Web Authentication Working Group - Activity in 2021
No matches.
Lifecycle
-
1 charter extension.
-
Charter extended until 31 March 2022.
-
Past meetings
Participants
-
1 participant left.
-
Kepeng Li (Alibaba Group) left.
-
GitHub
w3c/webauthn
-
3 issues opened.
-
Incorrect "to create" phrase used in get() section's introduction? w3c/webauthn#1687, by @equalsJeffH.
-
finish removing "create credential" permissions policy cruft w3c/webauthn#1685, by @equalsJeffH.
-
3 issues closed.
-
finish removing "create credential" permissions policy cruft w3c/webauthn#1685.
-
Cross origin and Conditional UI w3c/webauthn#1671.
-
6 issues received 23 new comments.
-
Cross origin authentication without iframes (accommodating SPC in WebAuthn) w3c/webauthn#1667 (11 comments by @akshayku, @equalsJeffH, @ianbjacobs, @stephenmcgruer, @ve7jtb)
-
Should an RP be able to provide finer grained authenticator filtering in attestation options? w3c/webauthn#1688 (6 comments by @sbweeden, @timcappalli, @ve7jtb)
-
Provide request deserialization, response serialization w3c/webauthn#1683 (3 comments by @dwaite, @kreichgauer, @timcappalli)
-
-
1 pull request opened.
-
remove extraneous "create credential" permissions policy cruft w3c/webauthn#1686, by @equalsJeffH.
-
-
3 pull requests merged.
-
Clarify, simplify and align parameter descriptions w3c/webauthn#1621.
-
Tighten requirements for rejecting duplicate credential IDs. w3c/webauthn#1680.
-
remove extraneous "create credential" permissions policy cruft w3c/webauthn#1686.
-
-
1 pull request closed.
-
Ask for tests for normative changes in CONTRIBUTING.md w3c/webauthn#653.
-
-
3 pull requests received 11 new comments.
-
non-modal "conditionally mediated" UI w3c/webauthn#1576 (7 comments by @emlun, @equalsJeffH, @nsatragno)
-
Past meetings
-
2 meetings.
Participants
-
1 participant joined.
-
Tara Whalen (Cloudflare) joined.
-
-
2 participants left.
-
Alexei Czeskis (Google LLC) left.
-
ELENI LIALIAMOU (Wiley) left.
-
-
1 organization joined.
-
Cloudflare joined.
-
GitHub
w3c/webauthn
-
3 issues opened.
-
Provide request deserialization, response serialization w3c/webauthn#1683, by @dwaite.
-
Fix the "aborted flag" reference w3c/webauthn#1682, by @nsatragno.
-
caBLE for Payments w3c/webauthn#1681, by @cyberphone.
-
-
4 issues closed.
-
Confusion on COSEAlgorithmIdentifier standards w3c/webauthn#1676.
-
Update URL to FIDO registry w3c/webauthn#1657.
-
Accessibility of WebAuthN Dialogs w3c/webauthn#1672.
-
Breaking change in Chrome 95/W10 w3c/webauthn#1677.
-
-
1 issue reopened.
-
13 issues received 44 new comments.
-
Cross origin authentication without iframes (accommodating SPC in WebAuthn) w3c/webauthn#1667 (14 comments by @akshayku, @christiaanbrand, @cyberphone, @emlun, @equalsJeffH, @Goosth, @ianbjacobs, @stephenmcgruer, @timcappalli, @ve7jtb)
-
Provide request deserialization, response serialization w3c/webauthn#1683 (8 comments by @dwaite, @emlun, @kreichgauer, @MasterKale)
-
Add a way to use webauthn without Javascript w3c/webauthn#1255 (3 comments by @ddevault, @dwaite, @Firstyear)
-
Mechanism for encoding *direction* metadata may need more work w3c/webauthn#1644 (2 comments by @agl, @aphillips)
-
Q: Regarding Security Concerns Surrounding WebAuthn: Don't Implement ECDAA (Yet) w3c/webauthn#1196 (1 comment by @equalsJeffH)
-
-
1 pull request opened.
-
Tighten requirements for rejecting duplicate credential IDs. w3c/webauthn#1680, by @agl.
-
-
2 pull requests merged.
-
Additional polish for PR #1621 w3c/webauthn#1674.
-
Update FIDO-Registry link w3c/webauthn#1675.
-
-
5 pull requests received 78 new comments.
-
non-modal "conditionally mediated" UI w3c/webauthn#1576 (50 comments by @emlun, @equalsJeffH, @nsatragno)
-
device public key extension w3c/webauthn#1663 (14 comments by @agl, @akshayku, @equalsJeffH, @pascoej, @sbweeden)
-
Tighten requirements for rejecting duplicate credential IDs. w3c/webauthn#1680 (7 comments by @agl, @emlun, @equalsJeffH, @lgarron)
-
Clarify, simplify and align parameter descriptions w3c/webauthn#1621 (4 comments by @emlun, @equalsJeffH)
-
Past meetings
-
2 meetings.
Participants
-
2 participants joined.
-
ㅤ Pascoe (Apple Inc.) joined.
-
Julien Rossi (CANTON CONSULTING) joined.
-
-
2 participants left.
-
Jiewen Tan (Apple Inc.) left.
-
Casey Piper (Google LLC) left.
-
GitHub
w3c/webauthn
-
6 issues opened.
-
Breaking change in Chrome 95/W10 w3c/webauthn#1677, by @cyberphone.
-
Confusion on COSEAlgorithmIdentifier standards w3c/webauthn#1676, by @wagner-robert.
-
Which extensions (if any) are supported by platform authenticators? w3c/webauthn#1673, by @ghost.
-
Accessibility of WebAuthN Dialogs w3c/webauthn#1672, by @yao-ding.
-
3 issues closed.
-
Which extensions (if any) are supported by platform authenticators? w3c/webauthn#1673.
-
Authenticator Attachment in Public Key Credential w3c/webauthn#1666.
