Web Authentication Working Group - Activity in 2024
No matches.
Past meetings
GitHub
w3c/webauthn
-
2 issues opened.
-
HTML-only webauthn w3c/webauthn#2220, by @sycamoreoak.
-
7 issues closed.
-
Missing Test Vectors w3c/webauthn#1633.
-
Replace `USVString` with `DOMString` w3c/webauthn#2203.
-
HTML-only webauthn w3c/webauthn#2220.
-
Should steps 28 and 29 occur before Step 27 in the registration ceremony w3c/webauthn#2204.
-
AttestationFormats may have duplicate entries w3c/webauthn#2202.
-
Compound attestation statement format is incompatible with attStmtTemplate w3c/webauthn#2210.
-
Incorrect references to File API w3c/webauthn#2212.
-
-
4 issues received 12 new comments.
-
Add a way to use webauthn without Javascript w3c/webauthn#1255 (2 comments by @MasterKale, @sycamoreoak)
-
3 pull requests opened.
-
Fix AuthenticationExtensionsAuthenticatorInputs/Outputs CDDL w3c/webauthn#2221, by @emlun.
-
Fix AuthenticationExtensionsAuthenticatorInputs/Outputs CDDL w3c/webauthn#2219, by @tidoust.
-
Link "Object" to WebDriver instead of File API w3c/webauthn#2218, by @emlun.
-
-
7 pull requests merged.
-
Add test vectors w3c/webauthn#2209.
-
Make remaining `USVString`s `DOMString`s w3c/webauthn#2217.
-
Fix AuthenticationExtensionsAuthenticatorInputs/Outputs CDDL w3c/webauthn#2221.
-
Store/update credential record last in RP ops w3c/webauthn#2215.
-
Clarify behaviour of duplicate pubKeyCredParams and attestationFormats w3c/webauthn#2214.
-
Fix CDDL inconsistencies in attStmtType and compound format w3c/webauthn#2216.
-
Link "Object" to WebDriver instead of File API w3c/webauthn#2218.
-
-
4 pull requests received 4 new comments.
-
Fix AuthenticationExtensionsAuthenticatorInputs/Outputs CDDL w3c/webauthn#2221 (1 comment by @tidoust)
Past meetings
Participants
-
3 participants joined.
-
James L1 (NCSC) joined.
-
Colin Whorlow (NCSC) joined.
-
Kaushik Satpathy (Yahoo Holdings Inc.) joined.
-
-
1 participant left.
-
Alex Radutskiy (MSFT) (Microsoft Corporation) left.
-
-
1 organization joined.
-
NCSC joined.
-
GitHub
w3c/webauthn
-
12 issues opened.
-
`credProps` output directions contradict notes w3c/webauthn#2213, by @zacknewman.
-
Incorrect references to File API w3c/webauthn#2212, by @annevk.
-
CR: Need a way to detect "cancel" w3c/webauthn#2211, by @hemanth.
-
Compound attestation statement format is incompatible with attStmtTemplate w3c/webauthn#2210, by @emlun.
-
"Verify" is undefined w3c/webauthn#2208, by @annevk.
-
JSON parsing should be on top of Infra primitives w3c/webauthn#2207, by @annevk.
-
Use of "valid domain" seems wrong w3c/webauthn#2206, by @annevk.
-
Usage of "effective domain" seems wrong w3c/webauthn#2205, by @annevk.
-
Should steps 28 and 29 occur before Step 27 in the registration ceremony w3c/webauthn#2204, by @zacknewman.
-
Replace `USVString` with `DOMString` w3c/webauthn#2203, by @zacknewman.
-
AttestationFormats may have duplicate entries w3c/webauthn#2202, by @Kieun.
-
-
8 issues closed.
-
CR: Need a way to detect "cancel" w3c/webauthn#2211.
-
Make `AuthenticatorAttestationResponseJSON.publicKeyAlgorithm` optional w3c/webauthn#2106.
-
[[Get]] method doesn't exist in CredMan w3c/webauthn#2169.
-
authenticatorDisplayName should use a localizable language map w3c/webauthn#2151.
-
Remove authenticatorDisplayName from L3 w3c/webauthn#2187.
-
-
19 issues received 41 new comments.
