Web Authentication Working Group - Activity in 2020
No matches.
TR publications
-
2 documents published.
-
Web Authentication: An API for accessing Public Key Credentials - Level 2 published as a Candidate Recommendation Snapshot. History of Web Authentication: An API for accessing Public Key Credentials - Level 2
-
Participants
-
1 participant left.
-
Haiguang Wang (Huawei) left.
-
GitHub
w3c/webauthn
-
5 issues opened.
-
Broken reference link for [EduPersonObjectClassSpec]. w3c/webauthn#1544, by @wseltzer.
-
Question about platform authenticator w3c/webauthn#1540, by @jason-webcomm.
-
ban empty user ID / user handle w3c/webauthn#1536, by @equalsJeffH.
-
Broken link to SVG in Figure 3 at w3.org w3c/webauthn#1534, by @riastradh.
-
How should website authors "get or create"? w3c/webauthn#1533, by @lgarron.
-
-
8 issues closed.
-
Support for language/direction metadata in PKCE 'name'? w3c/webauthn#1526.
-
How should website authors "get or create"? w3c/webauthn#1533.
-
Update Contributors for CR w3c/webauthn#1494.
-
ban empty user ID / user handle w3c/webauthn#1536.
-
String Handling section nits w3c/webauthn#1527.
-
Broken link to SVG in Figure 3 at w3.org w3c/webauthn#1534.
-
-
10 issues received 32 new comments.
-
Update Contributors for CR w3c/webauthn#1494 (6 comments by @futureimperfect, @Kieun, @nicksteele, @selfissued, @ve7jtb)
-
How should website authors "get or create"? w3c/webauthn#1533 (5 comments by @equalsJeffH, @lgarron, @ptoomey3)
-
user-agent signal for enterprise attestation should be understandable for general users w3c/webauthn#1521 (4 comments by @jumde, @nadalin, @samuelweiler, @swickr)
-
Question about platform authenticator w3c/webauthn#1540 (4 comments by @dwaite, @jason-webcomm, @Kieun, @sbweeden)
-
Length restriction on user handles has no processing model associated with it w3c/webauthn#1302 (3 comments by @agl, @annevk, @dveditz)
-
Consider allowing cross-domain credential use w3c/webauthn#1372 (2 comments by @mpeng-okta, @timcappalli)
-
How do I use a smart phone as an authenticator when the web application is running on a laptop/desktop? w3c/webauthn#954 (1 comment by @yaitskov)
-
-
10 pull requests opened.
-
Mark for CR w3c/webauthn#1543, by @wseltzer.
-
hold CR boilerplate for PP 2017 w3c/webauthn#1542, by @wseltzer.
-
fix an errant http w3c/webauthn#1541, by @wseltzer.
-
Add algorithm step to enforce specified limits on user.id. w3c/webauthn#1539, by @agl.
-
Fix missing '<' w3c/webauthn#1538, by @agl.
-
Ban empty user.id aka user handle w3c/webauthn#1537, by @equalsJeffH.
-
A manifest file for echidna w3c/webauthn#1535, by @wseltzer.
-
Create Block anyone who is trying to track me emails inboxes w3c/webauthn#1532, by @Asnohnam.
-
Update Contributors for CR w3c/webauthn#1531, by @ve7jtb.
-
Specify language and direction encoding. w3c/webauthn#1530, by @agl.
-
-
11 pull requests merged.
-
Mark for CR w3c/webauthn#1543.
-
hold CR boilerplate for PP 2017 w3c/webauthn#1542.
-
fix an errant http w3c/webauthn#1541.
-
Specify language and direction encoding. w3c/webauthn#1530.
-
Add algorithm step to enforce specified limits on user.id. w3c/webauthn#1539.
-
Fix missing '<' w3c/webauthn#1538.
-
Update Contributors for CR w3c/webauthn#1531.
-
Ban empty user.id aka user handle w3c/webauthn#1537.
-
A manifest file for echidna w3c/webauthn#1535.
-
Tweaks to string handling section w3c/webauthn#1529.
-
Update names in examples. w3c/webauthn#1528.
-
-
1 pull request closed.
-
Create Block anyone who is trying to track me emails inboxes w3c/webauthn#1532.
-
-
5 pull requests received 27 new comments.
-
Specify language and direction encoding. w3c/webauthn#1530 (11 comments by @agl, @aphillips, @equalsJeffH, @nadalin)
-
Create Block anyone who is trying to track me emails inboxes w3c/webauthn#1532 (1 comment by @emlun)
-
TR publications
-
1 document published.
Participants
-
2 participants joined.
-
Daniel Veditz (Mozilla Foundation) joined.
-
Keiko Itakura (Rakuten Group, Inc.) joined.
-
GitHub
w3c/webauthn
-
12 issues opened.
-
String Handling section nits w3c/webauthn#1527, by @aphillips.
-
Support for language/direction metadata in PKCE 'name'? w3c/webauthn#1526, by @aphillips.
-
Algorithm step numbers out of sync w3c/webauthn#1523, by @emlun.
-
Making PublicKeyCredentialDescriptor.transports mandatory w3c/webauthn#1522, by @arshadnoor.
-
user-agent signal for enterprise attestation should be understandable for general users w3c/webauthn#1521, by @jumde.
-
KeyUsage requirement (Certificate Signing or empty) for attestation roots w3c/webauthn#1519, by @xbillyj.
-
largeBlob storage extension can be used to bypass 3p storage restrictions w3c/webauthn#1518, by @jumde.
-
Location extension returns the authenticator coordinates to RP without user consent w3c/webauthn#1517, by @jumde.
-
migrate the WebAuthn L2 spec to the W3C 2020 Process Document? w3c/webauthn#1515, by @equalsJeffH.
-
Support for PWA authenticators w3c/webauthn#1514, by @jcayzac.
-
User verification policy leads to ambiguous usage situations. w3c/webauthn#1510, by @Firstyear.
-
-
10 issues closed.
-
KeyUsage requirement (Certificate Signing or empty) for attestation roots w3c/webauthn#1519.
-
Algorithm step numbers out of sync w3c/webauthn#1523.
-
largeBlob storage extension can be used to bypass 3p storage restrictions w3c/webauthn#1518.
-
migrate the WebAuthn L2 spec to the W3C 2020 Process Document? w3c/webauthn#1515.
-
ensure basic attestation type allows for self-signed attestation certs w3c/webauthn#1498.
-
Update IANA Considerations section w3c/webauthn#1495.
-
is None attestation format registered with IANA? Do so if not. w3c/webauthn#1493.
-
Inconsistent display formats for OIDs w3c/webauthn#1504.
-
-
1 issue reopened.
-
Length restriction on user handles has no processing model associated with it w3c/webauthn#1302, by @jcjones.
-
-
17 issues received 55 new comments.
-
User verification policy leads to ambiguous usage situations. w3c/webauthn#1510 (15 comments by @emlun, @equalsJeffH, @Firstyear, @sbweeden, @ve7jtb)
-
Length restriction on user handles has no processing model associated with it w3c/webauthn#1302 (8 comments by @agl, @bzbarsky, @jcjones, @nsatragno, @othermaciej)
-
largeBlob storage extension can be used to bypass 3p storage restrictions w3c/webauthn#1518 (6 comments by @emlun, @jumde, @kenrb, @nicksteele)
-
Consider allowing cross-domain credential use w3c/webauthn#1372 (5 comments by @dwaite, @emlun, @mpeng-okta)
-
Consider adding/using personal name examples that are more culturally neutral/diverse [editorial] w3c/webauthn#1525 (3 comments by @agl, @aphillips, @emlun)
-
Location extension returns the authenticator coordinates to RP without user consent w3c/webauthn#1517 (3 comments by @agl, @jumde, @ve7jtb)
-
Support for language/direction metadata in PKCE 'name'? w3c/webauthn#1526 (2 comments by @agl, @ve7jtb)
-
migrate the WebAuthn L2 spec to the W3C 2020 Process Document? w3c/webauthn#1515 (2 comments by @wseltzer)
-
double check whether the Secure Payment Confirmation effort has implications on the WebAuthn spec w3c/webauthn#1492 (1 comment by @equalsJeffH)
-
Making PublicKeyCredentialDescriptor.transports mandatory w3c/webauthn#1522 (1 comment by @jonathan-Mastercard)
-
KeyUsage requirement (Certificate Signing or empty) for attestation roots w3c/webauthn#1519 (1 comment by @agl)
-
user-agent signal for enterprise attestation should be understandable for general users w3c/webauthn#1521 (1 comment by @agl)
-
need "how to install bikeshed in one's local webauthn repo clone" instructions w3c/webauthn#1477 (1 comment by @wseltzer)
-
How do I use a smart phone as an authenticator when the web application is running on a laptop/desktop? w3c/webauthn#954 (1 comment by @pegah5665)
-
-
8 pull requests opened.
