun.
-
WebAuthn Authenticators are FIDO Authenticators w3c/webauthn#1128, by @yackermann.
-
Attestation privacy advice creates large scale security risks w3c/webauthn#1127, by @yackermann.
-
-
4 issues closed.
-
Redirected Icon Validation w3c/webauthn#1139.
-
SafetyNet response as an extension w3c/webauthn#1011.
-
Document wide review w3c/webauthn#106.
-
Clarify which user to authenticate if userHandle is not present w3c/webauthn#1078.
-
-
16 issues received 77 new comments.
-
No way to verify requireResidentKey during registration step at RP side w3c/webauthn#1060 (14 comments by @emlun, @equalsJeffH, @Kieun, @yackermann)
-
Attestation privacy advice creates large scale security risks w3c/webauthn#1127 (11 comments by @emlun, @ratoui, @rlin1, @yackermann)
-
Propose extension: Delegation of Authentication w3c/webauthn#1125 (10 comments by @bvandersloot, @emlun)
-
Is android-safetynet attestation trust path limited to one cert? w3c/webauthn#1132 (9 comments by @agl, @arnar, @emlun, @Kieun, @yackermann)
-
WebAuthn Authenticators are FIDO Authenticators w3c/webauthn#1128 (7 comments by @emlun, @yackermann)
-
Add notion of forbidding resident credential creation w3c/webauthn#1149 (5 comments by @dwaite, @emlun, @equalsJeffH, @Kieun)
-
How do I use a smart phone as an authenticator when the web application is running on a laptop/desktop? w3c/webauthn#954 (4 comments by @emlun, @glerchundi, @ToruAoyagi)
-
spec is missing baseline posture that credential source is bound to a particular authenticator w3c/webauthn#1122 (2 comments by @emlun, @jcjones)
-
Refer android-safetynet verification to SafetyNet documentation? w3c/webauthn#1135 (1 comment by @emlun)
-
Indicate resident key credential "preferred" during registration and find out what the authenticator offered w3c/webauthn#991 (1 comment by @yackermann)
-
-
10 pull requests opened.
-
Add None attestation case to RP ops registration step 16 w3c/webauthn#1145, by @emlun.
-
Make appid extension always return true w3c/webauthn#1144, by @emlun.
-
Determine appid extension output after authenticator returns w3c/webauthn#1143, by @emlun.
-
Fix android-safetynet trust path w3c/webauthn#1142, by @emlun.
-
Recommend minimal basic attestation batches w3c/webauthn#1141, by @emlun.
-
Let requireUserPresence always be true in authenticator operations w3c/webauthn#1140, by @emlun.
-
Use RFC2119 for defined extensions w3c/webauthn#1134, by @plehegar.
-
Add examples of authenticator types to Authenticator definition w3c/webauthn#1131, by @emlun.
-
Add "Webauthn Authenticator" definition alias w3c/webauthn#1130, by @emlun.
-
Replaced WebAuthn authenticator with FIDO2 authenticator w3c/webauthn#1129, by @yackermann.
-
-
5 pull requests merged.
-
Use RFC2119 for defined extensions w3c/webauthn#1134.
-
In safetynet attestation "nonce" is base64, not base64url w3c/webauthn#1093.
-
Fix typo in credential registration steps w3c/webauthn#1120.
-
Singularize a "Relying Parties'" to "Relying Party's" w3c/webauthn#1126.
-
Clarify user identification in RP assertion verification operation w3c/webauthn#1082.
-
-
2 pull requests closed.
-
Propose SafetyNet as an extension w3c/webauthn#1010.
-
Replaced WebAuthn authenticator with FIDO2 authenticator w3c/webauthn#1129.
-
-
9 pull requests received 18 new comments.
-
Recommend minimal basic attestation batches w3c/webauthn#1141 (3 comments by @agl, @emlun, @yackermann)
-
Note that appid should be set to the previously used AppID w3c/webauthn#1118 (3 comments by @emlun, @jcjones)
-
Add None attestation case to RP ops registration step 16 w3c/webauthn#1145 (2 comments by @agl, @yackermann)
-
Rewrite security consideration on attestation and MitM attacks w3c/webauthn#1095 (1 comment by @emlun)