-
Usage of "effective domain" seems wrong w3c/webauthn#2205 (4 comments by @agl, @annevk, @nicksteele)
-
JSON parsing should be on top of Infra primitives w3c/webauthn#2207 (4 comments by @annevk, @emlun, @timcappalli)
-
CR: Need a way to detect "cancel" w3c/webauthn#2211 (3 comments by @hemanth, @nsatragno, @timcappalli)
-
Handling of non-fully active documents for PublicKeyCredential methods w3c/webauthn#2184 (2 comments by @nsatragno)
-
Bit set by the SPC extension should backed up as part of the Public Key Credential Source w3c/webauthn#2153 (2 comments by @timcappalli)
-
WebAuthn Clients should NOT zero out AAGUIDs from security keys when attestation is none w3c/webauthn#2198 (2 comments by @emlun, @zacknewman)
-
The authenticator may hide the credential even if the RP signals unknown credentials w3c/webauthn#2192 (2 comments by @Kieun, @nsatragno)
-
Make `AuthenticatorAttestationResponseJSON.publicKeyAlgorithm` optional w3c/webauthn#2106 (1 comment by @emlun)
-
Should steps 28 and 29 occur before Step 27 in the registration ceremony w3c/webauthn#2204 (1 comment by @sbweeden)
-
authenticatorDisplayName should use a localizable language map w3c/webauthn#2151 (1 comment by @emlun)
-
TPM attestation verification steps inconsistent with FIDO conformance testing tool w3c/webauthn#1925 (1 comment by @sbweeden)
-
12 pull requests opened.
-
Make remaining `USVString`s `DOMString`s w3c/webauthn#2217, by @zacknewman.
-
Fix CDDL inconsistencies in attStmtType and compound format w3c/webauthn#2216, by @emlun.
-
Store/update credential record last in RP ops w3c/webauthn#2215, by @emlun.
-
Clarify behaviour of duplicate pubKeyCredParams and attestationFormats w3c/webauthn#2214, by @emlun.
-
Add test vectors w3c/webauthn#2209, by @emlun.
-
Merge pull request #2186 from w3c/tc-relatedorigins-tweaks w3c/webauthn#2201, by @agl.
-
chore: Small tweak to PR template w3c/webauthn#2200, by @timcappalli.
-
WebAuthn Clients should NOT zero out AAGUIDs from security keys when attestation is none w3c/webauthn#2199, by @ve7jtb.
-
Merge branch 'level3' into branch 'main' w3c/webauthn#2197, by @emlun.
-
Make NOTEs non-normative w3c/webauthn#2196, by @emlun.
-
Drop outdated "Issue 1" from spec w3c/webauthn#2195, by @emlun.
-
Delete authenticatorDisplayName w3c/webauthn#2194, by @emlun.
-
-
8 pull requests merged.
-
Merge branch 'level3' into branch 'main' w3c/webauthn#2197.
-
chore: Small tweak to PR template w3c/webauthn#2200.
-
Drop outdated "Issue 1" from spec w3c/webauthn#2195.
-
Delete authenticatorDisplayName w3c/webauthn#2194.
-
Mozilla feedback: Related Origins w3c/webauthn#2186.
-
Clarify use creating and verifying TPM attestation statements. w3c/webauthn#2193.
-
Move extension processing to after signature verification, and modernize it w3c/webauthn#2167.
-
-
1 pull request closed.
-
Merge pull request #2186 from w3c/tc-relatedorigins-tweaks w3c/webauthn#2201.
-
-
6 pull requests received 19 new comments.
-
Clarify use creating and verifying TPM attestation statements. w3c/webauthn#2193 (6 comments by @mwiseman-byid, @nadalin, @sbweeden, @simoneonofri)
-
Merge pull request #2186 from w3c/tc-relatedorigins-tweaks w3c/webauthn#2201 (3 comments by @agl, @emlun, @timcappalli)
-
WebAuthn Clients should NOT zero out AAGUIDs from security keys when attestation is none w3c/webauthn#2199 (1 comment by @emlun)
-
Past meetings
Participants
-
4 participants joined.
-
Monty Wiseman (W3C Invited Experts) joined.
-
Ravikanth Reddy Gudipati (PayPal) joined.
-
Haribalu V (PayPal) joined.
-
Bob Gilbert (Microsoft Corporation) joined.