-
-
8 issues received 22 new comments.
-
Which extensions (if any) are supported by platform authenticators? w3c/webauthn#1673 (5 comments by @emlun, @ghost, @timcappalli, @utliluom33)
-
Cross origin authentication without iframes (accommodating SPC in WebAuthn) w3c/webauthn#1667 (1 comment by @ianbjacobs)
-
2 pull requests opened.
-
Update FIDO-Registry link w3c/webauthn#1675, by @emlun.
-
Additional polish for PR #1621 w3c/webauthn#1674, by @emlun.
-
-
2 pull requests merged.
-
Add authenticator attachment used during authentication to assertion payload w3c/webauthn#1668.
-
Define 1023 bytes to be the maximum credential ID length. w3c/webauthn#1664.
-
-
1 pull request closed.
-
Describe how to determine authenticator attachment from transports w3c/webauthn#1670.
-
-
6 pull requests received 60 new comments.
-
non-modal "conditionally mediated" UI w3c/webauthn#1576 (22 comments by @emlun, @equalsJeffH, @lgarron, @MasterKale, @nsatragno)
-
Add authenticator attachment used during authentication to assertion payload w3c/webauthn#1668 (20 comments by @emlun, @equalsJeffH, @nsatragno, @z11h)
-
Clarify, simplify and align parameter descriptions w3c/webauthn#1621 (11 comments by @emlun, @equalsJeffH)
-
Describe how to determine authenticator attachment from transports w3c/webauthn#1670 (4 comments by @emlun)
-
Define 1023 bytes to be the maximum credential ID length. w3c/webauthn#1664 (1 comment by @equalsJeffH)
-
Past meetings
-
2 meetings.
GitHub
w3c/webauthn
-
1 issue opened.
-
Cross origin and Conditional UI w3c/webauthn#1671, by @akshayku.
-
-
3 issues closed.
-
Managing FIDO keys w3c/webauthn#1612.
-
Choosing An Attestation Statement Format? w3c/webauthn#1659.
-
-
7 issues received 18 new comments.
-
Cross origin authentication without iframes (accommodating SPC in WebAuthn) w3c/webauthn#1667 (10 comments by @adrianhopebailie, @cyberphone, @stephenmcgruer)
-
webauthn - API need to know the registration status of an platform authenticator w3c/webauthn#1639 (2 comments by @equalsJeffH)
-
-
3 pull requests opened.
-
Describe how to determine authenticator attachment from transports w3c/webauthn#1670, by @emlun.
-
Address review comments by @sbweeden w3c/webauthn#1669, by @emlun.
-
Add authenticator attachment used during authentication to assertion payload w3c/webauthn#1668, by @z11h.
-
-
2 pull requests merged.
-
Address review comments by @sbweeden w3c/webauthn#1669.
-
Explicitly state that RPs cannot in general choose attestation type/format w3c/webauthn#1660.
-
-
6 pull requests received 101 new comments.
-
Add authenticator attachment used during authentication to assertion payload w3c/webauthn#1668 (43 comments by @agl, @emlun, @equalsJeffH, @Firstyear, @MasterKale, @nsatragno, @sbweeden, @timcappalli, @ve7jtb, @z11h)
-
Clarify, simplify and align parameter descriptions w3c/webauthn#1621 (35 comments by @emlun, @equalsJeffH, @sbweeden)
-
Define 1023 bytes to be the maximum credential ID length. w3c/webauthn#1664 (16 comments by @agl, @emlun, @equalsJeffH, @lgarron, @MasterKale, @selfissued)
-
Describe how to determine authenticator attachment from transports w3c/webauthn#1670 (5 comments by @equalsJeffH, @sbweeden)
-
Explicitly state that RPs cannot in general choose attestation type/format w3c/webauthn#1660 (1 comment by @emlun)
-
Past meetings
-
2 meetings.
GitHub
w3c/webauthn
-
7 issues opened.
-
Cross origin authentication without iframes (accommodating SPC in WebAuthn) w3c/webauthn#1667, by @akshayku.
-
Authenticator Attachment in Public Key Credential w3c/webauthn#1666, by @z11h.
-
Synced/multi-device user Credentials w3c/webauthn#1665, by @equalsJeffH.
-
Confused About What To Do With Attestation Trust Paths w3c/webauthn#1662, by @DanielSanchezDiaz.
-
Choosing An Attestation Statement Format? w3c/webauthn#1659, by @DanielSanchezDiaz.
-
Device-bound key extension w3c/webauthn#1658, by @agl.
-
Update URL to FIDO registry w3c/webauthn#1657, by @emlun.
-
-
4 issues closed.
-
Remove tokenBinding integration w3c/webauthn#1627.
-
Confused About What To Do With Attestation Trust Paths w3c/webauthn#1662.
-
BigNumber serialization is not mentioned w3c/webauthn#1647.
-
Support for authenticators providing more than one key w3c/webauthn#1546.
-
-
13 issues received 88 new comments.
-
Cross-origin credential creation in iframes w3c/webauthn#1656 (24 comments by @arshadnoor, @cyberphone, @emlun, @FlxMgdnz, @jcemer-stripe, @ncthbrt, @rsolomakhin)
-
Device-bound key extension w3c/webauthn#1658 (20 comments by @agl, @akshayku, @dwaite, @emlun, @equalsJeffH, @timcappalli)
-
Cross origin authentication without iframes (accommodating SPC in WebAuthn) w3c/webauthn#1667 (15 comments by @akshayku, @christiaanbrand, @cyberphone, @emlun, @sbweeden, @stephenmcgruer, @ve7jtb)
-
Clarify how a user can authenticate from multiple devices w3c/webauthn#151 (10 comments by @agl, @arshadnoor, @emlun, @Firstyear, @knightcode)
-
Why does WebAuthn require a challenge when asking the client to register a new credential? w3c/webauthn#1355 (5 comments by @emlun, @Firstyear, @marekciupak)
-
Confused About What To Do With Attestation Trust Paths w3c/webauthn#1662 (4 comments by @arshadnoor, @cyberphone, @sbweeden)
-
Choosing An Attestation Statement Format? w3c/webauthn#1659 (3 comments by @arshadnoor, @DanielSanchezDiaz, @sbweeden)
-
Prohibit Create Credential from cross-origin iframes w3c/webauthn#1336 (2 comments by @emlun, @ncthbrt)
-
-
4 pull requests opened.
