Web Authentication Working Group - Activity in 2023
No matches.
Past meetings
Participants
-
5 participants joined.
-
Shuojing Wang (Google LLC) joined.
-
Peter Davis (Onfido) joined.
-
Oliver Terbu (Mattr Limited) joined.
-
Lachlan Gleeson (IBM Corporation) joined.
-
Neha Mankal (American Express Company) joined.
-
-
3 participants left.
-
Peter Davis (Onfido) left.
-
Prad Nukala (Sonr) left.
-
Oliver Terbu (Mattr Limited) left.
-
-
2 organizations joined.
-
Onfido joined.
-
Mattr Limited joined.
-
-
2 organizations left.
-
Onfido left.
-
Sonr left.
-
GitHub
w3c/webauthn
-
3 issues opened.
-
Conditional UI support by WebAuthn WebDriver Extension w3c/webauthn#2010, by @ynojima.
-
Consider replacing "Github" with "GitHub" w3c/webauthn#2007, by @tylerjmorg.
-
Cambios por abuso w3c/webauthn#2006, by @JuanMahnjn.
-
-
4 issues closed.
-
reference CTAP2.1 PS spec and fix broken link w3c/webauthn#1635.
-
Cambios por abuso w3c/webauthn#2006.
-
-
9 issues received 38 new comments.
-
Add a way to use webauthn without Javascript w3c/webauthn#1255 (16 comments by @alcinnz, @arianvp, @dwaite, @MasterKale, @pabs3, @rlin1, @ryanhiebert, @tcannonfodder)
-
[Superset] Updating credential metadata and requesting deletion of stale credentials w3c/webauthn#1967 (11 comments by @arianvp, @arnar, @Firstyear, @jgimenez, @kopy, @nsatragno, @serianox)
-
username and display name should not be mandatory (rp, challange either) and OS UX should be simplified if not present w3c/webauthn#1915 (4 comments by @arianvp, @Firstyear, @r-jo)
-
Prevent browsers from deleting credentials that the RP wanted to be server-side w3c/webauthn#1569 (1 comment by @arianvp)
-
Indicate that the credential could be backed up and restored, but not synchronized w3c/webauthn#1933 (1 comment by @nadalin)
-
rp.name, user.name and user.displayName length limit does not state binary encoding w3c/webauthn#1994 (1 comment by @aphillips)
-
Wrong type of encrypted content specified for credentialId under "Credential Storage Modality" section w3c/webauthn#2002 (1 comment by @emlun)
-
-
3 pull requests opened.
-
Correct capitalization on "Github" w3c/webauthn#2009, by @MasterKale.
-
Update index.html w3c/webauthn#2008, by @tylerjmorg.
-
Disambiguate "this value" in authenticatorDisplayName description w3c/webauthn#2005, by @emlun.
-
-
6 pull requests merged.
-
Reference CTAP 2.1 errata spec w3c/webauthn#2004.
-
Don't define a [[preventSilentAccess]] internal method w3c/webauthn#1991.
-
Add backup flags to virtual authenticator w3c/webauthn#1999.
-
Fix incorrect reference in Add Virtual Authenticator w3c/webauthn#2001.
-
Fix references to credential private key that should be credential source w3c/webauthn#2003.
-
Disambiguate "this value" in authenticatorDisplayName description w3c/webauthn#2005.
-
-
1 pull request closed.
-
Update index.html w3c/webauthn#2008.
-
-
8 pull requests received 19 new comments.
-
Add new getClientCapabilities method w3c/webauthn#1923 (8 comments by @agl, @jschanck, @MasterKale, @nsatragno, @timcappalli)
-
Add packed attestation optional firmware version attribute w3c/webauthn#1953 (4 comments by @emlun, @MasterKale, @serianox)
-
Make the default value for the attestation member in assertion options be null w3c/webauthn#1972 (1 comment by @MasterKale)
-
Past meetings
Participants
-
2 participants joined.
-
Thanawat Kaewka (Yahoo Holdings Inc.) joined.
-
Nate Jones (Microsoft Corporation) joined.
-
GitHub
w3c/webauthn
-
4 issues opened.
-
rp.name, user.name and user.displayName length limit does not state binary encoding w3c/webauthn#1994, by @emlun.
-
Inconsistent Passkey Authentication in Google Chrome w3c/webauthn#1993, by @CyberCtzn.
-
6 issues closed.
-
Code Injection vulnerability from client side w3c/webauthn#1965.
-
Spec is not specific enough about order of conditional UI autofill tokens w3c/webauthn#1982.
-
Inconsistent Passkey Authentication in Google Chrome w3c/webauthn#1993.
-
-
14 issues received 48 new comments.
-
How to know if a user has already registered a device? w3c/webauthn#1749 (17 comments by @agl, @andreujuanc, @dagnelies, @Firstyear, @mitar, @ragnarbull)
-
Inconsistent Passkey Authentication in Google Chrome w3c/webauthn#1993 (5 comments by @agl, @Firstyear, @MasterKale, @timcappalli)
-
Consider allowing cross-domain credential use w3c/webauthn#1372 (4 comments by @alfonso-paella, @jaiminbhatt7, @timcappalli)
-
Clarify how to differentiate between exceptions w3c/webauthn#1859 (4 comments by @emlun, @lgarron, @MasterKale)
-
username and display name should not be mandatory (rp, challange either) and OS UX should be simplified if not present w3c/webauthn#1915 (3 comments by @r-jo, @ragnarbull)
-
Support a "create or get [or replace]" credential re-association operation w3c/webauthn#1568 (2 comments by @mitar)
-
How is an RP to know if a packed attestation root certificate is used for multiple authenticator models? w3c/webauthn#1998 (2 comments by @emlun, @sbweeden)
-
Spec abstract is out of date on the eve of multi-device credentials and cross-device auth w3c/webauthn#1743 (1 comment by @nicksteele)
-
rp.name, user.name and user.displayName length limit does not state binary encoding w3c/webauthn#1994 (1 comment by @Firstyear)
-
Virtual Authenticator API does not expose a way to set backup-eligible or backup-status flags w3c/webauthn#1987 (1 comment by @MasterKale)
-
-
9 pull requests opened.
-
Reference CTAP 2.1 errata spec w3c/webauthn#2004, by @selfissued.
-
Fix references to credential private key that should be credential source w3c/webauthn#2003, by @emlun.
-
Fix incorrect reference in Add Virtual Authenticator w3c/webauthn#2001, by @emlun.
-
Clarify validation step for packed attestation certificate for RPs. w3c/webauthn#2000, by @sbweeden.
-
Add backup flags to virtual authenticator w3c/webauthn#1999, by @nsatragno.
-
Drop assertion-time attestation. w3c/webauthn#1997, by @agl.
-
Resolve conflicts between spk (#1957) and PR #1970 w3c/webauthn#1996, by @emlun.
-
Add credProps client processing step to set authenticatorDisplayName w3c/webauthn#1995, by @emlun.