-
-
1 organization joined.
-
PayPal joined.
-
GitHub
w3c/webauthn
-
11 issues opened.
-
The authenticator may hide the credential even if the RP signals unknown credentials w3c/webauthn#2192, by @Kieun.
-
[spam] w3c/webauthn#2190, by @david1234121.
-
[spam] w3c/webauthn#2189, by @david1234121.
-
Remove authenticatorDisplayName from L3 w3c/webauthn#2187, by @timcappalli.
-
Handling of non-fully active documents for PublicKeyCredential methods w3c/webauthn#2184, by @nsatragno.
-
Add cautionary note about extension data in the ceremony criteria w3c/webauthn#2177, by @zacknewman.
-
Should race condition be added as a reason for a signature counter not increasing? w3c/webauthn#2172, by @zacknewman.
-
Acknowledge @zacknewman's contributions w3c/webauthn#2170, by @emlun.
-
[[Get]] method doesn't exist in CredMan w3c/webauthn#2169, by @emlun.
-
[Editorial] platform authenticator relationship to WebAuthn Client and Client Device w3c/webauthn#2164, by @timcappalli.
-
-
15 issues closed.
-
Add cautionary note about extension data in the ceremony criteria w3c/webauthn#2177.
-
Repo w3c/webauthn#2191.
-
CollectedClientData.crossOrigin not referenced in RP ops w3c/webauthn#2113.
-
[spam] w3c/webauthn#2190.
-
[spam] w3c/webauthn#2189.
-
create() and get() return an algorithm, not a credential w3c/webauthn#1984.
-
Add examples for PRF extension w3c/webauthn#2088.
-
U+ notation incorrect w3c/webauthn#1641.
-
Deprecate rp.name w3c/webauthn#2121.
-
Authentication ceremony `options.publicKey` has the wrong hyperlink w3c/webauthn#2160.
-
Acknowledge @zacknewman's contributions w3c/webauthn#2170.
-
Misaligned steps in Section 7.2 w3c/webauthn#1913.
-
-
13 issues received 42 new comments.
-
Should race condition be added as a reason for a signature counter not increasing? w3c/webauthn#2172 (7 comments by @Firehed, @nsatragno, @sbweeden, @zacknewman)
-
The authenticator may hide the credential even if the RP signals unknown credentials w3c/webauthn#2192 (6 comments by @Kieun, @timcappalli)
-
[Editorial] platform authenticator relationship to WebAuthn Client and Client Device w3c/webauthn#2164 (4 comments by @emlun, @timcappalli)
-
Cross-window `Virtual Authenticator Database` w3c/webauthn#2117 (3 comments by @0xbuidler, @nsatragno)
-
Should credentials requested with attestation=none include an AAGUID? w3c/webauthn#1962 (2 comments by @nicksteele, @zacknewman)
-
Bit set by the SPC extension should backed up as part of the Public Key Credential Source w3c/webauthn#2153 (1 comment by @dwaite)
-
17 pull requests opened.
-
Clarify use creating and verifying TPM attestation statements. w3c/webauthn#2193, by @mwiseman-byid.
-
Mozilla feedback: Related Origins w3c/webauthn#2186, by @timcappalli.
-
Add warning about sending PRF outputs to server w3c/webauthn#2183, by @emlun.
-
Fix typo in reference to variable |effectiveDomain| w3c/webauthn#2182, by @emlun.
-
Drop definition "User Credential" unused since PR #2109 w3c/webauthn#2181, by @emlun.
-
Remove apparent reference to non-existent [[Get]] internal method w3c/webauthn#2180, by @emlun.
-
Extract macros for referring to [[Create]] and [[DiscoverFromExternalSource]] w3c/webauthn#2179, by @emlun.
-
Add note about possible sensitive data in extensions w3c/webauthn#2178, by @zacknewman.
-
Non-incrementing signature counters could be due to race condition w3c/webauthn#2176, by @sbweeden.
-
Fix encoding and syntax highlighting of example code w3c/webauthn#2175, by @emlun.
-
Add test vectors for PRF extension w3c/webauthn#2174, by @emlun.
-
Acknowledge Zack Newman for reviews and contributions w3c/webauthn#2173, by @emlun.