-
Define 1023 bytes to be the maximum credential ID length. w3c/webauthn#1664, by @agl.
-
device public key extension w3c/webauthn#1663, by @equalsJeffH.
-
Fix tokenBinding definition type w3c/webauthn#1661, by @emlun.
-
Explicitly state that RPs cannot in general choose attestation type/format w3c/webauthn#1660, by @emlun.
-
-
3 pull requests merged.
-
Note that largeBlob requires discoverable key on CTAP authenticators w3c/webauthn#1622.
-
Fix tokenBinding definition type w3c/webauthn#1661.
-
Define "user account" w3c/webauthn#1649.
-
-
6 pull requests received 45 new comments.
-
Clarify, simplify and align parameter descriptions w3c/webauthn#1621 (22 comments by @emlun, @equalsJeffH)
-
Explicitly state that RPs cannot in general choose attestation type/format w3c/webauthn#1660 (1 comment by @emlun)
-
Note that largeBlob requires discoverable key on CTAP authenticators w3c/webauthn#1622 (1 comment by @equalsJeffH)
-
Past meetings
-
2 meetings.
Participants
-
3 participants joined.
-
Manish Garg (VE3) joined.
-
werner bruinings (American Express Company) joined.
-
Sophie Rainford (American Express Company) joined.
-
-
1 participant left.
-
Andy Watson (Fiserv) left.
-
-
2 organizations joined.
-
VE3 joined.
-
American Express Company joined.
-
-
1 organization left.
-
Fiserv left.
-
GitHub
w3c/webauthn
-
17 issues opened.
-
Cross-origin credential creation in iframes w3c/webauthn#1656, by @agl.
-
Kike7laguna@gmail.com w3c/webauthn#1653, by @KikeE36.
-
Enterprise Attestation Conveyance Preference w3c/webauthn#1652, by @arshadnoor.
-
2021 recharter w3c/webauthn#1651, by @wseltzer.
-
denote crossOrigin in client data as OPTIONAL w3c/webauthn#1650, by @equalsJeffH.
-
Eliminate duplicate terminology w3c/webauthn#1648, by @emlun.
-
BigNumber serialization is not mentioned w3c/webauthn#1647, by @cyberphone.
-
Trailing position of metadata w3c/webauthn#1646, by @aphillips.
-
[Editorial] Truncation description inaccurate w3c/webauthn#1645, by @aphillips.
-
Mechanism for encoding *direction* metadata may need more work w3c/webauthn#1644, by @aphillips.
-
Use of in-field metadata not preferred w3c/webauthn#1643, by @aphillips.
-
Unicode "tag" characters are deprecated for language tagging w3c/webauthn#1642, by @aphillips.
-
U+ notation incorrect w3c/webauthn#1641, by @aphillips.
-
Syncing Platform Keys, Recoverability and Security levels w3c/webauthn#1640, by @akshayku.
-
webauthn - API need to know the registration status of an platform authenticator w3c/webauthn#1639, by @mkkhedawat.
-
Unwanted Browser Dependencies w3c/webauthn#1638, by @cyberphone.
-
Possible experiences in a future WebAuthn w3c/webauthn#1637, by @agl.
-
-
6 issues closed.
-
Inconsistent RP directions for handling credential transports w3c/webauthn#1587.
-
Unwanted Browser Dependencies w3c/webauthn#1638.
-
Enterprise Attestation Conveyance Preference w3c/webauthn#1652.
-
denote crossOrigin in client data as OPTIONAL w3c/webauthn#1650.
-
2021 recharter w3c/webauthn#1651.
-
-
1 issue reopened.
-
kike7laguna w3c/webauthn#1634, by @KikeE36.
-
-
23 issues received 94 new comments.
-
Cross-origin credential creation in iframes w3c/webauthn#1656 (16 comments by @agl, @akshayku, @arshadnoor, @cyberphone, @Firstyear, @ve7jtb)
-
Syncing Platform Keys, Recoverability and Security levels w3c/webauthn#1640 (12 comments by @akshayku, @arshadnoor, @cyberphone, @dwaite, @emlun, @ghost, @Kieun, @rlin1, @rmondello)
-
Eliminate duplicate terminology w3c/webauthn#1648 (8 comments by @arshadnoor, @dwaite, @emlun, @equalsJeffH)
-
Support `discoverableCredential` field in the API. w3c/webauthn#1565 (7 comments by @arshadnoor, @bathos, @cyberphone, @emlun, @equalsJeffH)
-
webauthn - API need to know the registration status of an platform authenticator w3c/webauthn#1639 (7 comments by @agl, @mkkhedawat)
-
Enterprise Attestation Conveyance Preference w3c/webauthn#1652 (6 comments by @agl, @arshadnoor, @dwaite)
-
Remove unimplemented extensions w3c/webauthn#1386 (6 comments by @arshadnoor, @dwaite, @emlun, @jpstotz)
-
Unwanted Browser Dependencies w3c/webauthn#1638 (5 comments by @agl, @akshayku, @cyberphone, @dwaite, @MasterKale)
-
Requesting properties of created credentials. w3c/webauthn#1449 (5 comments by @arshadnoor, @cyberphone, @equalsJeffH, @ve7jtb)
-
Possible experiences in a future WebAuthn w3c/webauthn#1637 (3 comments by @agl, @akshayku, @cyberphone)
-
Firefox generates credentials using TPM with Windows Hello - but does not send TPM attestation w3c/webauthn#1620 (1 comment by @akshayku)
-
Mechanism for encoding *direction* metadata may need more work w3c/webauthn#1644 (1 comment by @agl)
-
Support for authenticators providing more than one key w3c/webauthn#1546 (1 comment by @equalsJeffH)
-
Support a "create or get [or replace]" credential re-association operation w3c/webauthn#1568 (1 comment by @equalsJeffH)
-
Surface platform authenticator status in the `create` (and maybe `get`) response / help RPs track UV/PA/RK w3c/webauthn#1567 (1 comment by @equalsJeffH)
-
double check whether the Secure Payment Confirmation effort has implications on the WebAuthn spec w3c/webauthn#1492 (1 comment by @cyberphone)
-
-
4 pull requests opened.