-
Tweaks to string handling section w3c/webauthn#1529, by @agl.
-
Update names in examples. w3c/webauthn#1528, by @agl.
-
Fix out-of-sync step number w3c/webauthn#1524, by @emlun.
-
Update for L2-WD04 publication w3c/webauthn#1520, by @wseltzer.
-
Update bikeshed files for Process 2020 w3c/webauthn#1516, by @wseltzer.
-
Address review comment by @bdewater w3c/webauthn#1513, by @emlun.
-
update IANA considerations per IANA instructions w3c/webauthn#1512, by @equalsJeffH.
-
IANA registration for 'none' attestation statement format identifier w3c/webauthn#1511, by @equalsJeffH.
-
-
9 pull requests merged.
-
Fix out-of-sync step number w3c/webauthn#1524.
-
Update for L2-WD04 publication w3c/webauthn#1520.
-
Update bikeshed files for Process 2020 w3c/webauthn#1516.
-
ensure basic attestation type allows for self-signed attestation certs w3c/webauthn#1509.
-
Address review comment by @bdewater w3c/webauthn#1513.
-
update IANA considerations per IANA instructions w3c/webauthn#1512.
-
IANA registration for 'none' attestation statement format identifier w3c/webauthn#1511.
-
Display OIDs consistently w3c/webauthn#1508.
-
Fix a link to userVerification parameter w3c/webauthn#1507.
-
-
4 pull requests received 15 new comments.
-
ensure basic attestation type allows for self-signed attestation certs w3c/webauthn#1509 (7 comments by @akshayku, @emlun, @equalsJeffH, @jcjones)
-
Participants
-
5 participants joined.
-
Garrett Davidson (Apple Inc.) joined.
-
Mohammad Mikal Bin Amrul Halim Gan (SoftBank Corp.) joined.
-
Lu Zheng (SoftBank Corp.) joined.
-
Shougo Matsuda (SoftBank Corp.) joined.
-
Nick Mooney (Google LLC) joined.
-
-
1 participant left.
-
Nick Mooney (Google LLC) left.
-
GitHub
w3c/webauthn
-
10 issues opened.
-
Virtual Authenticator support for CTAP 2.1 w3c/webauthn#1505, by @kreichgauer.
-
Inconsistent display formats for OIDs w3c/webauthn#1504, by @emlun.
-
Difference Level-1 and Level-2 w3c/webauthn#1501, by @petermorlion.
-
ensure basic attestation type allows for self-signed attestation certs w3c/webauthn#1498, by @equalsJeffH.
-
Update editors and past editors for L2 Proposed Rec w3c/webauthn#1496, by @nadalin.
-
Update IANA Considerations section w3c/webauthn#1495, by @nicksteele.
-
Update Contributors for CR w3c/webauthn#1494, by @ve7jtb.
-
is None attestation format registered with IANA? Do so if not. w3c/webauthn#1493, by @equalsJeffH.
-
How to use WebAuth with caBLE? w3c/webauthn#1490, by @SilentImp.
-
-
10 issues closed.
-
Virtual Authenticator support for CTAP 2.1 w3c/webauthn#1505.
-
Refer to IntersectionObserver from the Security Considerations w3c/webauthn#1105.
-
more fully delineate "privacy ca", "attestation ca", "anonymization ca" w3c/webauthn#1422.
-
add additional attestation format(s) from Apple w3c/webauthn#1453.
-
RP guidance for `invalidStateError` returned from `[[Create]]()` w3c/webauthn#1331.
-
Difference Level-1 and Level-2 w3c/webauthn#1501.
-
changing to "permissions policy" messed up MDN links w3c/webauthn#1486.
-
Add clearer definition of API use cases to the spec w3c/webauthn#334.
-
"signature formats" section is underspecified w3c/webauthn#1441.
-
How to use WebAuth with caBLE? w3c/webauthn#1490.
-
-
14 issues received 26 new comments.
-
ensure basic attestation type allows for self-signed attestation certs w3c/webauthn#1498 (3 comments by @equalsJeffH, @sbweeden)
-
RP guidance for `invalidStateError` returned from `[[Create]]()` w3c/webauthn#1331 (2 comments by @equalsJeffH, @sbweeden)
-
is None attestation format registered with IANA? Do so if not. w3c/webauthn#1493 (1 comment by @sbweeden)
-
double check whether the Secure Payment Confirmation effort has implications on the WebAuthn spec w3c/webauthn#1492 (1 comment by @rlin1)
-
10 pull requests opened.
-
ensure basic attestation type allows for self-signed attestation certs w3c/webauthn#1509, by @equalsJeffH.
-
Display OIDs consistently w3c/webauthn#1508, by @emlun.
-
Fix a link to userVerification parameter w3c/webauthn#1507, by @emlun.
-
Add Virtual Authenticator support for CTAP 2.1 w3c/webauthn#1506, by @kreichgauer.
-
Minor editorial errata w3c/webauthn#1503, by @sbweeden.
-
RP guidance on error conditions w3c/webauthn#1502, by @sbweeden.
-
Change variable name: uvpaaAvailable → uvpaAvailable w3c/webauthn#1500, by @lgarron.
-
define "self-signed basic attestation type" "SSBasic" w3c/webauthn#1499, by @equalsJeffH.
-
Mention Intersection Observer v2 in sec considerations w3c/webauthn#1497, by @equalsJeffH.
-
Adding Apple Anonymous Attestation Statement Format w3c/webauthn#1491, by @alanwaketan.
-
-
8 pull requests merged.
-
Add Virtual Authenticator support for CTAP 2.1 w3c/webauthn#1506.
-
Mention Intersection Observer v2 in sec considerations w3c/webauthn#1497.
-
Abstracting the concept of Privacy CA/Attestation CA into Anonymization CA w3c/webauthn#1474.
-
Adding Apple Anonymous Attestation Statement Format w3c/webauthn#1491.
-
Change variable name: uvpaaAvailable → uvpaAvailable w3c/webauthn#1500.
-
Minor editorial errata w3c/webauthn#1503.
-
RP guidance on error conditions w3c/webauthn#1502.
-
Clarify signature format for packed attestations et al w3c/webauthn#1488.
-
-
1 pull request closed.
-
define "self-signed basic attestation type" "SSBasic" w3c/webauthn#1499.
-
-
1 pull request reopened.
-
Adding Apple Anonymous Attestation Statement Format w3c/webauthn#1491, by @yackermann.
-
-
10 pull requests received 65 new comments.
-
Adding Apple Anonymous Attestation Statement Format w3c/webauthn#1491 (35 comments by @alanwaketan, @bdewater, @emlun, @equalsJeffH, @MasterKale, @nicksteele, @sbweeden, @yackermann)
-
Abstracting the concept of Privacy CA/Attestation CA into Anonymization CA w3c/webauthn#1474 (15 comments by @akshayku, @alanwaketan, @emlun, @equalsJeffH, @sbweeden, @timcappalli, @ve7jtb)
-
define "self-signed basic attestation type" "SSBasic" w3c/webauthn#1499 (5 comments by @equalsJeffH, @RaeHayward, @ve7jtb, @yackermann)
-
Mention Intersection Observer v2 in sec considerations w3c/webauthn#1497 (4 comments by @emlun, @equalsJeffH, @jcjones)
-
Participants
-
2 participants joined.