-
Acknowledge Simone Onofri and Philippe Le Hégaret as W3C Team Contacts w3c/webauthn#2171, by @emlun.
-
Don't return an algorithm from [[DiscoverFromExternalSource]] w3c/webauthn#2168, by @emlun.
-
Move extension processing to after signature verification, and modernize it w3c/webauthn#2167, by @emlun.
-
Validate CollectedClientData.crossOrigin in RP ops w3c/webauthn#2166, by @emlun.
-
Fix Unicode example syntax w3c/webauthn#2165, by @emlun.
-
-
18 pull requests merged.
-
Add warning about sending PRF outputs to server w3c/webauthn#2183.
-
Validate CollectedClientData.crossOrigin in RP ops w3c/webauthn#2166.
-
Add [credential record/authenticatorDisplayName] handling to RP operations w3c/webauthn#2163.
-
Non-incrementing signature counters could be due to race condition w3c/webauthn#2176.
-
Drop definition "User Credential" unused since PR #2109 w3c/webauthn#2181.
-
Fix typo in reference to variable |effectiveDomain| w3c/webauthn#2182.
-
Don't return an algorithm from [[DiscoverFromExternalSource]] w3c/webauthn#2168.
-
Add test vectors for PRF extension w3c/webauthn#2174.
-
Fix encoding and syntax highlighting of example code w3c/webauthn#2175.
-
Remove apparent reference to non-existent [[Get]] internal method w3c/webauthn#2180.
-
Fix Unicode example syntax w3c/webauthn#2165.
-
Deprecate rp.name w3c/webauthn#2159.
-
Mark Android SafetyNet attestation as deprecated. w3c/webauthn#2155.
-
Fix CredentialRequestOptions hyperlink w3c/webauthn#2161.
-
Acknowledge Simone Onofri and Philippe Le Hégaret as W3C Team Contacts w3c/webauthn#2171.
-
Acknowledge Zack Newman for reviews and contributions w3c/webauthn#2173.
-
Add userName and userDisplayName to webdriver w3c/webauthn#2148.
-
-
1 pull request closed.
-
Add note about possible sensitive data in extensions w3c/webauthn#2178.
-
-
15 pull requests received 55 new comments.
-
Add test vectors for PRF extension w3c/webauthn#2174 (9 comments by @agl, @emlun, @Firehed, @zacknewman)
-
Clarify use creating and verifying TPM attestation statements. w3c/webauthn#2193 (7 comments by @emlun, @sbweeden, @simoneonofri)
-
Mark Android SafetyNet attestation as deprecated. w3c/webauthn#2155 (6 comments by @emlun, @Firehed, @MasterKale)
-
Add warning about sending PRF outputs to server w3c/webauthn#2183 (4 comments by @emlun, @timcappalli)
-
Non-incrementing signature counters could be due to race condition w3c/webauthn#2176 (4 comments by @emlun, @nsatragno, @sbweeden, @zacknewman)
-
Move extension processing to after signature verification, and modernize it w3c/webauthn#2167 (3 comments by @emlun, @zacknewman)
-
Remove apparent reference to non-existent [[Get]] internal method w3c/webauthn#2180 (3 comments by @emlun, @nsatragno)
-
Validate CollectedClientData.crossOrigin in RP ops w3c/webauthn#2166 (2 comments by @emlun, @sbweeden)
-
Add [credential record/authenticatorDisplayName] handling to RP operations w3c/webauthn#2163 (1 comment by @MasterKale)
-
Past meetings
-
5 meetings.
Participants
-
1 participant left.
-
Tara Whalen (Cloudflare) left.
-
GitHub
w3c/webauthn
-
13 issues opened.
-
Authentication ceremony `options.publicKey` has the wrong hyperlink w3c/webauthn#2160, by @zacknewman.
-
Reconciling with FedCM errors w3c/webauthn#2158, by @npm1.
-
Add AAGUID to credProps w3c/webauthn#2157, by @timcappalli.
-
Add `challengeUrl` w3c/webauthn#2152, by @nsatragno.
-
authenticatorDisplayName should use a localizable language map w3c/webauthn#2151, by @timcappalli.
-
Mustafacco w3c/webauthn#2147, by @ghost.
-
Allow Conditional Mediation without autofill w3c/webauthn#2144, by @kenrb.