-
Denote crossOrigin in client data as OPTIONAL w3c/webauthn#1655, by @emlun.
-
Fix inconsistency in RP directions for credential transports w3c/webauthn#1654, by @emlun.
-
Define "user account" w3c/webauthn#1649, by @emlun.
-
Remove trailing whitespace throughout w3c/webauthn#1636, by @equalsJeffH.
-
-
4 pull requests merged.
-
Fix inconsistency in RP directions for credential transports w3c/webauthn#1654.
-
Denote crossOrigin in client data as OPTIONAL w3c/webauthn#1655.
-
Remove TokenBinding w3c/webauthn#1630.
-
Remove trailing whitespace throughout w3c/webauthn#1636.
-
-
4 pull requests received 54 new comments.
-
Clarify, simplify and align parameter descriptions w3c/webauthn#1621 (41 comments by @emlun, @equalsJeffH, @sbweeden)
-
Note that largeBlob requires discoverable key on CTAP authenticators w3c/webauthn#1622 (2 comments by @emlun)
-
Past meetings
Participants
-
4 participants left.
-
Alex Russell (Google LLC) left.
-
Brett McDowell (Hedera Hashgraph) left.
-
Paul Madsen (Hedera Hashgraph) left.
-
Susan Pandy (Federal Reserve Bank of Minneapolis) left.
-
-
1 organization left.
-
Hedera Hashgraph left.
-
GitHub
w3c/webauthn
-
10 issues opened.
-
reference CTAP2.1 PS spec and fix broken link w3c/webauthn#1635, by @equalsJeffH.
-
kike7laguna w3c/webauthn#1634, by @KikeE36.
-
Missing Test Vectors w3c/webauthn#1633, by @cyberphone.
-
CollectedClientData.crossOrigin default value and whether it is required w3c/webauthn#1631, by @equalsJeffH.
-
Remove tokenBinding integration w3c/webauthn#1627, by @agl.
-
Update README with new Bikeshed build instructions w3c/webauthn#1626, by @emlun.
-
Dependencies on CTAP2 canonical CBOR encoding form? w3c/webauthn#1624, by @cyberphone.
-
How do I handle these unexpected U2F values for `tokenBinding`? w3c/webauthn#1623, by @MasterKale.
-
Base64 of fields to simplify javascript/json behaviour w3c/webauthn#1619, by @Firstyear.
-
-
10 issues closed.
-
Base64 of fields to simplify javascript/json behaviour w3c/webauthn#1619.
-
How do I handle these unexpected U2F values for `tokenBinding`? w3c/webauthn#1623.
-
Dependencies on CTAP2 canonical CBOR encoding form? w3c/webauthn#1624.
-
Update README with new Bikeshed build instructions w3c/webauthn#1626.
-
WebAuthn and Web Payments -- Transaction Confirmation, 3DS2, SRC, etc. w3c/webauthn#1396.
-
Decoding attestationObject w3c/webauthn#1614.
-
-
17 issues received 63 new comments.
-
Decoding attestationObject w3c/webauthn#1614 (12 comments by @agl, @cyberphone, @emlun, @yackermann)
-
Requesting properties of created credentials. w3c/webauthn#1449 (8 comments by @eldanb, @emlun, @Firstyear, @sbweeden)
-
Identify which items in creation and assertion options are client UI/UX hints w3c/webauthn#1618 (8 comments by @emlun, @equalsJeffH, @Firstyear)
-
Dependencies on CTAP2 canonical CBOR encoding form? w3c/webauthn#1624 (7 comments by @cyberphone, @dwaite, @equalsJeffH)
-
Support WWW-Authenticate (for one request. can be upgraded to cookies if necessary.) w3c/webauthn#1616 (4 comments by @equalsJeffH, @ignaloidas, @SoniEx2)
-
Base64 of fields to simplify javascript/json behaviour w3c/webauthn#1619 (3 comments by @emlun, @MasterKale)
-
How do I handle these unexpected U2F values for `tokenBinding`? w3c/webauthn#1623 (3 comments by @equalsJeffH, @nicksteele, @selfissued)
-
Support a "create or get [or replace]" credential re-association operation w3c/webauthn#1568 (3 comments by @eldanb, @emlun)
-
Update README with new Bikeshed build instructions w3c/webauthn#1626 (3 comments by @emlun, @sideshowbarker)
-
need "how to install bikeshed in one's local webauthn repo clone" instructions w3c/webauthn#1477 (2 comments by @equalsJeffH, @sideshowbarker)
-
PublicKeyCredentialParameters can't select curve (E.g. ed448) w3c/webauthn#1446 (2 comments by @cyberphone)
-
further explain, for RPs, lack of stipulation of maximum Credential ID length w3c/webauthn#1617 (2 comments by @equalsJeffH, @sbweeden)
-
Firefox generates credentials using TPM with Windows Hello - but does not send TPM attestation w3c/webauthn#1620 (1 comment by @dveditz)
-
WebAuthn and Web Payments -- Transaction Confirmation, 3DS2, SRC, etc. w3c/webauthn#1396 (1 comment by @equalsJeffH)
-
-
6 pull requests opened.
-
Remove TokenBinding w3c/webauthn#1630, by @nicksteele.