-
Jongho Shin (LINE Corporation) joined.
-
Charles Hubain (LINE Corporation) joined.
-
-
1 participant left.
-
Nitin Sarangdhar (Intel Corporation) left.
-
-
1 organization joined.
-
LINE Corporation joined.
-
GitHub
w3c/webauthn
-
7 issues opened.
-
cleanup <pre class=anchors> and use <pre class="link-defaults"> as appropriate w3c/webauthn#1489, by @equalsJeffH.
-
Is it possible to fail the registration ceremony if a certain extension is not present? w3c/webauthn#1487, by @arianvp.
-
changing to "permissions policy" messed up MDN links w3c/webauthn#1486, by @equalsJeffH.
-
Handling unwanted or unsupported attestation formats w3c/webauthn#1485, by @madwizard-thomas.
-
Remove Out-Of-Scope PRF Extension w3c/webauthn#1478, by @jcjones.
-
need "how to install bikeshed in one's local webauthn repo clone" instructions w3c/webauthn#1477, by @equalsJeffH.
-
-
8 issues closed.
-
Handling unwanted or unsupported attestation formats w3c/webauthn#1485.
-
Remove Out-Of-Scope PRF Extension w3c/webauthn#1478.
-
update "feature policy" reference to new name: "permissions policy" w3c/webauthn#1473.
-
Virtual authenticator support for extensions w3c/webauthn#1471.
-
1 issue reopened.
-
Move PRF Extension into its own specification w3c/webauthn#1462, by @nadalin.
-
-
16 issues received 60 new comments.
-
New platform authenticators are making discoverable credentials regardless of residentKey=false passed to Create() w3c/webauthn#1457 (11 comments by @akshayku, @arianvp, @equalsJeffH, @sbweeden)
-
Handling unwanted or unsupported attestation formats w3c/webauthn#1485 (7 comments by @akshayku, @emlun, @jcjones, @Kieun, @madwizard-thomas, @nicksteele)
-
more fully delineate "privacy ca", "attestation ca", "anonymization ca" w3c/webauthn#1422 (6 comments by @alanwaketan, @emlun, @equalsJeffH)
-
Move PRF Extension into its own specification w3c/webauthn#1462 (5 comments by @emlun, @equalsJeffH, @jcjones, @ve7jtb)
-
The risk of attacker may can identify whether if the account support FIDO or not w3c/webauthn#1475 (5 comments by @emlun, @keikoit, @maxhata)
-
Is it possible to fail the registration ceremony if a certain extension is not present? w3c/webauthn#1487 (4 comments by @arianvp, @ve7jtb)
-
Provide the public key in `AuthenticatorAttestationResponse` w3c/webauthn#1363 (4 comments by @agl, @ChrisPZone)
-
need "how to install bikeshed in one's local webauthn repo clone" instructions w3c/webauthn#1477 (4 comments by @emlun, @equalsJeffH, @jcayzac)
-
Clearly define the way how RP handles the extensions w3c/webauthn#1258 (2 comments by @Kieun, @madwizard-thomas)
-
Add explicit description on what should be done in incognito/private browsing mode w3c/webauthn#1174 (1 comment by @equalsJeffH)
-
-
5 pull requests opened.
-
Clarify signature format for packed attestations et al w3c/webauthn#1488, by @equalsJeffH.
-
Add note about fixed/empty user handles w3c/webauthn#1483, by @agl.
-
Remove the Psuedo-Random Function extension w3c/webauthn#1481, by @jcjones.
-
Add security consideration on detecting non-WebAuthn accounts w3c/webauthn#1480, by @emlun.
-
Update .spec-data .bikeshed-include cache w3c/webauthn#1479, by @jcayzac.
-
-
7 pull requests merged.
-
Make largeBlobs explicit during create. w3c/webauthn#1470.
-
Add note about fixed/empty user handles w3c/webauthn#1483.
-
Remove the Psuedo-Random Function extension w3c/webauthn#1481.
-
Update "feature policy" refs to new name "permissions policy" (#1473) w3c/webauthn#1476.
-
Add security consideration on detecting non-WebAuthn accounts w3c/webauthn#1480.
-
Update .spec-data .bikeshed-include cache w3c/webauthn#1479.
-
Virtual authenticators extension support w3c/webauthn#1472.
-
-
6 pull requests received 49 new comments.
-
Make largeBlobs explicit during create. w3c/webauthn#1470 (19 comments by @agl, @emlun, @equalsJeffH, @nsatragno)
-
Virtual authenticators extension support w3c/webauthn#1472 (12 comments by @emlun, @jcjones, @nsatragno)
-
Update "feature policy" refs to new name "permissions policy" (#1473) w3c/webauthn#1476 (7 comments by @equalsJeffH, @jcayzac)
-
Abstracting the concept of Privacy CA/Attestation CA into Anonymization CA w3c/webauthn#1474 (6 comments by @alanwaketan, @emlun, @equalsJeffH)
-
Add note about fixed/empty user handles w3c/webauthn#1483 (4 comments by @agl, @equalsJeffH, @lgarron)
-
Add security consideration on detecting non-WebAuthn accounts w3c/webauthn#1480 (1 comment by @equalsJeffH)
-
Participants
-
1 chair appointed.
-
Anthony Nadalin became a chair.
-
-
1 chair stepped down.
-
Anthony Nadalin stepped down as a chair.
-
-
2 participants joined.
-
Julien Cayzac (Rakuten Group, Inc.) joined.
-
Anthony Nadalin (W3C Invited Experts) joined.
-
-
2 participants left.
-
Swapnil Deshmukh (Certus Cybersecurity Solutions LLC) left.
-
Anthony Nadalin (W3C Invited Experts) left.
-
-
1 organization joined.
-
Rakuten Group, Inc. joined.
-
-
1 organization left.
-
Certus Cybersecurity Solutions LLC left.
-
GitHub
w3c/webauthn
-
5 issues opened.
-
The risk of attacker may can identify whether if the account support FIDO or not w3c/webauthn#1475, by @keikoit.
-
update "feature policy" reference to new name: "permissions policy" w3c/webauthn#1473, by @equalsJeffH.
-
Virtual authenticator support for extensions w3c/webauthn#1471, by @nsatragno.
-
Reference IANA WebAuthn registries w3c/webauthn#1468, by @selfissued.
-
Platform authenticator support is inconsistent in private/incognito modes w3c/webauthn#1465, by @yackermann.
-
-
4 issues closed.
-
Platform authenticator support is inconsistent in private/incognito modes w3c/webauthn#1465.
-
How "preferred" is a "preferred" resident key w3c/webauthn#1463.
-
Reference IANA WebAuthn registries w3c/webauthn#1468.
-
11 issues received 36 new comments.
-
How "preferred" is a "preferred" resident key w3c/webauthn#1463 (9 comments by @agl, @akshayku, @christiaanbrand, @Kieun, @maxhata, @sbweeden, @ve7jtb)
-
more fully delineate "privacy ca", "attestation ca", "anonymization ca" w3c/webauthn#1422 (6 comments by @alanwaketan, @dwaite, @equalsJeffH, @nadalin, @ve7jtb)
-
Move PRF Extension into its own specification w3c/webauthn#1462 (5 comments by @gangyal, @jcjones, @OR13, @selfissued, @ve7jtb)
-
Platform authenticator support is inconsistent in private/incognito modes w3c/webauthn#1465 (4 comments by @alanwaketan, @nicksteele, @yackermann)
-
The risk of attacker may can identify whether if the account support FIDO or not w3c/webauthn#1475 (3 comments by @Kieun, @maxhata)
-
add additional attestation format(s) from Apple w3c/webauthn#1453 (2 comments by @equalsJeffH, @mackie1001)
-
New platform authenticators are making discoverable credentials regardless of residentKey=false passed to Create() w3c/webauthn#1457 (2 comments by @agl, @equalsJeffH)
-
update "feature policy" reference to new name: "permissions policy" w3c/webauthn#1473 (1 comment by @jcayzac)
-
revise "resident key" language in authenticatorSelection section to emphasize the "(non-)discoverable" notion w3c/webauthn#1459 (1 comment by @equalsJeffH)
-
-
7 pull requests opened.