-
Add note about typical autocomplete combos for conditional UI w3c/webauthn#1992, by @MasterKale.
-
-
7 pull requests merged.
-
Allow use of credProps extension during auth w3c/webauthn#1988.
-
Add note about typical autocomplete combos for conditional UI w3c/webauthn#1992.
-
Clarify validation step for packed attestation certificate for RPs. w3c/webauthn#2000.
-
devicePubKey → supplementalPubKeys w3c/webauthn#1957.
-
Tweaks for bikeshed w3c/webauthn#1986.
-
Recommend duration of challenge validity w3c/webauthn#1855.
-
Add credProps client processing step to set authenticatorDisplayName w3c/webauthn#1995.
-
-
2 pull requests closed.
-
Resolve conflicts between spk (#1957) and PR #1970 w3c/webauthn#1996.
-
Add importCryptoKey input to PRF extension w3c/webauthn#1945.
-
-
11 pull requests received 64 new comments.
-
Add note about typical autocomplete combos for conditional UI w3c/webauthn#1992 (14 comments by @arianvp, @emlun, @MasterKale, @nsatragno)
-
Add new getClientCapabilities method w3c/webauthn#1923 (6 comments by @emlun, @jschanck, @MasterKale, @nsatragno)
-
Clarify validation step for packed attestation certificate for RPs. w3c/webauthn#2000 (1 comment by @emlun)
Past meetings
Participants
-
2 participants joined.
-
Anthony Joseph Castillo (Rakuten Group, Inc.) joined.
-
Alisa Gorelova (Rakuten Group, Inc.) joined.
-
GitHub
w3c/webauthn
-
6 issues opened.
-
> w3c/webauthn#1990, by @carlena3497.
-
Deprecation warning for fido-u2f, apple, and android-safetynet? w3c/webauthn#1989, by @vanbukin.
-
create() and get() return an algorithm, not a credential w3c/webauthn#1984, by @emlun.
-
Spec is not specific enough about order of conditional UI autofill tokens w3c/webauthn#1982, by @MasterKale.
-
-
4 issues closed.
-
Deprecation warning for fido-u2f, apple, and android-safetynet? w3c/webauthn#1989.
-
> w3c/webauthn#1990.
-
PublicKeyCredentialJSON is an invalid WebIDL construct w3c/webauthn#1958.
-
-
12 issues received 37 new comments.
-
Virtual Authenticator API does not expose a way to set backup-eligible or backup-status flags w3c/webauthn#1987 (8 comments by @agl, @emlun, @fwadnjar, @james-d-elliott, @MasterKale, @nsatragno)
-
[Superset] Updating credential metadata and requesting deletion of stale credentials w3c/webauthn#1967 (7 comments by @emlun, @Firstyear, @nsatragno)
-
Deprecation warning for fido-u2f, apple, and android-safetynet? w3c/webauthn#1989 (6 comments by @emlun, @timcappalli, @vanbukin)
-
Ambiguous instructions in the Android Key Attestation Statement Format verification procedure w3c/webauthn#1980 (4 comments by @Kieun, @vanbukin)
-
Support for FIDO passkey with HMAC-Secret extension w3c/webauthn#1830 (3 comments by @agl, @ragnarbull)
-
Provide a way for Web Extensions to hook into browser's Passkey autofill UI w3c/webauthn#1976 (3 comments by @arianvp, @irew)
-
Spec is not specific enough about order of conditional UI autofill tokens w3c/webauthn#1982 (1 comment by @MasterKale)
-
Remove the [SameObject] attribute from PublicKeyCredential::authenticatorAttachment w3c/webauthn#1977 (1 comment by @emlun)
-
-
6 pull requests opened.
-
Don't define a [[preventSilentAccess]] internal method w3c/webauthn#1991, by @emlun.
-
Allow use of credProps extension during auth w3c/webauthn#1988, by @MasterKale.
-
Tweaks for bikeshed w3c/webauthn#1986, by @plehegar.
-
[meta-PR] Retain both aaguid definitions w3c/webauthn#1985, by @emlun.
-
Update GitHub Actions workflow w3c/webauthn#1983, by @VoltrexKeyva.
-
Remove [SameObject] attribute from PublicKeyCredential.authenticatorAttachment w3c/webauthn#1981, by @emlun.
-
-
8 pull requests merged.
-
Add authenticatorDisplayName to credProps w3c/webauthn#1880.
-
update and link to working AAGUID definition w3c/webauthn#1970.
-
Add `compound` attestation format w3c/webauthn#1950.
-
[meta-PR] Retain both aaguid definitions w3c/webauthn#1985.
-
Update GitHub Actions workflow w3c/webauthn#1983.
-
Fix broken PublicKeyCredentialJSON WebIDL definition w3c/webauthn#1969.
-
Highlight that filtering all pubKeyCredParams is an error. w3c/webauthn#1971.
-
-
1 pull request closed.
-
Tweaks for bikeshed w3c/webauthn#1978.
-
-
13 pull requests received 47 new comments.
-
Add new getClientCapabilities method w3c/webauthn#1923 (6 comments by @agl, @emlun, @MasterKale, @timcappalli)
-
Add importCryptoKey input to PRF extension w3c/webauthn#1945 (5 comments by @emlun, @Firstyear, @fwadnjar)
-
Add packed attestation optional firmware version attribute w3c/webauthn#1953 (5 comments by @dwaite, @emlun)
-
Update GitHub Actions workflow w3c/webauthn#1983 (3 comments by @MasterKale, @timcappalli, @VoltrexKeyva)
-
Make the default value for the attestation member in assertion options be null w3c/webauthn#1972 (1 comment by @Kieun)
-
Highlight that filtering all pubKeyCredParams is an error. w3c/webauthn#1971 (1 comment by @nsatragno)
TR publications
-
1 document published.
Past meetings
-
6 meetings.
Participants
-
5 participants joined.
-
Tawanda Brandon Sibanda (Snake Nation) joined.
-
Michael Jones (W3C Invited Experts) joined.
-
Mike Fisk (Meta) joined.
-
Duy-Tung LUU (CANTON CONSULTING) joined.
-
Jean-Yves ROSSI (CANTON CONSULTING) joined.
-
-
2 participants left.
-
Nick Mooney (Google LLC) left.
-
Michael Jones (W3C Invited Experts) left.
-
-
3 organizations joined.
-
Snake Nation joined.
-
Meta joined.
-
CANTON CONSULTING joined.
-
GitHub
w3c/webauthn
-
11 issues opened.
-
Are notes in webauthn normative or informative? w3c/webauthn#1979, by @plehegar.
-
Remove the [SameObject] attribute from PublicKeyCredential::authenticatorAttachment w3c/webauthn#1977, by @jschanck.
-
Provide a way for Web Extensions to hook into browser's Passkey autofill UI w3c/webauthn#1976, by @arianvp.
-
The bike shed build is broken with the newest version w3c/webauthn#1974, by @pascoej.