-
Remove no-longer-needed .deploy-output.sh script w3c/webauthn#1629, by @sideshowbarker.
-
Update build & (auto)publishing info in README.md w3c/webauthn#1628, by @sideshowbarker.
-
CI: Drop Travis; switch to GitHub Actions with w3c/spec-prod w3c/webauthn#1625, by @sideshowbarker.
-
Note that largeBlob requires discoverable key on CTAP authenticators w3c/webauthn#1622, by @emlun.
-
Clarify, simplify and align parameter descriptions w3c/webauthn#1621, by @emlun.
-
-
4 pull requests merged.
-
Remove no-longer-needed .deploy-output.sh script w3c/webauthn#1629.
-
Update build & (auto)publishing info in README.md w3c/webauthn#1628.
-
CI: Drop Travis; switch to GitHub Actions with w3c/spec-prod w3c/webauthn#1625.
-
mmiller-improve-terminology w3c/webauthn#1615.
-
-
1 pull request closed.
-
Switch h2#subtitle to h2#profile-and-date w3c/webauthn#1602.
-
-
1 pull request reopened.
-
CI: Drop Travis; switch to GitHub Actions with w3c/spec-prod w3c/webauthn#1625, by @sideshowbarker.
-
-
8 pull requests received 50 new comments.
-
Clarify, simplify and align parameter descriptions w3c/webauthn#1621 (26 comments by @emlun, @equalsJeffH, @Firstyear, @sbweeden)
-
Note that largeBlob requires discoverable key on CTAP authenticators w3c/webauthn#1622 (8 comments by @agl, @emlun, @equalsJeffH)
-
CI: Drop Travis; switch to GitHub Actions with w3c/spec-prod w3c/webauthn#1625 (5 comments by @equalsJeffH, @MasterKale, @plehegar, @w3cbot)
-
mmiller-improve-terminology w3c/webauthn#1615 (5 comments by @emlun, @equalsJeffH, @MasterKale, @selfissued)
-
Update build & (auto)publishing info in README.md w3c/webauthn#1628 (2 comments by @equalsJeffH, @w3cbot)
-
Switch h2#subtitle to h2#profile-and-date w3c/webauthn#1602 (2 comments by @equalsJeffH, @sideshowbarker)
-
Past meetings
-
2 meetings.
Participants
-
1 participant joined.
-
Ranjiva Prasad (Visa) joined.
-
-
5 participants left.
-
Jeffrey Yasskin (Google LLC) left.
-
Tom Lowenthal (Brave Software Inc.) left.
-
Gavin Shenker (Visa) left.
-
Arvind Santhanaraman (Visa) left.
-
bill leddy (Visa) left.
-
GitHub
w3c/webauthn
-
8 issues opened.
-
Identify which items in creation and assertion options are client UI/UX hints w3c/webauthn#1618, by @Firstyear.
-
further explain, for RPs, lack of stipulation of maximum Credential ID length w3c/webauthn#1617, by @equalsJeffH.
-
Support WWW-Authenticate (for one request. can be upgraded to cookies if necessary.) w3c/webauthn#1616, by @SoniEx2.
-
Decoding attestationObject w3c/webauthn#1614, by @cyberphone.
-
Is there a way to store metadata in the authenticator with/without an extension? w3c/webauthn#1613, by @ghost.
-
Managing FIDO keys w3c/webauthn#1612, by @cyberphone.
-
Support for raw cryptographic signatures w3c/webauthn#1611, by @cybercent.
-
-
8 issues closed.
-
Support for raw cryptographic signatures w3c/webauthn#1611.
-
Can the private keys be used for other cryptographic operations? w3c/webauthn#1595.
-
<new proposal> Extending WebAuthn Protocol for Remote Authentication w3c/webauthn#1580.
-
Multiple Authenticator Options and Policies w3c/webauthn#1601.
-
Multiple Credentials in a single Enrollment w3c/webauthn#1603.
-
update Figure 6 to remove mention of ECDAA w3c/webauthn#1606.
-
-
1 issue reopened.
-
Requiring user activation to call WebAuthn API w3c/webauthn#1293, by @equalsJeffH.
-
-
12 issues received 59 new comments.
-
Managing FIDO keys w3c/webauthn#1612 (20 comments by @cyberphone, @emlun, @Firstyear, @haxelion, @Kieun, @MasterKale)
-
PROPOSAL: Add support for general (hardware backed) cryptographic signatures and key exchange w3c/webauthn#1608 (12 comments by @akshayku, @cybercent, @equalsJeffH, @Firstyear, @ghost)
-
Can the private keys be used for other cryptographic operations? w3c/webauthn#1595 (10 comments by @akshayku, @cybercent, @emlun, @equalsJeffH, @Firstyear, @ghost)
-
Support WWW-Authenticate (for one request. can be upgraded to cookies if necessary.) w3c/webauthn#1616 (4 comments by @emlun, @SoniEx2)
-
Requiring user activation to call WebAuthn API w3c/webauthn#1293 (3 comments by @dwaite, @equalsJeffH, @ve7jtb)
-
Support for raw cryptographic signatures w3c/webauthn#1611 (3 comments by @dwaite, @ghost, @selfissued)
-
Is there a way to store metadata in the authenticator with/without an extension? w3c/webauthn#1613 (1 comment by @agl)
-
need "how to install bikeshed in one's local webauthn repo clone" instructions w3c/webauthn#1477 (1 comment by @equalsJeffH)
-
-
4 pull requests opened.
-
mmiller-improve-terminology w3c/webauthn#1615, by @MasterKale.
-
Install Bikeshed from PyPI instead of Git clone w3c/webauthn#1610, by @emlun.
-
Fix incorrect authenticator operation reference in §6.1.2 w3c/webauthn#1609, by @emlun.
-
Remove mention of ECDAA from Figure 6 w3c/webauthn#1607, by @emlun.
-
-
7 pull requests merged.