-
Update "feature policy" refs to new name "permissions policy" (#1473) w3c/webauthn#1476, by @jcayzac.
-
Abstracting the concept of Privacy CA/Attestation CA into Anonymization CA w3c/webauthn#1474, by @alanwaketan.
-
Virtual authenticators extension support w3c/webauthn#1472, by @nsatragno.
-
Make largeBlobs explicit during create. w3c/webauthn#1470, by @agl.
-
Use RFC 8809 w3c/webauthn#1469, by @selfissued.
-
Update description of residentKey w3c/webauthn#1467, by @agl.
-
Note that rk=preferred means strongly preferred. w3c/webauthn#1466, by @agl.
-
-
4 pull requests merged.
-
Update description of residentKey w3c/webauthn#1467.
-
Note that rk=preferred means strongly preferred. w3c/webauthn#1466.
-
Fix spec-build errors (editorial) w3c/webauthn#1461.
-
Use RFC 8809 w3c/webauthn#1469.
-
-
6 pull requests received 18 new comments.
-
Update description of residentKey w3c/webauthn#1467 (10 comments by @agl, @akshayku, @equalsJeffH, @sbweeden)
-
Abstracting the concept of Privacy CA/Attestation CA into Anonymization CA w3c/webauthn#1474 (1 comment by @alanwaketan)
-
TR publications
-
1 document published.
Participants
-
1 participant joined.
-
Andy Watson (Fiserv) joined.
-
-
1 participant left.
-
Axel Nennker (Deutsche Telekom AG) left.
-
-
1 organization joined.
-
Fiserv joined.
-
-
1 organization left.
-
Deutsche Telekom AG left.
-
GitHub
w3c/webauthn
-
9 issues opened.
-
How "preferred" is a "preferred" resident key w3c/webauthn#1463, by @christiaanbrand.
-
Move PRF Extension into its own specification w3c/webauthn#1462, by @jcjones.
-
Remove mutable information from credential ID generation w3c/webauthn#1458, by @nsatragno.
-
Personal information updates & webauthn w3c/webauthn#1456, by @nsatragno.
-
Create an implementation issue tag, route implementation questions to community group w3c/webauthn#1454, by @nicksteele.
-
add additional attestation format(s) from Apple w3c/webauthn#1453, by @equalsJeffH.
-
Requesting properties of created credentials. w3c/webauthn#1449, by @ve7jtb.
-
-
7 issues closed.
-
Remove mutable information from credential ID generation w3c/webauthn#1458.
-
update RP ID definition to allow URL syntax or arbitrary strings w3c/webauthn#1406.
-
§9.2 requires client extension output but appidExclude sets none w3c/webauthn#1445.
-
Unclear whether compressed curve points need to be supported by RPs w3c/webauthn#1447.
-
Is AuthenticationExtensionsAuthenticatorInputs unused? w3c/webauthn#1435.
-
Bio-Metric Authentication done by Another finger print w3c/webauthn#1444.
-
-
24 issues received 50 new comments.
-
WebAuthn and Web Payments -- Transaction Confirmation, 3DS2, SRC, etc. w3c/webauthn#1396 (8 comments by @adrianhopebailie, @bleddyv, @Champion0081, @cyberphone)
-
PublicKeyCredentialParameters can't select curve (E.g. ed448) w3c/webauthn#1446 (5 comments by @agl, @arianvp, @equalsJeffH, @ve7jtb)
-
Clarify how a user can authenticate from multiple devices w3c/webauthn#151 (4 comments by @Ali-Amir, @emlun, @nicksteele)
-
Unclear whether compressed curve points need to be supported by RPs w3c/webauthn#1447 (4 comments by @agl, @arianvp, @equalsJeffH, @ve7jtb)
-
How "preferred" is a "preferred" resident key w3c/webauthn#1463 (3 comments by @christiaanbrand, @ve7jtb)
-
Requesting properties of created credentials. w3c/webauthn#1449 (3 comments by @emlun, @equalsJeffH, @sbweeden)
-
Bio-Metric Authentication done by Another finger print w3c/webauthn#1444 (3 comments by @agl, @securewebsite)
-
more fully delineate "privacy ca", "attestation ca", "anonymization ca" w3c/webauthn#1422 (2 comments by @equalsJeffH)
-
Provide the public key in `AuthenticatorAttestationResponse` w3c/webauthn#1363 (2 comments by @craigfrancis)
-
Consider allowing cross-domain credential use w3c/webauthn#1372 (2 comments by @emlun, @equalsJeffH)
-
New platform authenticators are making discoverable credentials regardless of residentKey=false passed to Create() w3c/webauthn#1457 (1 comment by @equalsJeffH)
-
Create an implementation issue tag, route implementation questions to community group w3c/webauthn#1454 (1 comment by @equalsJeffH)
-
Add explicit description on what should be done in incognito/private browsing mode w3c/webauthn#1174 (1 comment by @equalsJeffH)
-
Refer to IntersectionObserver from the Security Considerations w3c/webauthn#1105 (1 comment by @equalsJeffH)
-
"privacy ca" term in images/fido-attestation-structures.svg w3c/webauthn#1421 (1 comment by @equalsJeffH)
-
RP guidance for `invalidStateError` returned from `[[Create]]()` w3c/webauthn#1331 (1 comment by @equalsJeffH)
-
think about adding note wrt how client platform might obtain authenticator capabilities w3c/webauthn#1207 (1 comment by @equalsJeffH)
-
-
6 pull requests opened.
-
Fix spec-build errors (editorial) w3c/webauthn#1461, by @equalsJeffH.
-
Do not wrap `otherUI` into credential ID w3c/webauthn#1460, by @nsatragno.
-
Fix ambiguous {{appidExclude}} link w3c/webauthn#1455, by @emlun.
-
Update RP ID definition to allow URL syntax or arbitrary strings w3c/webauthn#1452, by @equalsJeffH.
-
Use conforming appidExclude client extension output w3c/webauthn#1451, by @selfissued.
-
Prohibit compressed points in COSE keys. w3c/webauthn#1450, by @agl.
-
-
7 pull requests merged.
-
Do not wrap `otherUI` into credential ID w3c/webauthn#1460.
-
Fix ambiguous {{appidExclude}} link w3c/webauthn#1455.
-
Update RP ID definition to allow URL syntax or arbitrary strings w3c/webauthn#1452.
-
Use conforming appidExclude client extension output w3c/webauthn#1451.
-
Prohibit compressed points in COSE keys. w3c/webauthn#1450.
-
Replace AuthenticationExtensionsAuthenticatorInputs with CDDL w3c/webauthn#1440.
-
PRF extension. w3c/webauthn#1424.
-
-
1 pull request closed.
-
Revert "Addressed additional IESG comment by Magnus Westerlund" w3c/webauthn#1448.
-
-
5 pull requests received 27 new comments.
-
Update RP ID definition to allow URL syntax or arbitrary strings w3c/webauthn#1452 (14 comments by @agl, @emlun, @equalsJeffH, @nicksteele)
-
Do not wrap `otherUI` into credential ID w3c/webauthn#1460 (5 comments by @emlun, @equalsJeffH, @nsatragno)
-
Revert "Addressed additional IESG comment by Magnus Westerlund" w3c/webauthn#1448 (1 comment by @equalsJeffH)
-
Participants
-
7 participants joined.
-
Jake Ingman (Cisco) joined.
-
Jake Payton (Cisco) joined.
-
Jeremy Erickson (Cisco) joined.
-
Marie Jordan (Visa) joined.
-
Haiguang Wang (Huawei) joined.
-
Gavin Shenker (Visa) joined.
-
Arvind Santhanaraman (Visa) joined.
-
-
1 organization joined.
-
Huawei joined.
-
GitHub
w3c/webauthn
-
10 issues opened.
-
Unclear whether compressed curve points need to be supported by RPs w3c/webauthn#1447, by @arianvp.
-
PublicKeyCredentialParameters can't select curve (E.g. ed448) w3c/webauthn#1446, by @arianvp.