-
Add dfn for passkey in passkey platform authenticator w3c/webauthn#2136, by @timcappalli.
-
Clarify behaviour of duplicate hints w3c/webauthn#2135, by @emlun.
-
-
23 issues closed.
-
Reconciling with FedCM errors w3c/webauthn#2158.
-
undefined terms and terms we really ought to define w3c/webauthn#462.
-
Minor cleanups from PR 1270 review w3c/webauthn#1291.
-
Requesting properties of created credentials. w3c/webauthn#1449.
-
Adding info about HSTS for the RPID to client Data. w3c/webauthn#1554.
-
Cross origin authentication without iframes (accommodating SPC in WebAuthn) w3c/webauthn#1667.
-
Syncing Platform Keys, Recoverability and Security levels w3c/webauthn#1640.
-
Possible experiences in a future WebAuthn w3c/webauthn#1637.
-
Cross-origin credential creation in iframes w3c/webauthn#1656.
-
Allow desired attestation format to be an ordered list w3c/webauthn#1917.
-
Describe packed enterprise attestation w3c/webauthn#1916.
-
Review privacy concerns around error conditions w3c/webauthn#2132.
-
Clarify behaviour of duplicate hints w3c/webauthn#2135.
-
Rename PublicKeyCredentialHints to PublicKeyCredentialHint? w3c/webauthn#2112.
-
Mustafacco w3c/webauthn#2147.
-
Add `topOrigin` to the limited verification algorithm w3c/webauthn#2102.
-
Add dfn for passkey in passkey platform authenticator w3c/webauthn#2136.
-
Editorial convention: Semantic line breaks w3c/webauthn#2045.
-
§6.1. Steps to generate authenticator data should include BE and BS flags w3c/webauthn#2064.
-
Should enterprise attestation support be flagged explicitly? w3c/webauthn#1742.
-
-
36 issues received 83 new comments.
-
Allow Conditional Mediation without autofill w3c/webauthn#2144 (17 comments by @agl, @emlun, @Firehed, @gioele-antoci, @kenrb, @MasterKale, @nsatragno, @pascoej, @sbweeden)
-
Add `challengeUrl` w3c/webauthn#2152 (9 comments by @agl, @arianvp, @emlun, @kenrb, @MasterKale, @nsatragno, @zacknewman)
-
authenticatorDisplayName should use a localizable language map w3c/webauthn#2151 (5 comments by @aphillips, @emlun, @zacknewman)
-
Should credentials requested with attestation=none include an AAGUID? w3c/webauthn#1962 (4 comments by @nicksteele, @pascoej, @zacknewman)
-
Add `authenticatorDisplayName` to Step 27 and Step 23 of the registration and authentication ceremonies respectively w3c/webauthn#2156 (3 comments by @emlun, @timcappalli, @zacknewman)
-
Allow `platform`-based self attestation with non-zero AAGUID when `AttestationConveyancePreferenceOption` `"none"` is used w3c/webauthn#2146 (3 comments by @pascoej, @zacknewman)
-
Requiring user activation to call WebAuthn API w3c/webauthn#1293 (3 comments by @gioele-antoci, @HK9-questions, @sbweeden)
-
Cross-window `Virtual Authenticator Database` w3c/webauthn#2117 (2 comments by @0xbuidler, @pascoej)
-
Unicode "tag" characters are deprecated for language tagging w3c/webauthn#1642 (1 comment by @aphillips)
-
Mechanism for encoding *direction* metadata may need more work w3c/webauthn#1644 (1 comment by @aphillips)
-
Bit set by the SPC extension should backed up as part of the Public Key Credential Source w3c/webauthn#2153 (1 comment by @selfissued)
-
Surface platform authenticator status in the `create` (and maybe `get`) response / help RPs track UV/PA/RK w3c/webauthn#1567 (1 comment by @emlun)
-
Cross origin authentication without iframes (accommodating SPC in WebAuthn) w3c/webauthn#1667 (1 comment by @akshayku)
-
Syncing Platform Keys, Recoverability and Security levels w3c/webauthn#1640 (1 comment by @akshayku)
-
Ambiguous instructions in the Android Key Attestation Statement Format verification procedure w3c/webauthn#1980 (1 comment by @arnar)
-
Enum values that ignore naming conventions in Web Authentication: An API for accessing Public Key Credentials - Level 3 w3c/webauthn#2133 (1 comment by @MasterKale)
-
Should enterprise attestation support be flagged explicitly? w3c/webauthn#1742 (1 comment by @timcappalli)
-
-
14 pull requests opened.