-
[Superset] Updating credential metadata and requesting deletion of stale credentials w3c/webauthn#1967, by @timcappalli.
-
Code Injection vulnerability from client side w3c/webauthn#1965, by @AdityaMitra5102.
-
Further clarification of Unsigned Extension Outputs w3c/webauthn#1964, by @bobknowscode.
-
Should credentials requested with attestation=none include an AAGUID? w3c/webauthn#1962, by @pascoej.
-
Add support for SRP (or some other PAKE) in WebAuthn w3c/webauthn#1960, by @dolda2000.
-
PublicKeyCredentialJSON is an invalid WebIDL construct w3c/webauthn#1958, by @petervanderbeken.
-
-
14 issues closed.
-
The bike shed build is broken with the newest version w3c/webauthn#1974.
-
Specify authenticator attachment for authentication operation w3c/webauthn#1267.
-
FIDO credential decommissioning w3c/webauthn#1696.
-
Personal information updates & webauthn w3c/webauthn#1456.
-
Cleanup when creating discoverable credentials with attestations w3c/webauthn#1560.
-
Making PublicKeyCredentialDescriptor.transports mandatory w3c/webauthn#1522.
-
add feature detection blurb... w3c/webauthn#1208.
-
Recovering from Device Loss w3c/webauthn#931.
-
Emphasize use of `user.name` for RP's to help users distinguish credentials w3c/webauthn#1852.
-
Add support for SRP (or some other PAKE) in WebAuthn w3c/webauthn#1960.
-
-
23 issues received 59 new comments.
-
Code Injection vulnerability from client side w3c/webauthn#1965 (17 comments by @AdityaMitra5102, @arianvp, @emlun, @Firstyear, @irew, @micolous, @serianox, @ve7jtb)
-
Extend WebAuthn spec to support interoperability in WebExtensions w3c/webauthn#1766 (7 comments by @arianvp, @dwaite, @FlxMgdnz, @irew)
-
Could not use Webauthn `PublicKeyCredential.create` when the RP ID is a Host string(ip). w3c/webauthn#1358 (5 comments by @emlun, @jbhanks, @slayercat, @timcappalli)
-
Cleanup when creating discoverable credentials with attestations w3c/webauthn#1560 (3 comments by @dwaite, @Firstyear, @timcappalli)
-
Should credentials requested with attestation=none include an AAGUID? w3c/webauthn#1962 (3 comments by @irew, @nsatragno, @pascoej)
-
PublicKeyCredentialJSON is an invalid WebIDL construct w3c/webauthn#1958 (3 comments by @arianvp, @MasterKale)
-
Add support for SRP (or some other PAKE) in WebAuthn w3c/webauthn#1960 (3 comments by @dolda2000, @emlun, @Firstyear)
-
Specify authenticator attachment for authentication operation w3c/webauthn#1267 (2 comments by @Kieun, @timcappalli)
-
Prevent browsers from deleting credentials that the RP wanted to be server-side w3c/webauthn#1569 (2 comments by @lgarron, @MasterKale)
-
Provide a way for Web Extensions to hook into browser's Passkey autofill UI w3c/webauthn#1976 (1 comment by @arianvp)
-
[Superset] Updating credential metadata and requesting deletion of stale credentials w3c/webauthn#1967 (1 comment by @MasterKale)
-
Facility for an RP to indicate a change of displayName to a discoverable credential w3c/webauthn#1779 (1 comment by @timcappalli)
-
PublicKeyCredentialParameters can't select curve (E.g. ed448) w3c/webauthn#1446 (1 comment by @selfissued)
-
Making PublicKeyCredentialDescriptor.transports mandatory w3c/webauthn#1522 (1 comment by @timcappalli)
-
think about adding note wrt how client platform might obtain authenticator capabilities w3c/webauthn#1207 (1 comment by @timcappalli)
-
Proposal/discussion: non-extractable CryptoKey output from the prf extension w3c/webauthn#1895 (1 comment by @MasterKale)
-
-
10 pull requests opened.
-
Tweaks for bikeshed w3c/webauthn#1978, by @plehegar.
-
Fix the bikeshed build w3c/webauthn#1975, by @pascoej.
-
Add myself to the contributors w3c/webauthn#1973, by @Kieun.
-
Make the default value for the attestation member in assertion options be null w3c/webauthn#1972, by @Kieun.
-
Highlight that filtering all pubKeyCredParams is an error. w3c/webauthn#1971, by @agl.
-
update and link to working AAGUID definition w3c/webauthn#1970, by @nicksteele.
-
Fix broken PublicKeyCredentialJSON WebIDL definition w3c/webauthn#1969, by @MasterKale.
-
Specify what an unknown type credential descriptor being ignored means w3c/webauthn#1966, by @amoseui.
-
Reference CTAP 2.1 Proposed Standard w3c/webauthn#1961, by @selfissued.
-
devicePubKey → supplementalPubKeys w3c/webauthn#1957, by @agl.
-
-
7 pull requests merged.
-
Add myself to the contributors w3c/webauthn#1973.
-
Fix the bikeshed build w3c/webauthn#1975.
-
Fix inconsistent usage of options variable w3c/webauthn#1948.
-
Delete outdated note about checking registration UV with PRF extension w3c/webauthn#1944.
-
Reference CTAP 2.1 Proposed Standard w3c/webauthn#1961.
-
Fix broken spec references w3c/webauthn#1955.
-
-
2 pull requests closed.
-
Specify what an unknown type credential descriptor being ignored means w3c/webauthn#1966.
-
[Meta] Hard-code HKDF in PRF importCryptoKey w3c/webauthn#1946.
-
-
18 pull requests received 100 new comments.
-
Initial text for conditional create w3c/webauthn#1951 (24 comments by @agl, @emlun, @MasterKale, @nicksteele, @nsatragno, @pascoej)
-
devicePubKey → supplementalPubKeys w3c/webauthn#1957 (20 comments by @agl, @arianvp, @dwaite, @maxhata, @rlin1, @sbweeden, @timcappalli, @ve7jtb)
-
Add importCryptoKey input to PRF extension w3c/webauthn#1945 (10 comments by @agl, @emlun, @MasterKale)
-
Add `compound` attestation format w3c/webauthn#1950 (9 comments by @MasterKale, @selfissued, @timcappalli)
-
Add packed attestation optional firmware version attribute w3c/webauthn#1953 (7 comments by @agl, @dwaite, @emlun, @sbweeden)
-
Add new getClientCapabilities method w3c/webauthn#1923 (6 comments by @emlun, @MasterKale, @timcappalli)
-
Specify what an unknown type credential descriptor being ignored means w3c/webauthn#1966 (3 comments by @agl, @w3cbot)
-
update and link to working AAGUID definition w3c/webauthn#1970 (3 comments by @timcappalli, @w3cbot)
-
Clarify distinction between PublicKeyCredentialUserEntity name and displayName w3c/webauthn#1932 (2 comments by @MasterKale)
-
Make the default value for the attestation member in assertion options be null w3c/webauthn#1972 (1 comment by @Kieun)
-
Highlight that filtering all pubKeyCredParams is an error. w3c/webauthn#1971 (1 comment by @nicksteele)
-
Past meetings
Participants
-
2 participants joined.