-
§9.2 requires client extension output but appidExclude sets none w3c/webauthn#1445, by @emlun.
-
Bio-Metric Authentication done by Another finger print w3c/webauthn#1444, by @securewebsite.
-
clientDataJSON sent to authenticator? w3c/webauthn#1442, by @Nesuma.
-
"signature formats" section is underspecified w3c/webauthn#1441, by @equalsJeffH.
-
registration of EdDSA credentials without resident keys fails w3c/webauthn#1437, by @nicocaille.
-
Suggested use of getTransports() incorrectly calls it from `credential` w3c/webauthn#1436, by @MasterKale.
-
Is AuthenticationExtensionsAuthenticatorInputs unused? w3c/webauthn#1435, by @emlun.
-
What is the difference between origin verification at client and RP end? w3c/webauthn#1434, by @tarun14110.
-
-
15 issues closed.
-
TPM section is missing TPMT_PUBLIC validation steps w3c/webauthn#929.
-
adopt consistent terms for RP server-side and client-side components w3c/webauthn#80.
-
NULL or DOMException w3c/webauthn#876.
-
Eliminate duplicate terminology w3c/webauthn#358.
-
clientDataJSON sent to authenticator? w3c/webauthn#1442.
-
enrichen registration and authentication ceremonies definitions w3c/webauthn#1099.
-
registration of EdDSA credentials without resident keys fails w3c/webauthn#1437.
-
Suggested use of getTransports() incorrectly calls it from `credential` w3c/webauthn#1436.
-
Registering multiple devices without common interfaces w3c/webauthn#1429.
-
[=present=] throws link error w3c/webauthn#1397.
-
What is the difference between origin verification at client and RP end? w3c/webauthn#1434.
-
Example 4 in 1.3.3 uses txAuthSimple w3c/webauthn#1401.
-
MDN panels do not appear in editors' draft w3c/webauthn#1414.
-
-
23 issues received 69 new comments.
-
registration of EdDSA credentials without resident keys fails w3c/webauthn#1437 (12 comments by @agl, @emlun, @nicocaille, @ve7jtb)
-
Lack of support for modern ECC w3c/webauthn#1124 (8 comments by @arianvp, @bdewater, @dwaite, @equalsJeffH, @selfissued)
-
WebAuthn and Web Payments -- Transaction Confirmation, 3DS2, SRC, etc. w3c/webauthn#1396 (7 comments by @Champion0081, @cyberphone, @equalsJeffH, @rlin1)
-
Does AuthenticationExtensionsClientOutputs key have to be extension identifier or not? w3c/webauthn#1430 (7 comments by @akshayku, @emlun, @equalsJeffH, @selfissued)
-
update RP ID definition to allow URL syntax or arbitrary strings w3c/webauthn#1406 (3 comments by @equalsJeffH, @selfissued)
-
Bio-Metric Authentication done by Another finger print w3c/webauthn#1444 (3 comments by @agl, @emlun, @securewebsite)
-
clientDataJSON sent to authenticator? w3c/webauthn#1442 (3 comments by @dwaite, @Nesuma, @nicksteele)
-
Provide the public key in `AuthenticatorAttestationResponse` w3c/webauthn#1363 (3 comments by @agl, @MasterKale)
-
"signature formats" section is underspecified w3c/webauthn#1441 (2 comments by @nadalin, @selfissued)
-
§9.2 requires client extension output but appidExclude sets none w3c/webauthn#1445 (2 comments by @selfissued)
-
Registering multiple devices without common interfaces w3c/webauthn#1429 (2 comments by @emlun, @Nesuma)
-
What is the difference between origin verification at client and RP end? w3c/webauthn#1434 (2 comments by @emlun, @tarun14110)
-
MDN panels do not appear in editors' draft w3c/webauthn#1414 (2 comments by @sideshowbarker, @wseltzer)
-
adopt consistent terms for RP server-side and client-side components w3c/webauthn#80 (1 comment by @equalsJeffH)
-
Unclear whether compressed curve points need to be supported by RPs w3c/webauthn#1447 (1 comment by @arianvp)
-
`publicKey` member name in `CredentialCreationRequestOptions` should be `"public-key"`, or vice-versa? w3c/webauthn#1004 (1 comment by @equalsJeffH)
-
Refer to IntersectionObserver from the Security Considerations w3c/webauthn#1105 (1 comment by @jcjones)
-
Suggested use of getTransports() incorrectly calls it from `credential` w3c/webauthn#1436 (1 comment by @emlun)
-
-
8 pull requests opened.
-
Revert "Addressed additional IESG comment by Magnus Westerlund" w3c/webauthn#1448, by @nikalynn.
-
Clarify How Client Data is Sent to Authenticator w3c/webauthn#1443, by @nicksteele.
-
Replace AuthenticationExtensionsAuthenticatorInputs with CDDL w3c/webauthn#1440, by @emlun.
-
Add note about extensions not using ext ID as entry key w3c/webauthn#1439, by @emlun.
-
Fix references to AuthenticatorAttestationResponse.getTransports() w3c/webauthn#1438, by @emlun.
-
fix "present" link errors along with a couple others w3c/webauthn#1433, by @equalsJeffH.
-
Remove webdriver-spec.html from WebDriver URLs w3c/webauthn#1432, by @foolip.
-
Addressed additional IESG comment by Magnus Westerlund w3c/webauthn#1431, by @selfissued.
-
-
11 pull requests merged.
-
Clarify How Client Data is Sent to Authenticator w3c/webauthn#1443.
-
Add `largeBlob` extension. w3c/webauthn#1402.
-
Add note about extensions not using ext ID as entry key w3c/webauthn#1439.
-
Enrichen registration and authentication ceremonies definitions w3c/webauthn#1330.
-
Fix references to AuthenticatorAttestationResponse.getTransports() w3c/webauthn#1438.
-
fix "present" link errors along with a couple others w3c/webauthn#1433.
-
Document how to use update-bikeshed-cache.sh w3c/webauthn#1428.
-
Remove webdriver-spec.html from WebDriver URLs w3c/webauthn#1432.
-
Update examples to use current Extensions w3c/webauthn#1426.
-
Specify more about COSE algorithms. w3c/webauthn#1420.
-
Addressed additional IESG comment by Magnus Westerlund w3c/webauthn#1431.
-
-
2 pull requests closed.
-
WIP: More explicitly document use cases. w3c/webauthn#1300.
-
Added TPM verification clarifications w3c/webauthn#966.
-
-
12 pull requests received 121 new comments.
-
Add `largeBlob` extension. w3c/webauthn#1402 (18 comments by @agl, @bdewater, @emlun, @equalsJeffH, @ve7jtb)
-
Clarify How Client Data is Sent to Authenticator w3c/webauthn#1443 (10 comments by @emlun, @equalsJeffH, @Nesuma)
-
Document how to use update-bikeshed-cache.sh w3c/webauthn#1428 (5 comments by @equalsJeffH, @sideshowbarker)
-
Replace AuthenticationExtensionsAuthenticatorInputs with CDDL w3c/webauthn#1440 (4 comments by @emlun, @equalsJeffH)
-
Add note about extensions not using ext ID as entry key w3c/webauthn#1439 (2 comments by @emlun, @equalsJeffH)
-
fix "present" link errors along with a couple others w3c/webauthn#1433 (2 comments by @emlun, @equalsJeffH)
-
Remove webdriver-spec.html from WebDriver URLs w3c/webauthn#1432 (2 comments by @equalsJeffH, @foolip)
-
Enrichen registration and authentication ceremonies definitions w3c/webauthn#1330 (1 comment by @emlun)
Participants
-
1 participant joined.
-
Merwan Rodriguez (The Washington Post) joined.
-
-
1 organization joined.
-
The Washington Post joined.
-
GitHub
w3c/webauthn
-
7 issues opened.
-
Does AuthenticationExtensionsClientOutputs key have to be extension identifier or not? w3c/webauthn#1430, by @ynojima.
-
Registering multiple devices without common interfaces w3c/webauthn#1429, by @Nesuma.