-
Add [credential record/authenticatorDisplayName] handling to RP operations w3c/webauthn#2163, by @emlun.
-
Fix CredentialRequestOptions hyperlink w3c/webauthn#2161, by @zacknewman.
-
Deprecate rp.name w3c/webauthn#2159, by @emlun.
-
Mark Android SafetyNet attestation as deprecated. w3c/webauthn#2155, by @agl.
-
Exclude all platform authenticators that use self attesation from hav… w3c/webauthn#2150, by @zacknewman.
-
Remove bikeshed workaround w3c/webauthn#2149, by @dwaite.
-
Add userName and userDisplayName to webdriver w3c/webauthn#2148, by @nsatragno.
-
Clarify behaviour of duplicate hints w3c/webauthn#2145, by @emlun.
-
Add BE/BS steps to authData generation w3c/webauthn#2141, by @timcappalli.
-
Rename first-factor roaming authenticator and integrate passkey term … w3c/webauthn#2140, by @emlun.
-
Update Use Cases for L3 w3c/webauthn#2139, by @timcappalli.
-
Adds dfn for passkey in passkey platform authenticator and exports w3c/webauthn#2138, by @timcappalli.
-
Adds dfn for passkey in passkey platform authenticator w3c/webauthn#2137, by @timcappalli.
-
Update obsolete privacy concerns about throwing errors early w3c/webauthn#2134, by @emlun.
-
-
12 pull requests merged.
-
Enterprise packed attestation guidance w3c/webauthn#1954.
-
Remove bikeshed workaround w3c/webauthn#2149.
-
Update obsolete privacy concerns about throwing errors early w3c/webauthn#2134.
-
Clarify TPM attestation verification instructions w3c/webauthn#1926.
-
Clarify behaviour of duplicate hints w3c/webauthn#2145.
-
Clarify meaning of "unless" in UP flag validation w3c/webauthn#2126.
-
Rename PublicKeyCredentialHints to PublicKeyCredentialHint w3c/webauthn#2129.
-
Add topOrigin to the limited verification algorithm. w3c/webauthn#2104.
-
Adds dfn for passkey in passkey platform authenticator and exports w3c/webauthn#2138.
-
Codify semantic line breaks as editorial convention w3c/webauthn#2127.
-
Add BE/BS steps to authData generation w3c/webauthn#2141.
-
Rename first-factor roaming authenticator and integrate passkey term … w3c/webauthn#2140.
-
-
1 pull request closed.
-
Adds dfn for passkey in passkey platform authenticator w3c/webauthn#2137.
-
-
16 pull requests received 39 new comments.
-
Mark Android SafetyNet attestation as deprecated. w3c/webauthn#2155 (3 comments by @agl, @Firehed, @timcappalli)
-
Add userName and userDisplayName to webdriver w3c/webauthn#2148 (3 comments by @emlun, @MasterKale, @nsatragno)
-
Adds dfn for passkey in passkey platform authenticator and exports w3c/webauthn#2138 (3 comments by @emlun, @timcappalli)
-
Exclude all platform authenticators that use self attesation from hav… w3c/webauthn#2150 (2 comments by @agl, @zacknewman)
-
Adds dfn for passkey in passkey platform authenticator w3c/webauthn#2137 (1 comment by @timcappalli)
Past meetings
Participants
-
3 participants joined.
-
Steve Venema (Microsoft Corporation) joined.
-
Andreas Efthymiou (Visa) joined.
-
Henna Kapur (Visa) joined.
-
GitHub
w3c/webauthn
-
11 issues opened.
-
Review privacy concerns around error conditions w3c/webauthn#2132, by @emlun.
-
Add `mediation` to `PublicKeyCredentialJSON` w3c/webauthn#2124, by @zacknewman.
-
Deprecate rp.name w3c/webauthn#2121, by @nsatragno.
-
Remove `RegistrationResponseJSON.id` and `AuthenticationResponseJSON.id` w3c/webauthn#2119, by @zacknewman.