-
Dana Keeler (Mozilla Foundation) joined.
-
John Schanck (Mozilla Foundation) joined.
-
GitHub
w3c/webauthn
-
8 issues opened.
-
[[preventSilentAccess]] seems incorrect w3c/webauthn#1956, by @emlun.
-
Describe firmware OID usage in packed attestation w3c/webauthn#1952, by @dwaite.
-
Inconsistent variable reference of attestation and attestationFormats in the steps w3c/webauthn#1947, by @Kieun.
-
Extension's data security on assertion w3c/webauthn#1940, by @BeetLab.
-
Should we keep the word “passkey” in the spec or not w3c/webauthn#1939, by @ko-koiwai.
-
Remove isPPAA() and expand getClientCapabilities() w3c/webauthn#1937, by @timcappalli.
-
-
12 issues closed.
-
Enforce backup eligibility during assertion w3c/webauthn#1791.
-
Add Changed Flag to UVM Entry w3c/webauthn#1890.
-
Return public key in attestedCredentialData on authenticatorGetAssertion w3c/webauthn#1928.
-
Revisit description of userHandle w3c/webauthn#1909.
-
Require non-null userHandle when allowCredentials is empty? w3c/webauthn#1892.
-
Ambiguous reference to [=Window=] w3c/webauthn#1910.
-
Should we keep the word “passkey” in the spec or not w3c/webauthn#1939.
-
Extension's data security on assertion w3c/webauthn#1940.
-
-
1 issue reopened.
-
Should we keep the word “passkey” in the spec or not w3c/webauthn#1939, by @timcappalli.
-
-
24 issues received 56 new comments.
-
Should we keep the word “passkey” in the spec or not w3c/webauthn#1939 (13 comments by @james-d-elliott, @MasterKale, @maxhata, @nicksteele, @nov, @timcappalli)
-
username and display name should not be mandatory (rp, challange either) and OS UX should be simplified if not present w3c/webauthn#1915 (7 comments by @emlun, @r-jo, @ryanshahine)
-
Adding some sentences to describe credential sharing between multiple users w3c/webauthn#1921 (7 comments by @emlun, @Firstyear, @Kieun, @sbweeden, @timcappalli)
-
The default value of `attestation` member in `PublicKeyCredentialRequestOptions` should be null or must not have default value w3c/webauthn#1941 (4 comments by @Kieun, @nicksteele, @ve7jtb)
-
Broken references in Web Authentication: An API for accessing Public Key Credentials - Level w3c/webauthn#1794 (2 comments by @emlun, @nadalin)
-
WebAuthn available to Workers? aka "silent authentication" w3c/webauthn#199 (2 comments by @jordaaash, @nicksteele)
-
Proposal/discussion: non-extractable CryptoKey output from the prf extension w3c/webauthn#1895 (2 comments by @emlun, @MasterKale)
-
Signaling when user credentials are shared between users to the `relying party` w3c/webauthn#1922 (2 comments by @dwaite, @Firstyear)
-
Non-modal registration during conditional assertion w3c/webauthn#1929 (2 comments by @MasterKale, @pascoej)
-
Should enterprise attestation support be flagged explicitly? w3c/webauthn#1742 (1 comment by @timcappalli)
-
Spec abstract is out of date on the eve of multi-device credentials and cross-device auth w3c/webauthn#1743 (1 comment by @MasterKale)
-
Dependencies section is out of date and duplicates terms index w3c/webauthn#1797 (1 comment by @nadalin)
-
Allow conditional and modal flows to run simultaneously w3c/webauthn#1854 (1 comment by @timcappalli)
-
Clarify the need for truly randomly generated challenges (aka challenge callback issue) w3c/webauthn#1856 (1 comment by @timcappalli)
-
How to know if a user has already registered a device? w3c/webauthn#1749 (1 comment by @andreujuanc)
-
Inconsistent variable reference of attestation and attestationFormats in the steps w3c/webauthn#1947 (1 comment by @Kieun)
-
Return public key in attestedCredentialData on authenticatorGetAssertion w3c/webauthn#1928 (1 comment by @emlun)
-
-
11 pull requests opened.
-
Fix broken spec references w3c/webauthn#1955, by @emlun.
-
Enterprise packed attestation guidance w3c/webauthn#1954, by @dwaite.
-
Add packed attestation optional firmware version attribute w3c/webauthn#1953, by @dwaite.
-
Initial text for conditional create w3c/webauthn#1951, by @pascoej.
-
Add `compound` attestation format w3c/webauthn#1950, by @timcappalli.
-
Fix inconsistent usage of options variable w3c/webauthn#1948, by @Kieun.
-
[Meta] Hard-code HKDF in PRF importCryptoKey w3c/webauthn#1946, by @emlun.
-
Add importCryptoKey input to PRF extension w3c/webauthn#1945, by @emlun.
-
Delete outdated note about checking registration UV with PRF extension w3c/webauthn#1944, by @emlun.
-
remove passkey word w3c/webauthn#1938, by @ko-koiwai.
-
remove isPasskeyPlatformAuthenticatorAvailable() w3c/webauthn#1936, by @timcappalli.
-
-
8 pull requests merged.
-
Add a `hints` element for both `create` and `get`. w3c/webauthn#1884.
-
Address description of uses, and requirements for supplying userHandle w3c/webauthn#1914.
-
Add missing fields in dictionaries for JSON representation w3c/webauthn#1920.
-
Add security consideration section "Validating the origin of a credential" w3c/webauthn#1930.
-
Update Authenticator Definition w3c/webauthn#1931.
-
remove isPasskeyPlatformAuthenticatorAvailable() w3c/webauthn#1936.
-
Disambiguate [=Window=] links as {{Window}} w3c/webauthn#1911.
-
Define RP processing of be and bs flags during `.create()` and `.get()` w3c/webauthn#1907.
-
-
1 pull request closed.
-
remove passkey word w3c/webauthn#1938.
-
-
10 pull requests received 67 new comments.
-
Clarify distinction between PublicKeyCredentialUserEntity name and displayName w3c/webauthn#1932 (23 comments by @agl, @akshayku, @emlun, @MasterKale, @sbweeden)
-
Add new getClientCapabilities method w3c/webauthn#1923 (12 comments by @agl, @arianvp, @emlun, @MasterKale, @timcappalli)
-
remove isPasskeyPlatformAuthenticatorAvailable() w3c/webauthn#1936 (8 comments by @Firstyear, @ko-koiwai, @MasterKale, @maxhata, @timcappalli)
-
remove passkey word w3c/webauthn#1938 (8 comments by @Firstyear, @ko-koiwai, @maxhata, @nicksteele, @timcappalli)
-
Add authenticatorDisplayName to credProps w3c/webauthn#1880 (6 comments by @arnar, @emlun, @MasterKale)
-
Add packed attestation optional firmware version attribute w3c/webauthn#1953 (3 comments by @dwaite, @emlun)
-
Address description of uses, and requirements for supplying userHandle w3c/webauthn#1914 (1 comment by @sbweeden)
-
Past meetings
Participants
-
2 participants left.