-
more fully delineate "privacy ca", "attestation ca", "anonymization ca" w3c/webauthn#1422, by @equalsJeffH.
-
"privacy ca" term in images/fido-attestation-structures.svg w3c/webauthn#1421, by @equalsJeffH.
-
MDN panels do not appear in editors' draft w3c/webauthn#1414, by @equalsJeffH.
-
Is android safety net nonce the same as web authnn challenge? w3c/webauthn#1413, by @vieiralc.
-
Collect w3c/webauthn#1412, by @jrock4eva.
-
-
6 issues closed.
-
Is android safety net nonce the same as web authnn challenge? w3c/webauthn#1413.
-
Remove ECDAA? w3c/webauthn#1410.
-
Inputs to WebAuthn methods should not include strict Enum types w3c/webauthn#1376.
-
add "non-discoverable credential" to terminology section... w3c/webauthn#1409.
-
Provide the public key in `AuthenticatorAttestationResponse` w3c/webauthn#1363.
-
Collect w3c/webauthn#1412.
-
-
10 issues received 16 new comments.
-
MDN panels do not appear in editors' draft w3c/webauthn#1414 (5 comments by @dontcallmedom, @equalsJeffH, @sideshowbarker, @wseltzer)
-
add "non-discoverable credential" to terminology section... w3c/webauthn#1409 (1 comment by @equalsJeffH)
-
WebAuthn and Web Payments -- Transaction Confirmation, 3DS2, SRC, etc. w3c/webauthn#1396 (1 comment by @cyberphone)
-
update RP ID definition to allow URL syntax or arbitrary strings w3c/webauthn#1406 (1 comment by @emlun)
-
-
13 pull requests opened.
-
Document how to use update-bikeshed-cache.sh w3c/webauthn#1428, by @sideshowbarker.
-
Fix typo in update-bikeshed-cache.sh w3c/webauthn#1427, by @sideshowbarker.
-
Update examples to use current Extensions w3c/webauthn#1426, by @ve7jtb.
-
Add recovery extension w3c/webauthn#1425, by @emlun.
-
PRF extension. w3c/webauthn#1424, by @agl.
-
Use Python 3 in bikeshed Dockerfile w3c/webauthn#1423, by @emlun.
-
Specify more about COSE algorithms. w3c/webauthn#1420, by @agl.
-
Addressed IESG review comments w3c/webauthn#1419, by @selfissued.
-
Remove mentions of ECDAA. w3c/webauthn#1418, by @agl.
-
Mike's proposed changes for draft-hodges-webauthn-registries-08 w3c/webauthn#1417, by @selfissued.
-
Mike's proposed edits for draft-hodges-webauthn-registries-07 w3c/webauthn#1416, by @selfissued.
-
Mike's proposed edits for draft-hodges-webauthn-registries-06 w3c/webauthn#1415, by @selfissued.
-
Add "MDN Panels" to spec w3c/webauthn#1411, by @equalsJeffH.
-
-
10 pull requests merged.
-
Fix typo in update-bikeshed-cache.sh w3c/webauthn#1427.
-
Use Python 3 in bikeshed Dockerfile w3c/webauthn#1423.
-
Remove mentions of ECDAA. w3c/webauthn#1418.
-
Substitute enum types in dictionaries with DOMStrings w3c/webauthn#1392.
-
Addressed IESG review comments w3c/webauthn#1419.
-
Mike's proposed changes for draft-hodges-webauthn-registries-08 w3c/webauthn#1417.
-
Add getPublicKey method. w3c/webauthn#1395.
-
Mike's proposed edits for draft-hodges-webauthn-registries-07 w3c/webauthn#1416.
-
Mike's proposed edits for draft-hodges-webauthn-registries-06 w3c/webauthn#1415.
-
Add "MDN Panels" to spec w3c/webauthn#1411.
-
-
1 pull request reopened.
-
Add `largeBlob` extension. w3c/webauthn#1402, by @agl.
-
-
17 pull requests received 51 new comments.
-
Substitute enum types in dictionaries with DOMStrings w3c/webauthn#1392 (10 comments by @emlun, @equalsJeffH, @jcjones)
-
Mike's proposed edits for draft-hodges-webauthn-registries-06 w3c/webauthn#1415 (2 comments by @equalsJeffH, @gmandyam)
-
Add explanatory note to step 3 in authenticatorMakeCredential w3c/webauthn#1326 (2 comments by @emlun, @holycleugh)
-
Add registration/authentication extensions for cloud-assisted BLE w3c/webauthn#909 (1 comment by @zbot473)
-
Mike's proposed changes for draft-hodges-webauthn-registries-08 w3c/webauthn#1417 (1 comment by @equalsJeffH)
Participants
-
5 participants joined.
-
Arno Van Der Merwe (Entersekt) joined.
-
Erhard Brand (Entersekt) joined.
-
Tim Cappalli (Okta) joined.
-
Simon Rodway (Entersekt) joined.
-
Gerhard Oosthuizen (Entersekt) joined.
-
GitHub
w3c/webauthn
-
8 issues opened.
-
Remove ECDAA? w3c/webauthn#1410, by @bdewater.
-
add "non-discoverable credential" to terminology section... w3c/webauthn#1409, by @equalsJeffH.
-
Support for non-browser applications w3c/webauthn#1407, by @dolda2000.
-
update RP ID definition to allow URL syntax or arbitrary strings w3c/webauthn#1406, by @equalsJeffH.
-
Why does credentialId need to be unique across all users? w3c/webauthn#1403, by @epheat.
-
Example 4 in 1.3.3 uses txAuthSimple w3c/webauthn#1401, by @ve7jtb.
-
Fix IANA registry section for extensions. w3c/webauthn#1400, by @ve7jtb.
-
-
10 issues closed.
-
add notion of "enterprise" attestation w3c/webauthn#1147.
-
Support for non-browser applications w3c/webauthn#1407.
-
Fix IANA registry section for extensions. w3c/webauthn#1400.
-
Remove unimplemented extensions w3c/webauthn#1386.
-
Why does credentialId need to be unique across all users? w3c/webauthn#1403.
-
Prohibit Create Credential from cross-origin iframes w3c/webauthn#1336.
-
Signature counters exist in makeCredential too w3c/webauthn#1370.
-
-
13 issues received 35 new comments.
-
WebAuthn and Web Payments -- Transaction Confirmation, 3DS2, SRC, etc. w3c/webauthn#1396 (7 comments by @adrianhopebailie, @equalsJeffH, @rlin1)
-
Why does credentialId need to be unique across all users? w3c/webauthn#1403 (6 comments by @dwaite, @emlun, @epheat, @Kieun)
-
refine `publickey-credential` feature policy to have separate policies for Create and Get w3c/webauthn#1377 (3 comments by @equalsJeffH)
-
update RP ID definition to allow URL syntax or arbitrary strings w3c/webauthn#1406 (3 comments by @equalsJeffH, @selfissued)
-
Support for non-browser applications w3c/webauthn#1407 (3 comments by @jcjones, @nuno0529, @sbweeden)
-
WebAuthN error at: WebAuthNAuthenticatorMakeCredentialRemoteSessionCheck w3c/webauthn#1349 (2 comments by @koczkatamas, @unagori)
-
Provide the public key in `AuthenticatorAttestationResponse` w3c/webauthn#1363 (1 comment by @arianvp)
-
-
5 pull requests opened.
-
Fix IANA Registration w3c/webauthn#1408, by @ve7jtb.
-
Fix markup error in three headings. w3c/webauthn#1405, by @agl.
-
Add `largeBlob` extension. w3c/webauthn#1402, by @agl.
-
remove unimplemented extensions (was: Update index.bs) w3c/webauthn#1399, by @ve7jtb.
-
use '(client-side) discoverable credential' terminology w3c/webauthn#1398, by @equalsJeffH.
-
-
8 pull requests merged.
-
Add more requirements for ClientDataJSON serialisation. w3c/webauthn#1375.
-
Add “enterprise” attestation type. w3c/webauthn#1366.
-
use '(client-side) discoverable credential' terminology w3c/webauthn#1398.
-
Fix IANA Registration w3c/webauthn#1408.