-
Make `Credential.id` a `DOMString` w3c/webauthn#2118, by @zacknewman.
-
Cross-window `Virtual Authenticator Database` w3c/webauthn#2117, by @0xbuidler.
-
CollectedClientData.crossOrigin not referenced in RP ops w3c/webauthn#2113, by @emlun.
-
Rename PublicKeyCredentialHints to PublicKeyCredentialHint? w3c/webauthn#2112, by @emlun.
-
13 issues closed.
-
Add `mediation` to `PublicKeyCredentialJSON` w3c/webauthn#2124.
-
Clarify how to differentiate between exceptions w3c/webauthn#1859.
-
Defining new OIDs to facilitate WebAuthn interoperability with CMS w3c/webauthn#2026.
-
Define `TypeError` behavior during `.get()` w3c/webauthn#2094.
-
Remove `RegistrationResponseJSON.id` and `AuthenticationResponseJSON.id` w3c/webauthn#2119.
-
Make `Credential.id` a `DOMString` w3c/webauthn#2118.
-
19 issues received 37 new comments.
-
Remove `RegistrationResponseJSON.id` and `AuthenticationResponseJSON.id` w3c/webauthn#2119 (10 comments by @emlun, @MasterKale, @zacknewman)
-
CollectedClientData fields are not ordered correctly and crossOrigin should be required w3c/webauthn#2101 (3 comments by @emlun, @zacknewman)
-
Cross-window `Virtual Authenticator Database` w3c/webauthn#2117 (2 comments by @0xbuidler, @timcappalli)
-
`options.mediation` should be called something else in step 14 of Registering a New Credential w3c/webauthn#2122 (2 comments by @emlun, @zacknewman)
-
Clarify how to differentiate between exceptions w3c/webauthn#1859 (2 comments by @MasterKale, @sameadis)
-
Enum values that ignore naming conventions in Web Authentication: An API for accessing Public Key Credentials - Level 3 w3c/webauthn#2133 (1 comment by @emlun)
-
Add links where non-members can make patent licensing committments to `CONTRIBUTING.md` w3c/webauthn#2128 (1 comment by @simoneonofri)
-
Defining new OIDs to facilitate WebAuthn interoperability with CMS w3c/webauthn#2026 (1 comment by @agl)
-
CollectedClientData.crossOrigin not referenced in RP ops w3c/webauthn#2113 (1 comment by @zacknewman)
-
Rename PublicKeyCredentialHints to PublicKeyCredentialHint? w3c/webauthn#2112 (1 comment by @timcappalli)
-
CollectedClientData.crossOrigin default value and whether it is required w3c/webauthn#1631 (1 comment by @emlun)
-
-
13 pull requests opened.
-
Update CONTRIBUTING.md for non-member IPR commitment w3c/webauthn#2131, by @simoneonofri.
-
Rename PublicKeyCredentialHints to PublicKeyCredentialHint w3c/webauthn#2129, by @timcappalli.
-
Codify semantic line breaks as editorial convention w3c/webauthn#2127, by @emlun.
-
Clarify meaning of "unless" in UP flag validation w3c/webauthn#2126, by @emlun.
-
Fix Credential*Options/PublicKeyCredential*Options confusion in RP ops w3c/webauthn#2125, by @emlun.
-
Add the `topOrigin` field to the limited clientData verification algorithm w3c/webauthn#2123, by @agl.
-
Change `*ResponseJSON.id` to `DOMString` w3c/webauthn#2120, by @MasterKale.
-
Re-add supplementalPubKeys extension w3c/webauthn#2116, by @emlun.
-
Change type of credProps.authenticatorDisplayName to DOMString w3c/webauthn#2115, by @emlun.
-
Move topOrigin definition after crossOrigin w3c/webauthn#2114, by @emlun.
-
Cleanup: Manual References w3c/webauthn#2111, by @timcappalli.
-
Drop the supplementalPubKeys extension w3c/webauthn#2109, by @agl.
-
-
10 pull requests merged.
-
Update CONTRIBUTING.md for non-member IPR commitment w3c/webauthn#2131.
-
Add Signal API w3c/webauthn#2093.
-
Fix Credential*Options/PublicKeyCredential*Options confusion in RP ops w3c/webauthn#2125.
-
Change type of credProps.authenticatorDisplayName to DOMString w3c/webauthn#2115.