-
Erhard Brand (Entersekt) left.
-
Keiko Itakura (Rakuten Group, Inc.) left.
-
GitHub
w3c/webauthn
-
13 issues opened.
-
Goo w3c/webauthn#1935, by @dp1939392.
-
Fido w3c/webauthn#1934, by @dp1939392.
-
Indicate that the credential could be backed up and restored, but not synchronized w3c/webauthn#1933, by @Kieun.
-
Non-modal registration during conditional assertion w3c/webauthn#1929, by @pascoej.
-
Return public key in attestedCredentialData on authenticatorGetAssertion w3c/webauthn#1928, by @hariria.
-
TPM attestation verification steps inconsistent with FIDO conformance testing tool w3c/webauthn#1925, by @sbweeden.
-
Headless API w3c/webauthn#1924, by @matthewp.
-
Signaling when user credentials are shared between users to the `relying party` w3c/webauthn#1922, by @Kieun.
-
Adding some sentences to describe credential sharing between multiple users w3c/webauthn#1921, by @Kieun.
-
`attestation` and `attestationObject` is missing some of interfaces for assertions w3c/webauthn#1918, by @Kieun.
-
Allow desired attestation format to be an ordered list w3c/webauthn#1917, by @sbweeden.
-
Describe packed enterprise attestation w3c/webauthn#1916, by @dwaite.
-
-
4 issues closed.
-
Goo w3c/webauthn#1935.
-
Fido w3c/webauthn#1934.
-
Headless API w3c/webauthn#1924.
-
More explicitly document use cases w3c/webauthn#1389.
-
-
13 issues received 47 new comments.
-
Headless API w3c/webauthn#1924 (11 comments by @arianvp, @emlun, @Firstyear, @matthewp, @nicksteele, @sbweeden, @timcappalli, @ve7jtb)
-
username and display name should not be mandatory (rp, challange either) and OS UX should be simplified if not present w3c/webauthn#1915 (8 comments by @emlun, @Firstyear, @r-jo)
-
Non-modal registration during conditional assertion w3c/webauthn#1929 (7 comments by @agl, @emlun, @MasterKale, @pascoej)
-
Indicate that the credential could be backed up and restored, but not synchronized w3c/webauthn#1933 (5 comments by @emlun, @Firstyear, @Kieun, @timcappalli)
-
TPM attestation verification steps inconsistent with FIDO conformance testing tool w3c/webauthn#1925 (4 comments by @emlun, @Firstyear, @sbweeden)
-
Clarify the need for truly randomly generated challenges (aka challenge callback issue) w3c/webauthn#1856 (3 comments by @dolda2000, @sbweeden)
-
Return public key in attestedCredentialData on authenticatorGetAssertion w3c/webauthn#1928 (2 comments by @emlun, @timcappalli)
-
Clarify browser behavior when an authenticators return equivalent of "InvalidStateError" w3c/webauthn#1888 (2 comments by @arnar)
-
Being able to access the same public key credentials across different domains w3c/webauthn#1827 (1 comment by @igorlogvin)
-
-
7 pull requests opened.
-
Clarify distinction between PublicKeyCredentialUserEntity name and displayName w3c/webauthn#1932, by @MasterKale.
-
Update Authenticator Definition w3c/webauthn#1931, by @nicksteele.
-
Add security consideration section "Validating the origin of a credential" w3c/webauthn#1930, by @emlun.
-
Clarify TPM attestation verification instructions w3c/webauthn#1926, by @sbweeden.
-
Add new getClientCapabilities method w3c/webauthn#1923, by @timcappalli.
-
Add missing fields in dictionaries for JSON representation w3c/webauthn#1920, by @Kieun.
-
Add missing fields in dictionaries for JSON representation w3c/webauthn#1919, by @Kieun.
-
-
1 pull request merged.
-
Add new isPasskeyPlatformAuthenticatorAvailable() method w3c/webauthn#1901.
-
-
1 pull request closed.
-
Add missing fields in dictionaries for JSON representation w3c/webauthn#1919.
-
-
10 pull requests received 61 new comments.
-
Add new getClientCapabilities method w3c/webauthn#1923 (19 comments by @agl, @emlun, @Firstyear, @Kieun, @MasterKale, @timcappalli)
-
Add new isPasskeyPlatformAuthenticatorAvailable() method w3c/webauthn#1901 (15 comments by @arianvp, @dagnelies, @devsnek, @Firstyear, @MasterKale, @maxhata, @nadalin, @timcappalli)
-
Address description of uses, and requirements for supplying userHandle w3c/webauthn#1914 (9 comments by @emlun, @Kieun, @MasterKale, @sbweeden)
-
Add a `hints` element for both `create` and `get`. w3c/webauthn#1884 (4 comments by @agl, @MasterKale)
-
Define RP processing of be and bs flags during `.create()` and `.get()` w3c/webauthn#1907 (3 comments by @MasterKale)
-
Clarify distinction between PublicKeyCredentialUserEntity name and displayName w3c/webauthn#1932 (2 comments by @MasterKale, @sbweeden)
-
Add missing fields in dictionaries for JSON representation w3c/webauthn#1919 (2 comments by @Kieun, @w3cbot)
-
Add security consideration section "Validating the origin of a credential" w3c/webauthn#1930 (1 comment by @emlun)
-
Past meetings
Participants
-
3 participants joined.
-
Charles Cunningham (Spruce Systems, Inc.) joined.
-
Ki-Eun Shin (W3C Invited Experts) joined.
-
zhilei zhang (360) joined.
-
-
2 participants left.
-
Sampath Srinivas (Google LLC) left.
-
Carey Ferro (Discover Financial Services LLC) left.
-
-
1 organization joined.
-
360 joined.
-
GitHub
w3c/webauthn
-
6 issues opened.
-
Misaligned steps in Section 7.2 w3c/webauthn#1913, by @ndpar.
-
Update Authenticator Taxonomy examples section w3c/webauthn#1912, by @timcappalli.
-
Ambiguous reference to [=Window=] w3c/webauthn#1910, by @emlun.
-
Revisit description of userHandle w3c/webauthn#1909, by @sbweeden.
-
Proposal/discussion: non-extractable CryptoKey output from the prf extension w3c/webauthn#1895, by @stephen.
-
-
2 issues closed.
-
Add topOrigin to clientData for cross-origin GET in iframe w3c/webauthn#1842.
-
-
9 issues reopened.