-
remove unimplemented extensions (was: Update index.bs) w3c/webauthn#1399.
-
Fix markup error in three headings. w3c/webauthn#1405.
-
Prohibit Create Credential from cross-origin iframes w3c/webauthn#1394.
-
Update signature counters section. w3c/webauthn#1390.
-
-
10 pull requests received 102 new comments.
-
use '(client-side) discoverable credential' terminology w3c/webauthn#1398 (24 comments by @agl, @emlun, @equalsJeffH, @ve7jtb)
-
Add getPublicKey method. w3c/webauthn#1395 (23 comments by @agl, @emlun, @equalsJeffH, @jcjones, @lgarron)
-
Substitute enum types in dictionaries with DOMStrings w3c/webauthn#1392 (13 comments by @agl, @emlun, @equalsJeffH, @jcjones)
-
Add more requirements for ClientDataJSON serialisation. w3c/webauthn#1375 (9 comments by @agl, @dwaite, @equalsJeffH, @quartzjer)
-
Add “enterprise” attestation type. w3c/webauthn#1366 (8 comments by @agl, @akshayku, @equalsJeffH, @jcjones)
-
remove unimplemented extensions (was: Update index.bs) w3c/webauthn#1399 (6 comments by @agl, @equalsJeffH, @ve7jtb)
-
Participants
-
3 participants joined.
-
bill leddy (Visa) joined.
-
Paul Madsen (Hedera Hashgraph) joined.
-
Brett McDowell (Hedera Hashgraph) joined.
-
-
2 participants left.
-
Pasan Hapuarachchi (Visa) left.
-
Brett McDowell (W3C Invited Experts) left.
-
-
1 organization joined.
-
Hedera Hashgraph joined.
-
GitHub
w3c/webauthn
-
7 issues opened.
-
[=present=] throws link error w3c/webauthn#1397, by @equalsJeffH.
-
WebAuthn and Web Payments -- Transaction Confirmation, 3DS2, SRC, etc. w3c/webauthn#1396, by @js165.
-
Add direction to somewhere to ask for help to the contributing guidelines w3c/webauthn#1391, by @CrowdHailer.
-
More explicitly document use cases w3c/webauthn#1389, by @equalsJeffH.
-
Remove unimplemented extensions w3c/webauthn#1386, by @ve7jtb.
-
correct usage of userHandle? w3c/webauthn#1385, by @sachaw.
-
`credentials.create` should default to ES256 if `options.pubKeyCredParams` is empty w3c/webauthn#1383, by @nsatragno.
-
-
6 issues closed.
-
Upgrade Bikeshed to Python 3 w3c/webauthn#1367.
-
correct usage of userHandle? w3c/webauthn#1385.
-
Add direction to somewhere to ask for help to the contributing guidelines w3c/webauthn#1391.
-
way to return a platform specific Name for the thing that gets registered. w3c/webauthn#1304.
-
Clarity on transport hints w3c/webauthn#1368.
-
-
2 issues reopened.
-
WebAuthn and Web Payments -- Transaction Confirmation, 3DS2, SRC, etc. w3c/webauthn#1396, by @js165.
-
WebAuthn and Web Payments -- Transaction Confirmation, 3DS2, SRC, etc. w3c/webauthn#1396, by @js165.
-
-
14 issues received 36 new comments.
-
Remove unimplemented extensions w3c/webauthn#1386 (10 comments by @agl, @akshayku, @equalsJeffH, @nadalin, @rlin1, @selfissued, @ve7jtb)
-
correct usage of userHandle? w3c/webauthn#1385 (6 comments by @dwaite, @emlun, @equalsJeffH, @sachaw, @sbweeden)
-
Add direction to somewhere to ask for help to the contributing guidelines w3c/webauthn#1391 (3 comments by @arshadnoor, @CrowdHailer, @equalsJeffH)
-
refine `publickey-credential` feature policy to have separate policies for Create and Get w3c/webauthn#1377 (2 comments by @equalsJeffH, @nadalin)
-
Inputs to WebAuthn methods should not include strict Enum types w3c/webauthn#1376 (2 comments by @equalsJeffH)
-
BLE Resolvable Private Address resolution using IRK w3c/webauthn#1371 (2 comments by @ghost, @rjhallock6)
-
factor-in the notion of client-side discoverable cred and revise & deprecate the "resident cred" w3c/webauthn#1379 (1 comment by @nadalin)
-
`credentials.create` should default to ES256 if `options.pubKeyCredParams` is empty w3c/webauthn#1383 (1 comment by @nsatragno)
-
-
8 pull requests opened.
-
Add getPublicKey method. w3c/webauthn#1395, by @agl.
-
Prohibit Create Credential from cross-origin iframes w3c/webauthn#1394, by @jcjones.
-
Use Python 3.7 for Travis-CI w3c/webauthn#1393, by @jcjones.
-
Substitute enum types in dictionaries with DOMStrings w3c/webauthn#1392, by @jcjones.
-
Update signature counters section. w3c/webauthn#1390, by @agl.
-
Some suggested fixups to merge into the ep branch... w3c/webauthn#1388, by @equalsJeffH.
-
Default to ES256 and RS256 if pubKeyCredParams is empty w3c/webauthn#1387, by @nsatragno.
-
re-gen .html & .txt files from .xml file w3c/webauthn#1384, by @equalsJeffH.
-
-
5 pull requests merged.
-
Default to ES256 and RS256 if pubKeyCredParams is empty w3c/webauthn#1387.
-
Use Python 3.7 for Travis-CI w3c/webauthn#1393.
-
Add clearer recommendation on what to do with transport hints w3c/webauthn#1369.
-
re-gen .html & .txt files from .xml file w3c/webauthn#1384.
-
Proposed changes for draft-hodges-webauthn-registries-05 w3c/webauthn#1380.
-
-
1 pull request closed.
-
Some suggested fixups to merge into the ep branch... w3c/webauthn#1388.
-
-
10 pull requests received 50 new comments.
-
Add more requirements for ClientDataJSON serialisation. w3c/webauthn#1375 (12 comments by @agl, @equalsJeffH)
-
Default to ES256 and RS256 if pubKeyCredParams is empty w3c/webauthn#1387 (10 comments by @akshayku, @equalsJeffH, @nsatragno)
-
Substitute enum types in dictionaries with DOMStrings w3c/webauthn#1392 (8 comments by @agl, @jcjones)
-
Prohibit Create Credential from cross-origin iframes w3c/webauthn#1394 (6 comments by @agl, @jcjones, @kenrb, @ve7jtb)
-
Add clearer recommendation on what to do with transport hints w3c/webauthn#1369 (2 comments by @arshadnoor, @emlun)
-
Participants
-
1 participant joined.
-
Joel Hartshorn (USAA) joined.
-
-
1 organization joined.
-
USAA joined.
-
GitHub
w3c/webauthn
-
9 issues opened.
-
Addition of a network transport w3c/webauthn#1381, by @nickmooney.
-
Inputs to WebAuthn methods should not include strict Enum types w3c/webauthn#1376, by @jcjones.
-
inconsistent terminology: "array of" vs "sequence of" w3c/webauthn#1374, by @equalsJeffH.
-
Return authentication method used for platform types w3c/webauthn#1373, by @gcbenjamin.
-
Consider allowing cross-domain credential use w3c/webauthn#1372, by @sbweeden.
-
BLE Resolvable Private Address resolution using IRK w3c/webauthn#1371, by @rjhallock6.
-
Signature counters exist in makeCredential too w3c/webauthn#1370, by @agl.
-
-
9 issues closed.
-
Explicitly prohibit use of WebAuthn from non-visible cross-origin iframes w3c/webauthn#1303.
-
inconsistent terminology: "array of" vs "sequence of" w3c/webauthn#1374.
-
Return authentication method used for platform types w3c/webauthn#1373.
-
BLE Resolvable Private Address resolution using IRK w3c/webauthn#1371.
-
15 issues received 46 new comments.