-
Add WebDriver support for credBlob w3c/webauthn#1586.
-
Update CTAP reference. w3c/webauthn#1585.
-
Move JC to former editors w3c/webauthn#1599.
-
Remove user handle "MAY be null" statement w3c/webauthn#1600.
-
Remove mention of ECDAA from Figure 6 w3c/webauthn#1607.
-
Fix incorrect authenticator operation reference in §6.1.2 w3c/webauthn#1609.
-
Install Bikeshed from PyPI instead of Git clone w3c/webauthn#1610.
-
-
4 pull requests received 15 new comments.
-
mmiller-improve-terminology w3c/webauthn#1615 (7 comments by @emlun, @equalsJeffH, @Firstyear, @MasterKale)
-
Install Bikeshed from PyPI instead of Git clone w3c/webauthn#1610 (4 comments by @emlun, @sideshowbarker, @wseltzer)
-
Fix incorrect authenticator operation reference in §6.1.2 w3c/webauthn#1609 (2 comments by @emlun, @equalsJeffH)
-
TR publications
-
2 documents published.
-
Web Authentication: An API for accessing Public Key Credentials - Level 3 published as a First Public Working Draft. History of Web Authentication: An API for accessing Public Key Credentials - Level 3
Past meetings
-
2 meetings.
Participants
-
1 participant left.
-
J.C. Jones (Mozilla Foundation) left.
-
GitHub
w3c/webauthn
-
6 issues opened.
-
update Figure 6 to remove mention of ECDAA w3c/webauthn#1606, by @equalsJeffH.
-
Multiple Credentials in a single Enrollment w3c/webauthn#1603, by @cyberphone.
-
Multiple Authenticator Options and Policies w3c/webauthn#1601, by @cyberphone.
-
"The user handle MUST NOT be empty, though it MAY be null" - but only in responses? w3c/webauthn#1598, by @emlun.
-
Web Standard to Access Device Authenticators w3c/webauthn#1597, by @sirinath.
-
Can the private keys be used for other cryptographic operations? w3c/webauthn#1595, by @ghost.
-
-
2 issues closed.
-
Web Standard to Access Device Authenticators w3c/webauthn#1597.
-
Make signature counters a MAY ? w3c/webauthn#1590.
-
-
12 issues received 84 new comments.
-
Can the private keys be used for other cryptographic operations? w3c/webauthn#1595 (32 comments by @agl, @cybercent, @emlun, @equalsJeffH, @Firstyear, @ghost, @MasterKale, @nuno0529, @rlin1, @serianox, @ve7jtb)
-
Consider allowing cross-domain credential use w3c/webauthn#1372 (12 comments by @agl, @dwaite, @emlun, @MasterKale, @Mikescops)
-
Prevent browsers from deleting credentials that the RP wanted to be server-side w3c/webauthn#1569 (11 comments by @Kieun, @lgarron, @MasterKale)
-
Multiple Credentials in a single Enrollment w3c/webauthn#1603 (7 comments by @cyberphone, @emlun, @Firstyear)
-
Make signature counters a MAY ? w3c/webauthn#1590 (5 comments by @bdewater, @equalsJeffH, @Firstyear, @ve7jtb, @yackermann)
-
Multiple Authenticator Options and Policies w3c/webauthn#1601 (4 comments by @cyberphone, @emlun, @Firstyear)
-
"The user handle MUST NOT be empty, though it MAY be null" - but only in responses? w3c/webauthn#1598 (4 comments by @emlun, @equalsJeffH, @MasterKale)
-
Web Standard to Access Device Authenticators w3c/webauthn#1597 (3 comments by @dwaite, @emlun, @sirinath)
-
Requiring user activation to call WebAuthn API w3c/webauthn#1293 (2 comments by @archoversight, @MasterKale)
-
User verification policy leads to ambiguous usage situations. w3c/webauthn#1510 (2 comments by @Firstyear, @soloturn)
-
<new proposal> Extending WebAuthn Protocol for Remote Authentication w3c/webauthn#1580 (1 comment by @ve7jtb)
-
-
9 pull requests opened.
-
Revert "FPWD tag" w3c/webauthn#1605, by @wseltzer.
-
Switch h2#subtitle to h2#profile-and-date w3c/webauthn#1602, by @deniak.
-
Remove user handle "MAY be null" statement w3c/webauthn#1600, by @equalsJeffH.
-
Move JC to former editors w3c/webauthn#1599, by @wseltzer.
-
prep for L3 FPWD w3c/webauthn#1594, by @wseltzer.
-
WD -> Process 2020 w3c/webauthn#1593, by @wseltzer.
-
rename main branch (travis) w3c/webauthn#1592, by @wseltzer.
-
Update bikeshed branch w3c/webauthn#1591, by @ynojima.
-
-
7 pull requests merged.
-
Revert "FPWD tag" w3c/webauthn#1605.
-
FPWD tag w3c/webauthn#1604.
-
master -> main ? w3c/webauthn#1578.
-
prep for L3 FPWD w3c/webauthn#1594.
-
WD -> Process 2020 w3c/webauthn#1593.
-
rename main branch (travis) w3c/webauthn#1592.
-
Update bikeshed branch w3c/webauthn#1591.
-
-
5 pull requests received 25 new comments.
-
Switch h2#subtitle to h2#profile-and-date w3c/webauthn#1602 (5 comments by @equalsJeffH, @sideshowbarker, @tabatkins, @wseltzer)
-
non-modal "conditionally mediated" UI w3c/webauthn#1576 (5 comments by @emlun, @equalsJeffH, @lgarron, @MasterKale)
Past meetings
Participants
-
1 participant joined.
-
Michel Foucault (CANTON CONSULTING) joined.
-
-
1 participant left.
-
Hubert Le Van Gong (PayPal) left.
-
-
1 organization left.
-
PayPal left.
-
GitHub
w3c/webauthn
-
8 issues opened.