-
13 issues received 40 new comments.
-
Revisit description of userHandle w3c/webauthn#1909 (9 comments by @arianvp, @emlun, @Kieun, @MasterKale, @sbweeden)
-
Clarify how the given origin in the ClientDataJSON matches to the expected one w3c/webauthn#1889 (5 comments by @Kieun, @ndpar, @Ret1ge, @timcappalli)
-
Clarify the need for truly randomly generated challenges (aka challenge callback issue) w3c/webauthn#1856 (4 comments by @dolda2000, @sbweeden, @timurnkey, @ve7jtb)
-
Consider allowing cross-domain credential use w3c/webauthn#1372 (4 comments by @Mikescops, @nadalin, @sbweeden)
-
Proposal/discussion: non-extractable CryptoKey output from the prf extension w3c/webauthn#1895 (4 comments by @agl, @emlun, @MasterKale, @stephen)
-
Should timeout recommendations for clients be updated to cater for conditional mediation? w3c/webauthn#1908 (3 comments by @agl, @Kieun, @sbweeden)
-
Cross-origin credential creation in iframes w3c/webauthn#1656 (3 comments by @mangoplane, @timcappalli)
-
Clarify browser behavior when an authenticators return equivalent of "InvalidStateError" w3c/webauthn#1888 (1 comment by @MasterKale)
-
-
5 pull requests opened.
-
Address description of uses, and requirements for supplying userHandle w3c/webauthn#1914, by @sbweeden.
-
Disambiguate [=Window=] links as {{Window}} w3c/webauthn#1911, by @emlun.
-
Define RP processing of be and bs flags during `.create()` and `.get()` w3c/webauthn#1907, by @MasterKale.
-
Merge #1887 into main w3c/webauthn#1906, by @MasterKale.
-
Add new isPasskeyPlatformAuthenticatorAvailable() method w3c/webauthn#1901, by @timcappalli.
-
-
5 pull requests merged.
-
add client processing for topOrigin w3c/webauthn#1891.
-
Merge #1887 into main w3c/webauthn#1906.
-
Include the "Easily accessing credential data" fields in JSON. w3c/webauthn#1887.
-
Mike is independent w3c/webauthn#1893.
-
Update Nick Contact info w3c/webauthn#1894.
-
-
8 pull requests received 66 new comments.
-
Add new isPasskeyPlatformAuthenticatorAvailable() method w3c/webauthn#1901 (44 comments by @arianvp, @dagnelies, @emlun, @Firstyear, @Kieun, @ko-koiwai, @MasterKale, @ndpar, @nicksteele, @timcappalli, @ve7jtb)
-
Define RP processing of be and bs flags during `.create()` and `.get()` w3c/webauthn#1907 (6 comments by @emlun, @MasterKale)
-
Add authenticatorDisplayName to credProps w3c/webauthn#1880 (5 comments by @Firstyear, @Kieun, @MasterKale, @sbweeden, @timcappalli)
-
Include the "Easily accessing credential data" fields in JSON. w3c/webauthn#1887 (2 comments by @emlun)
-
Add a `hints` element for both `create` and `get`. w3c/webauthn#1884 (2 comments by @Firstyear, @MasterKale)
-
Address description of uses, and requirements for supplying userHandle w3c/webauthn#1914 (1 comment by @sbweeden)
-
Past meetings
Participants
-
2 participants joined.
-
Abigail Fox (Apple Inc.) joined.
-
Michael Jones (W3C Invited Experts) joined.
-
-
2 participants left.
-
Arlen Yan (Keeper Security Inc.) left.
-
Craig Lurey (Keeper Security Inc.) left.
-
-
1 organization left.
-
Keeper Security Inc. left.
-
GitHub
w3c/webauthn
-
5 issues opened.
-
Require non-null userHandle when allowCredentials is empty? w3c/webauthn#1892, by @emlun.
-
Add Changed Flag to UVM Entry w3c/webauthn#1890, by @ranjivaprasadvisa.
-
Clarify how the given origin in the ClientDataJSON matches to the expected one w3c/webauthn#1889, by @Kieun.
-
Clarify browser behavior when an authenticators return equivalent of "InvalidStateError" w3c/webauthn#1888, by @arnar.
-
Adjust timeout for create and get operations w3c/webauthn#1886, by @akshayku.
-
-
2 issues closed.
-
Adjust timeout for create and get operations w3c/webauthn#1886.
-
User verification policy leads to ambiguous usage situations. w3c/webauthn#1510.
-
-
7 issues received 35 new comments.
-
Which "pubKeyCredParams" to use? w3c/webauthn#1757 (9 comments by @dagnelies, @emlun, @MasterKale, @petrdvorak)
-
Require non-null userHandle when allowCredentials is empty? w3c/webauthn#1892 (7 comments by @arianvp, @emlun, @Kieun, @MasterKale, @ndpar)
-
Add Changed Flag to UVM Entry w3c/webauthn#1890 (6 comments by @emlun, @Kieun, @ranjivaprasadvisa, @ve7jtb)
-
Clarify how the given origin in the ClientDataJSON matches to the expected one w3c/webauthn#1889 (5 comments by @james-d-elliott, @Kieun, @MasterKale, @ndpar)
-
Clarify browser behavior when an authenticators return equivalent of "InvalidStateError" w3c/webauthn#1888 (4 comments by @akshayku, @arnar, @emlun, @MasterKale)
-
Add topOrigin to clientData for cross-origin GET in iframe w3c/webauthn#1842 (2 comments by @Kieun, @timcappalli)
-
Should an RP be able to provide finer grained authenticator filtering in attestation options? w3c/webauthn#1688 (2 comments by @agl, @emlun)
-
-
6 pull requests opened.
-
Update Nick Contact info w3c/webauthn#1894, by @nicksteele.
-
Mike is independent w3c/webauthn#1893, by @selfissued.
-
add client processing for topOrigin w3c/webauthn#1891, by @timcappalli.
-
Include the "Easily accessing credential data" fields in JSON. w3c/webauthn#1887, by @agl.
-
Adjust timeout for create and get operations w3c/webauthn#1885, by @akshayku.
-
Add a `hints` element for both `create` and `get`. w3c/webauthn#1884, by @agl.
-
-
3 pull requests merged.
-
Adjust timeout for create and get operations w3c/webauthn#1885.
-
Mark all JSON fields as required. w3c/webauthn#1878.
-
Improve guidance around using UV w3c/webauthn#1774.
-
-
6 pull requests received 51 new comments.
-
Add a `hints` element for both `create` and `get`. w3c/webauthn#1884 (27 comments by @agl, @denniskniep, @emlun, @Firstyear, @Kieun, @MasterKale, @timcappalli)
-
Include the "Easily accessing credential data" fields in JSON. w3c/webauthn#1887 (13 comments by @agl, @emlun, @MasterKale)
-
Add authenticatorDisplayName to credProps w3c/webauthn#1880 (6 comments by @emlun, @Firstyear, @hpsin, @irew, @Kieun)
-
Past meetings
Participants
-
2 participants joined.