-
Return authentication method used for platform types w3c/webauthn#1373 (9 comments by @dwaite, @equalsJeffH, @gcbenjamin, @Kieun, @sbweeden)
-
Clarify how a user can authenticate from multiple devices w3c/webauthn#151 (8 comments by @arshadnoor, @emlun, @mamartins, @Oloompa)
-
Consider allowing cross-domain credential use w3c/webauthn#1372 (6 comments by @emlun, @equalsJeffH, @jcjones, @kreichgauer, @sbweeden)
-
Could not use Webauthn `PublicKeyCredential.create` when the RP ID is a Host string(ip). w3c/webauthn#1358 (5 comments by @equalsJeffH, @jcjones)
-
Prohibit Create Credential from cross-origin iframes w3c/webauthn#1336 (3 comments by @equalsJeffH, @jcjones)
-
way to return a platform specific Name for the thing that gets registered. w3c/webauthn#1304 (3 comments by @arshadnoor, @equalsJeffH)
-
Considerations on using WebAuthn in cross-origin iframes and Storage Access API w3c/webauthn#1347 (2 comments by @equalsJeffH, @rmondello)
-
Supply an “intention" member in PublicKeyCredentialCreationOptions dictionary w3c/webauthn#1292 (2 comments by @alanwaketan, @rmondello)
-
BLE Resolvable Private Address resolution using IRK w3c/webauthn#1371 (2 comments by @agl, @rjhallock6)
-
Provide the public key in `AuthenticatorAttestationResponse` w3c/webauthn#1363 (1 comment by @nadalin)
-
Explicitly prohibit use of WebAuthn from non-visible cross-origin iframes w3c/webauthn#1303 (1 comment by @equalsJeffH)
-
-
3 pull requests opened.
-
Proposed changes for draft-hodges-webauthn-registries-05 w3c/webauthn#1380, by @selfissued.
-
draft-hodges-webauthn-registries-04 w3c/webauthn#1378, by @selfissued.
-
Add more requirements for ClientDataJSON serialisation. w3c/webauthn#1375, by @agl.
-
-
3 pull requests merged.
-
draft-hodges-webauthn-registries-04 w3c/webauthn#1378.
-
-
2 pull requests closed.
-
WIP: revise webauthn registries internet-draft per reviews w3c/webauthn#1343.
-
Add registration/authentication extensions for cloud-assisted BLE w3c/webauthn#909.
-
-
7 pull requests received 24 new comments.
-
Add more requirements for ClientDataJSON serialisation. w3c/webauthn#1375 (14 comments by @emlun, @equalsJeffH)
-
Add clearer recommendation on what to do with transport hints w3c/webauthn#1369 (2 comments by @emlun, @equalsJeffH)
-
WIP: revise webauthn registries internet-draft per reviews w3c/webauthn#1343 (1 comment by @selfissued)
-
Add registration/authentication extensions for cloud-assisted BLE w3c/webauthn#909 (1 comment by @equalsJeffH)
-
Remove the requirement accept and store a 64-byte minimum length for a name member’s value w3c/webauthn#1354 (1 comment by @ve7jtb)
-
Add to sec cons a brief discussion of the sec properties accrued by authnr & client platform proximity w3c/webauthn#1333 (1 comment by @equalsJeffH)
-
Participants
-
1 organization joined.
-
Entersekt joined.
-
GitHub
w3c/webauthn
-
7 issues opened.
-
Clarity on transport hints w3c/webauthn#1368, by @agl.
-
Upgrade Bikeshed to Python 3 w3c/webauthn#1367, by @emlun.
-
Provide the public key in `AuthenticatorAttestationResponse` w3c/webauthn#1363, by @agl.
-
Use of CBOR, and Uint8Array/ArrayBuffer w3c/webauthn#1362, by @craigfrancis.
-
link to latest CTAP spec w3c/webauthn#1360, by @equalsJeffH.
-
Dependence on Browser state for Primary Factor login w3c/webauthn#1356, by @ChadKillingsworth.
-
-
12 issues closed.
-
link to latest CTAP spec w3c/webauthn#1360.
-
Removing “lightning” from AuthenticatorTransport w3c/webauthn#1294.
-
Conflict between WebAuthn and CTAP2 handling of userVerification mapping w3c/webauthn#1306.
-
Use of CBOR, and Uint8Array/ArrayBuffer w3c/webauthn#1362.
-
Dependence on Browser state for Primary Factor login w3c/webauthn#1356.
-
Add a capability to the WebAuthn WebDriver extension w3c/webauthn#1351.
-
Underspecified client output in `exts` extension w3c/webauthn#1314.
-
Ignore transport hints in excludeCredentials? w3c/webauthn#1348.
-
How to get supported client extension w3c/webauthn#1199.
-
Clarify 127.0.0.1 in spec w3c/webauthn#1204.
-
23 issues received 84 new comments.
-
Provide the public key in `AuthenticatorAttestationResponse` w3c/webauthn#1363 (14 comments by @craigfrancis, @emlun, @equalsJeffH, @grzuy)
-
Removing “lightning” from AuthenticatorTransport w3c/webauthn#1294 (14 comments by @agl, @alanwaketan, @christiaanbrand, @dwaite, @equalsJeffH, @nadalin, @othermaciej, @ve7jtb)
-
Dependence on Browser state for Primary Factor login w3c/webauthn#1356 (11 comments by @agl, @ChadKillingsworth, @kreichgauer, @nadalin)
-
Use of CBOR, and Uint8Array/ArrayBuffer w3c/webauthn#1362 (8 comments by @agl, @craigfrancis, @dwaite, @emlun)
-
exclude/allowCredentials state different defaults in definition vs description w3c/webauthn#1346 (7 comments by @emlun, @equalsJeffH)
-
Could not use Webauthn `PublicKeyCredential.create` when the RP ID is a Host string(ip). w3c/webauthn#1358 (6 comments by @emlun, @equalsJeffH, @jcjones, @nadalin, @slayercat)
-
Conflict between WebAuthn and CTAP2 handling of userVerification mapping w3c/webauthn#1306 (2 comments by @fmeum, @ve7jtb)
-
Considerations on using WebAuthn in cross-origin iframes and Storage Access API w3c/webauthn#1347 (2 comments by @agl, @alanwaketan)
-
Clarify how a user can authenticate from multiple devices w3c/webauthn#151 (2 comments by @emlun, @Oloompa)
-
way to return a platform specific Name for the thing that gets registered. w3c/webauthn#1304 (1 comment by @equalsJeffH)
-
Supply an “intention" member in PublicKeyCredentialCreationOptions dictionary w3c/webauthn#1292 (1 comment by @equalsJeffH)
-
Explicitly prohibit use of WebAuthn from non-visible cross-origin iframes w3c/webauthn#1303 (1 comment by @jcjones)
-
Add explicit description on what should be done in incognito/private browsing mode w3c/webauthn#1174 (1 comment by @akshayku)
-
-
7 pull requests opened.
-
Add clearer recommendation on what to do with transport hints w3c/webauthn#1369, by @emlun.
-
Add “enterprise” attestation type. w3c/webauthn#1366, by @agl.
-
remove 'lightning' AuthenticatorTransport enum value w3c/webauthn#1364, by @equalsJeffH.
-
Clarify exts client extension output w3c/webauthn#1361, by @emlun.
-
Add note about risk of ignoring excludeCredentials with mismatched transports w3c/webauthn#1359, by @emlun.
-
-
6 pull requests merged.
-
remove 'lightning' AuthenticatorTransport enum value w3c/webauthn#1364.
-
Add a WebDriver Extension Capability w3c/webauthn#1353.
-
Clarify exts client extension output w3c/webauthn#1361.
-
Fix typo w3c/webauthn#1357.
-
4 pull requests received 10 new comments.
-
Add to sec cons a brief discussion of the sec properties accrued by authnr & client platform proximity w3c/webauthn#1333 (2 comments by @agl, @emlun)
-
Remove the requirement accept and store a 64-byte minimum length for a name member’s value w3c/webauthn#1354 (2 comments by @agl, @equalsJeffH)
-
Add registration/authentication extensions for cloud-assisted BLE w3c/webauthn#909 (1 comment by @equalsJeffH)