-
Make signature counters a MAY ? w3c/webauthn#1590, by @equalsJeffH.
-
WebAuthn assertion disabled by default in cross-origin iframes (Emv 3D Secure flow) w3c/webauthn#1589, by @erhardbrand.
-
Inconsistent RP directions for handling credential transports w3c/webauthn#1587, by @emlun.
-
SPC Security Analysis w3c/webauthn#1584, by @cyberphone.
-
Assertion signatures with JWS? w3c/webauthn#1581, by @cyberphone.
-
<new proposal> Extending WebAuthn Protocol for Remote Authentication w3c/webauthn#1580, by @thedreamwork.
-
FIDO + 3DS is a strange combination w3c/webauthn#1579, by @cyberphone.
-
-
8 issues closed.
-
FIDO + 3DS is a strange combination w3c/webauthn#1579.
-
FIDO Payment Support w3c/webauthn#1570.
-
SPC Security Analysis w3c/webauthn#1584.
-
Assertion signatures with JWS? w3c/webauthn#1581.
-
ensure non-native Signature Assertions are passed-through w3c/webauthn#465.
-
17 issues received 70 new comments.
-
<new proposal> Extending WebAuthn Protocol for Remote Authentication w3c/webauthn#1580 (28 comments by @emlun, @equalsJeffH, @Firstyear, @Kieun, @sbweeden, @thedreamwork, @ve7jtb)
-
Make signature counters a MAY ? w3c/webauthn#1590 (6 comments by @akshayku, @Firstyear, @kreichgauer, @maxhata, @rlin1, @yackermann)
-
FIDO + 3DS is a strange combination w3c/webauthn#1579 (6 comments by @cyberphone, @equalsJeffH, @Firstyear)
-
Inconsistent RP directions for handling credential transports w3c/webauthn#1587 (4 comments by @dwaite, @Firstyear, @Kieun, @maxhata)
-
Cleanup when creating discoverable credentials with attestations w3c/webauthn#1560 (2 comments by @dwaite, @emlun)
-
WebAuthn assertion disabled by default in cross-origin iframes (Emv 3D Secure flow) w3c/webauthn#1589 (1 comment by @agl)
-
New platform authenticators are making discoverable credentials regardless of residentKey=false passed to Create() w3c/webauthn#1457 (1 comment by @jurepurgar)
-
Consider allowing RPs to indicate that they want platform authenticators to be synced across devices w3c/webauthn#969 (1 comment by @agl)
-
-
3 pull requests opened.
-
Explicitly restrict NONE aaguid to none attestation only w3c/webauthn#1588, by @yackermann.
-
Add WebDriver support for credBlob w3c/webauthn#1586, by @agl.
-
Update CTAP reference. w3c/webauthn#1585, by @agl.
-
-
2 pull requests closed.
-
Explicitly restrict NONE aaguid to none attestation only w3c/webauthn#1588.
-
Pass through other assertion formats w3c/webauthn#1232.
-
-
3 pull requests received 13 new comments.
-
Explicitly restrict NONE aaguid to none attestation only w3c/webauthn#1588 (11 comments by @emlun, @Kieun, @MasterKale, @yackermann)
-
TR publications
-
1 document published.
-
Web Authentication: An API for accessing Public Key Credentials - Level 2 published as a Proposed Recommendation. History of Web Authentication: An API for accessing Public Key Credentials - Level 2
-
Participants
-
2 participants joined.
-
Matthew Miller (Cisco) joined.
-
William Brown (W3C Invited Experts) joined.
-
GitHub
w3c/webauthn
-
12 issues opened.
-
Support for remote desktops w3c/webauthn#1577, by @agl.
-
Issue with user_verification=preferred w3c/webauthn#1571, by @p0w1.
-
FIDO Payment Support w3c/webauthn#1570, by @cyberphone.
-
Prevent browsers from deleting credentials that the RP wanted to be server-side w3c/webauthn#1569, by @lgarron.
-
Support a "create or get [or replace]" credential re-association operation w3c/webauthn#1568, by @lgarron.
-
Support `discoverableCredential` field in the API. w3c/webauthn#1565, by @lgarron.
-
Allow RP to determine correct Platform Authenticator name w3c/webauthn#1563, by @FlxMgdnz.
-
Cleanup when creating discoverable credentials with attestations w3c/webauthn#1560, by @dwaite.
-
Questions about user handle when supporting usernameless w3c/webauthn#1559, by @MasterKale.
-
-
6 issues closed.
-
Broken reference link for [EduPersonObjectClassSpec]. w3c/webauthn#1544.
-
Issue with user_verification=preferred w3c/webauthn#1571.
-
Update editors and past editors for L2 Proposed Rec w3c/webauthn#1496.
-
Allow RP to determine correct Platform Authenticator name w3c/webauthn#1563.
-
18 issues received 91 new comments.