-
Laszlo Gombos (Samsung Electronics Co., Ltd.) joined.
-
Yusi Zhang (Google LLC) joined.
-
-
1 participant left.
-
Michael Jones (W3C Invited Experts) left.
-
GitHub
w3c/webauthn
-
4 issues closed.
-
Add "smart-card" to AuthenticatorTransport enum (WebKit) w3c/webauthn#1835.
-
Credential discovery is unclear w3c/webauthn#1789.
-
Possibility to filter displayed authenticators by certified level w3c/webauthn#1816.
-
Variable reference issue in DPK processing rules w3c/webauthn#1817.
-
-
10 issues received 22 new comments.
-
"android-key" and "android-safetynet" are really basic attestation type support? w3c/webauthn#1819 (8 comments by @agl, @arianvp, @divegeek, @Kieun, @thestinger)
-
Cross-origin credential creation in iframes w3c/webauthn#1656 (2 comments by @spencercap, @stephenmcgruer)
-
Enforce backup eligibility during assertion w3c/webauthn#1791 (2 comments by @Firstyear, @MasterKale)
-
Should an RP be able to provide finer grained authenticator filtering in attestation options? w3c/webauthn#1688 (1 comment by @denniskniep)
-
Possibility to filter displayed authenticators by certified level w3c/webauthn#1816 (1 comment by @nicksteele)
-
-
3 pull requests opened.
-
Add authenticatorDisplayName to credProps w3c/webauthn#1880, by @emlun.
-
add topOrigin verification logic for get w3c/webauthn#1879, by @timcappalli.
-
Mark all JSON fields as required. w3c/webauthn#1878, by @agl.
-
-
2 pull requests merged.
-
add topOrigin verification logic for get w3c/webauthn#1879.
-
Add smart-card to transports enum w3c/webauthn#1865.
-
-
3 pull requests received 34 new comments.
-
Add authenticatorDisplayName to credProps w3c/webauthn#1880 (18 comments by @arnar, @emlun, @Firstyear, @hpsin, @Kieun, @MasterKale, @ndpar)
-
Past meetings
Participants
-
3 participants joined.
-
Dongwoo Joshua Im (Samsung Electronics Co., Ltd.) joined.
-
Junseok Lee (Samsung Electronics Co., Ltd.) joined.
-
Nayoung Kang (Samsung Electronics Co., Ltd.) joined.
-
-
2 participants left.
-
Ian Perez (Sonr) left.
-
Brayden Cloud (Sonr) left.
-
-
1 organization joined.
-
Samsung Electronics Co., Ltd. joined.
-
GitHub
w3c/webauthn
-
4 issues opened.
-
Move isConditionalMediationAvailable to its own section like isUVPAA? w3c/webauthn#1867, by @emlun.
-
WebAuthn Autofill (Conditional UI) for credential registration w3c/webauthn#1862, by @nov.
-
Update step references in RP operations w3c/webauthn#1861, by @emlun.
-
Ambiguous for-less link for 'grapheme cluster' w3c/webauthn#1860, by @emlun.
-
-
10 issues closed.
-
Move isConditionalMediationAvailable to its own section like isUVPAA? w3c/webauthn#1867.
-
WebAuthn Autofill (Conditional UI) for credential registration w3c/webauthn#1862.
-
PRF inputs should be BufferSource instead of ArrayBuffer w3c/webauthn#1851.
-
Ambiguous for-less link for 'grapheme cluster' w3c/webauthn#1860.
-
Update step references in RP operations w3c/webauthn#1861.
-
Move step 16 of Registration to between 21 and 22 w3c/webauthn#1555.
-
Redundant step 6 in DPK verification for authentication w3c/webauthn#1853.
-
Always PRF enabled:false w3c/webauthn#1857.
-
Questions about user handle when supporting usernameless w3c/webauthn#1559.
-
How to declare that a registration only awaits for a Security Key? w3c/webauthn#1750.
-
-
1 issue reopened.
-
10 issues received 32 new comments.
-
WebAuthn Autofill (Conditional UI) for credential registration w3c/webauthn#1862 (14 comments by @emlun, @Kieun, @MasterKale, @nov, @nsatragno, @serianox, @timcappalli)
-
Allow conditional and modal flows to run simultaneously w3c/webauthn#1854 (6 comments by @MasterKale, @nsatragno, @sbweeden)
-
Spec abstract is out of date on the eve of multi-device credentials and cross-device auth w3c/webauthn#1743 (4 comments by @MasterKale, @vonDubenshire)
-
Move isConditionalMediationAvailable to its own section like isUVPAA? w3c/webauthn#1867 (1 comment by @emlun)
-
RP operations: some extension processing may assume that the encompassing signature is valid w3c/webauthn#1711 (1 comment by @emlun)
-
Questions about user handle when supporting usernameless w3c/webauthn#1559 (1 comment by @MasterKale)
-
-
3 pull requests opened.
-
Add smart-card to transports enum w3c/webauthn#1865, by @pascoej.
-
Add links to and update all numbered step references w3c/webauthn#1864, by @emlun.
-
Use i18n-glossary definition of [=grapheme cluster=] w3c/webauthn#1863, by @emlun.
-
-
5 pull requests merged.
-
Only expose the UV PRF w3c/webauthn#1836.
-
Use i18n-glossary definition of [=grapheme cluster=] w3c/webauthn#1863.
-
Add links to and update all numbered step references w3c/webauthn#1864.
-
Remove redundant extra step in DPK processing. w3c/webauthn#1858.
-
Allow for credential creation in a cross-origin iframe w3c/webauthn#1801.
-
-
5 pull requests received 14 new comments.
-
Allow for credential creation in a cross-origin iframe w3c/webauthn#1801 (3 comments by @emlun, @ndpar, @nsatragno)
Past meetings
Participants
-
2 participants joined.
-
Anders Aberg (Bitwarden) joined.
-
Kyle Spearrin (Bitwarden) joined.
-
-
3 participants left.
-
Inactive Inactive (Sonr) left.
-
Nicholas Tindle (Sonr) left.
-
Wendy Seltzer (W3C) left.
-
-
1 organization joined.
-
Bitwarden joined.
-
GitHub
w3c/webauthn
-
8 issues opened.
-
Clarify how to differentiate between exceptions w3c/webauthn#1859, by @dolda2000.
-
Always PRF enabled:false w3c/webauthn#1857, by @kksingla.
-
Allow conditional and modal flows to run simultaneously w3c/webauthn#1854, by @dolda2000.
-
Redundant step 6 in DPK verification for authentication w3c/webauthn#1853, by @ndpar.
-
Emphasize use of `user.name` for RP's to help users distinguish credentials w3c/webauthn#1852, by @MasterKale.
-
PRF inputs should be BufferSource instead of ArrayBuffer w3c/webauthn#1851, by @emlun.
-
How long the relying party should maintain the challenge and related information? w3c/webauthn#1848, by @Kieun.
-
-
4 issues closed.
-
Differentiate when devicePubKey unsupported vs. failed? w3c/webauthn#1846.
-
Use aPAKE/OPAQUE for FIDO multi-device credentials (PassKey) w3c/webauthn#1747.
-
Split the standard by focus driven use cases. w3c/webauthn#1751.
-
Which "pubKeyCredParams" to use? w3c/webauthn#1757.
-
-
13 issues received 65 new comments.
-
Clarify the need for truly randomly generated challenges (aka challenge callback issue) w3c/webauthn#1856 (18 comments by @agl, @arianvp, @dolda2000, @emlun, @Firstyear, @MasterKale, @sbweeden, @serianox)
-
Emphasize use of `user.name` for RP's to help users distinguish credentials w3c/webauthn#1852 (11 comments by @emlun, @Firstyear, @james-d-elliott, @MasterKale, @ve7jtb)
-
How long the relying party should maintain the challenge and related information? w3c/webauthn#1848 (9 comments by @dolda2000, @Kieun, @MasterKale, @sbweeden, @timcappalli)
-
PRF inputs should be BufferSource instead of ArrayBuffer w3c/webauthn#1851 (8 comments by @agl, @emlun, @Firstyear)
-
Redundant step 6 in DPK verification for authentication w3c/webauthn#1853 (5 comments by @agl, @emlun, @ndpar)
-
Differentiate when devicePubKey unsupported vs. failed? w3c/webauthn#1846 (2 comments by @agl, @emlun)
-
Allow conditional and modal flows to run simultaneously w3c/webauthn#1854 (2 comments by @emlun, @FlxMgdnz)
-
Use aPAKE/OPAQUE for FIDO multi-device credentials (PassKey) w3c/webauthn#1747 (1 comment by @emlun)
-
Provide a way for an RP to set an intention to offer more user friendly UX w3c/webauthn#1823 (1 comment by @Kieun)
-
-
4 pull requests opened.
-
Remove redundant extra step in DPK processing. w3c/webauthn#1858, by @agl.
-
Recommend duration of challenge validity w3c/webauthn#1855, by @emlun.
-
Create SECURITY.md w3c/webauthn#1850, by @carlena3497.
-
Create SECURITY.md w3c/webauthn#1849, by @carlena3497.
-
-
2 pull requests merged.
-
Issue 1817 w3c/webauthn#1845.
-
Define discrete list of pubKeyCredParams algs w3c/webauthn#1843.
-
-
2 pull requests closed.
-
Create SECURITY.md w3c/webauthn#1850.
-
Create SECURITY.md w3c/webauthn#1849.
-
-
5 pull requests received 38 new comments.
-
Allow for credential creation in a cross-origin iframe w3c/webauthn#1801 (31 comments by @agl, @akshayku, @emlun, @stephenmcgruer, @timcappalli)
-
Past meetings
Participants
-
1 Team contact appointed.
-
Philippe Le Hegaret became a Team contact.
-
-
1 Team contact stepped down.
-
Wendy Seltzer stepped down as a Team contact.
-
-
3 participants joined.
-
Ricardo Iván Vieitez Parra (Apeleg Limited) joined.
-
Mert Coskuner (Yahoo Holdings Inc.) joined.
-
Philippe Le Hegaret (W3C) joined.
-
-
2 participants left.
-
Samuel Weiler (W3C) left.
-
Callum May (Microsoft Corporation) left.
-
-
1 organization joined.
-
Apeleg Limited joined.
-
GitHub
w3c/webauthn
-
4 issues opened.
-
Differentiate when devicePubKey unsupported vs. failed? w3c/webauthn#1846, by @emlun.
-
Individual Certificate Authority for credential management and recovery w3c/webauthn#1844, by @EliRibble.
-
Add topOrigin to clientData for cross-origin GET in iframe w3c/webauthn#1842, by @timcappalli.
-
-
7 issues closed.
-
Provide a way for an RP to set an intention to offer more user friendly UX w3c/webauthn#1823.
-
Individual Certificate Authority for credential management and recovery w3c/webauthn#1844.
-
Support for FIDO passkey with HMAC-Secret extension w3c/webauthn#1830.
-
residentKey: "preferred-if-unlimited"? w3c/webauthn#1822.
-
Attestation on Get Assertion w3c/webauthn#1741.
-
Assertion signatures: raw or ASN.1 wrapped? w3c/webauthn#1829.
-
-
1 issue reopened.
-
residentKey: "preferred-if-unlimited"? w3c/webauthn#1822, by @emlun.
-
-
13 issues received 85 new comments.
-
residentKey: "preferred-if-unlimited"? w3c/webauthn#1822 (44 comments by @agl, @emlun, @Firstyear, @FlxMgdnz, @MasterKale, @My1, @ndpar, @sbweeden, @serianox, @timcappalli, @ve7jtb)
-
Support for FIDO passkey with HMAC-Secret extension w3c/webauthn#1830 (10 comments by @agl, @akshayku, @arianvp, @maccman, @MasterKale, @Progdrasil)
-
Individual Certificate Authority for credential management and recovery w3c/webauthn#1844 (7 comments by @EliRibble, @Firstyear, @timcappalli)
-
Provide a way for an RP to set an intention to offer more user friendly UX w3c/webauthn#1823 (5 comments by @Firstyear, @Kieun, @nicksteele, @timcappalli)
-
"android-key" and "android-safetynet" are really basic attestation type support? w3c/webauthn#1819 (4 comments by @arnar, @Kieun)
-
Add "smart-card" to AuthenticatorTransport enum (WebKit) w3c/webauthn#1835 (3 comments by @micolous, @serianox)
-
Can the private keys be used for other cryptographic operations? w3c/webauthn#1595 (2 comments by @earonesty, @timcappalli)
-
Spelling mistake expecially in 1.1 https://www.w3.org/TR/2019/REC-webauthn-1-20190304/#spec-roadmap w3c/webauthn#1841 (1 comment by @emlun)
-
-
3 pull requests opened.
-
Issue 1817 w3c/webauthn#1845, by @sbweeden.
-
Define discrete list of pubKeyCredParams algs w3c/webauthn#1843, by @MasterKale.
-
Only expose the UV PRF w3c/webauthn#1836, by @agl.
-
-
1 pull request merged.
-
Use credential record abstraction in devicePubKey extension w3c/webauthn#1812.
-
-
4 pull requests received 29 new comments.
-
Only expose the UV PRF w3c/webauthn#1836 (9 comments by @agl, @akshayku, @emlun, @Firstyear, @MasterKale)
-
Use credential record abstraction in devicePubKey extension w3c/webauthn#1812 (6 comments by @emlun, @timcappalli)
-
Allow for credential creation in a cross-origin iframe w3c/webauthn#1801 (5 comments by @stephenmcgruer, @timcappalli)