-
FIDO Payment Support w3c/webauthn#1570 (11 comments by @adrianhopebailie, @cyberphone, @equalsJeffH, @rsolomakhin)
-
Can RPs assume that `InvalidStateError` for `create()` means an excludeCredentials match? w3c/webauthn#1566 (11 comments by @akshayku, @arshadnoor, @equalsJeffH, @Kieun, @lgarron, @nicksteele)
-
Move step 16 of Registration to between 21 and 22 w3c/webauthn#1555 (9 comments by @emlun, @equalsJeffH, @Firstyear)
-
Prevent browsers from deleting credentials that the RP wanted to be server-side w3c/webauthn#1569 (8 comments by @akshayku, @emlun, @equalsJeffH, @lgarron, @limpkin)
-
Surface platform authenticator status in the `create` (and maybe `get`) response / help RPs track UV/PA/RK w3c/webauthn#1567 (8 comments by @akshayku, @equalsJeffH, @Kieun, @lgarron, @nsatragno)
-
Note to encourage storage of registered credential details w3c/webauthn#1556 (7 comments by @akshayku, @equalsJeffH, @Firstyear, @lgarron, @MasterKale)
-
Request for an Accessibility Considerations section to API for Accessing Public key credentials CR w3c/webauthn#1557 (6 comments by @AutoSponge, @brewerj, @equalsJeffH, @michael-n-cooper)
-
Support a "create or get [or replace]" credential re-association operation w3c/webauthn#1568 (6 comments by @akshayku, @equalsJeffH, @Kieun, @lgarron)
-
Cleanup when creating discoverable credentials with attestations w3c/webauthn#1560 (6 comments by @arshadnoor, @dwaite, @equalsJeffH)
-
Support `discoverableCredential` field in the API. w3c/webauthn#1565 (4 comments by @akshayku, @lgarron, @selfissued)
-
Allow RP to determine correct Platform Authenticator name w3c/webauthn#1563 (3 comments by @dwaite, @lgarron, @nicksteele)
-
Questions about user handle when supporting usernameless w3c/webauthn#1559 (2 comments by @dwaite, @Kieun)
-
Adding info about HSTS for the RPID to client Data. w3c/webauthn#1554 (2 comments by @equalsJeffH, @ve7jtb)
-
Consider adding/using personal name examples that are more culturally neutral/diverse [editorial] w3c/webauthn#1525 (1 comment by @r12a)
-
-
8 pull requests opened.
-
master -> main ? w3c/webauthn#1578, by @wseltzer.
-
non-modal "conditionally mediated" UI w3c/webauthn#1576, by @equalsJeffH.
-
Revert "Prep for Proposed Rec" w3c/webauthn#1575, by @wseltzer.
-
Prep for Proposed Rec w3c/webauthn#1574, by @wseltzer.
-
fix eduPerson reference, again w3c/webauthn#1573, by @equalsJeffH.
-
Prep for Proposed Rec w3c/webauthn#1572, by @wseltzer.
-
Fix link to EduPersonObjectClassSpec w3c/webauthn#1561, by @equalsJeffH.
-
Add Accessibility Considerations section w3c/webauthn#1558, by @equalsJeffH.
-
-
6 pull requests merged.
-
Revert "Prep for Proposed Rec" w3c/webauthn#1575.
-
Prep for Proposed Rec w3c/webauthn#1574.
-
Add Accessibility Considerations section w3c/webauthn#1558.
-
fix eduPerson reference, again w3c/webauthn#1573.
-
Fix link to EduPersonObjectClassSpec w3c/webauthn#1561.
-
Update editors and past editors w3c/webauthn#1548.
-
-
1 pull request closed.
-
Prep for Proposed Rec w3c/webauthn#1572.
-
-
5 pull requests received 28 new comments.
-
Add Accessibility Considerations section w3c/webauthn#1558 (16 comments by @agl, @becka11y, @emlun, @equalsJeffH, @lgarron, @nadalin)
-
Fix link to EduPersonObjectClassSpec w3c/webauthn#1561 (6 comments by @equalsJeffH, @Firstyear, @rlin1, @ve7jtb)
-
Participants
-
3 participants left.
-
Ibrahim Damlaj (Microsoft Corporation) left.
-
Olivier Lisandre (CANTON CONSULTING) left.
-
Jules Renier (CANTON CONSULTING) left.
-
GitHub
w3c/webauthn
-
6 issues opened.
-
Note to encourage storage of registered credential details w3c/webauthn#1556, by @Firstyear.
-
Move step 16 of Registration to between 21 and 22 w3c/webauthn#1555, by @Firstyear.
-
Adding info about HSTS for the RPID to client Data. w3c/webauthn#1554, by @ve7jtb.
-
editorial cleanups noted by Mr Pinkas w3c/webauthn#1549, by @equalsJeffH.
-
Support for authenticators providing more than one key w3c/webauthn#1546, by @agl.
-
Add support for non-modal UI w3c/webauthn#1545, by @agl.
-
-
3 issues closed.
-
editorial cleanups noted by Mr Pinkas w3c/webauthn#1549.
-
Standardising support for software authenticators w3c/webauthn#1175.
-
Question about platform authenticator w3c/webauthn#1540.
-
-
13 issues received 35 new comments.
-
User verification policy leads to ambiguous usage situations. w3c/webauthn#1510 (15 comments by @equalsJeffH, @Firstyear, @nadalin, @nicksteele, @sbweeden)
-
Support for authenticators providing more than one key w3c/webauthn#1546 (3 comments by @emlun, @nicksteele, @sbweeden)
-
Note to encourage storage of registered credential details w3c/webauthn#1556 (2 comments by @dwaite, @lgarron)
-
Clarify how a user can authenticate from multiple devices w3c/webauthn#151 (1 comment by @arshadnoor)
-
-
6 pull requests opened.
-
Bikeshed spec data update w3c/webauthn#1553, by @wseltzer.
-
Bikeshed .spec-data update w3c/webauthn#1552, by @wseltzer.
-
update bikeshed cache w3c/webauthn#1551, by @equalsJeffH.
-
fix: empty section, misspelling, RFC7049 is now RFC8949 w3c/webauthn#1550, by @equalsJeffH.
-
Update editors and past editors w3c/webauthn#1548, by @equalsJeffH.
-
Draft changes for allowCredentials to indicate per-credential verification w3c/webauthn#1547, by @Firstyear.
-
-
2 pull requests merged.
-
fix: empty section, misspelling, RFC7049 is now RFC8949 w3c/webauthn#1550.
-
Bikeshed spec data update w3c/webauthn#1553.
-
-
3 pull requests closed.
-
Draft changes for allowCredentials to indicate per-credential verification w3c/webauthn#1547.
-
update bikeshed cache w3c/webauthn#1551.
-
Bikeshed .spec-data update w3c/webauthn#1552.
-
-
5 pull requests received 9 new comments.
-
Draft changes for allowCredentials to indicate per-credential verification w3c/webauthn#1547 (2 comments by @equalsJeffH, @sbweeden)