-
Add PR template w3c/webauthn#2108.
-
Move topOrigin definition after crossOrigin w3c/webauthn#2114.
-
Change `*ResponseJSON.id` to `DOMString` w3c/webauthn#2120.
-
Drop the supplementalPubKeys extension w3c/webauthn#2109.
-
Help RP's understand actionable exceptions from `create()` and `get()` w3c/webauthn#2047.
-
-
2 pull requests closed.
-
Add the `topOrigin` field to the limited clientData verification algorithm w3c/webauthn#2123.
-
Re-add supplementalPubKeys extension w3c/webauthn#2116.
-
-
12 pull requests received 63 new comments.
-
Add topOrigin to the limited verification algorithm. w3c/webauthn#2104 (11 comments by @agl, @emlun, @zacknewman)
-
Add the `topOrigin` field to the limited clientData verification algorithm w3c/webauthn#2123 (5 comments by @agl, @emlun, @zacknewman)
-
Clarify meaning of "unless" in UP flag validation w3c/webauthn#2126 (4 comments by @MasterKale, @timcappalli, @zacknewman)
-
Drop the supplementalPubKeys extension w3c/webauthn#2109 (4 comments by @emlun, @james-d-elliott, @timcappalli)
-
Change type of credProps.authenticatorDisplayName to DOMString w3c/webauthn#2115 (1 comment by @emlun)
-
Help RP's understand actionable exceptions from `create()` and `get()` w3c/webauthn#2047 (1 comment by @MasterKale)
Past meetings
Participants
-
1 chair stepped down.
-
John Fontana stepped down as a chair.
-
-
2 participants joined.
-
Hu Liu (Jiangsu TPBlock Technology Co., Ltd. （江苏第三极区块链科技有限公司）) joined.
-
Bjorn Hjelm (Yubico) joined.
-
-
2 participants left.
-
Manish Garg (VE3) left.
-
John Fontana (Yubico) left.
-
-
1 organization joined.
-
Jiangsu TPBlock Technology Co., Ltd. （江苏第三极区块链科技有限公司） joined.
-
-
1 organization left.
-
VE3 left.
-
GitHub
w3c/webauthn
-
12 issues opened.
-
Make `AuthenticatorAttestationResponseJSON.publicKeyAlgorithm` optional w3c/webauthn#2106, by @zacknewman.
-
Add `publicKey` and `publicKeyAlgorithm` to `AuthenticatorAssertionResponseJSON` w3c/webauthn#2105, by @zacknewman.
-
Use URI instead of URL for related origins w3c/webauthn#2103, by @opotonniee.
-
Add `topOrigin` to the limited verification algorithm w3c/webauthn#2102, by @zacknewman.
-
UTF-8 decode should not be required for response.clientDataJSON and cData w3c/webauthn#2100, by @zacknewman.
-
Does Related Origins introduce a need for "Related RP IDs" support in `.get()`? w3c/webauthn#2099, by @MasterKale.
-
Return more nuanced errors w3c/webauthn#2096, by @MasterKale.
-
Define `TypeError` behavior during `.get()` w3c/webauthn#2094, by @MasterKale.
-
[[Create]] should not access the global object directly w3c/webauthn#2092, by @nsatragno.
-
Proposal for password-only authentication using ES256 w3c/webauthn#2091, by @dolda2000.
-
Passkey - Disable authentication with another device w3c/webauthn#2090, by @BartekMilew.
-
-
10 issues closed.
-
CredentialCreationOptions/mediation not yet defined in CredMan w3c/webauthn#2079.
-
Make PublicKeyCredentialRequestOptions.rpId a DOMString w3c/webauthn#2066.
-
Empty strings are not valid RFC 8266 Nicknames w3c/webauthn#2068.
-
Use URI instead of URL for related origins w3c/webauthn#2103.
-
Proposal for password-only authentication using ES256 w3c/webauthn#2091.
-
Passkey - Disable authentication with another device w3c/webauthn#2090.
-
Consider allowing cross-domain credential use w3c/webauthn#1372.
-
Support NoCredentialsError and UserCancelledError codes w3c/webauthn#2062.
-
Make AuthenticatorAttestationResponseJSON.publicKeyAlgorithm a long w3c/webauthn#2065.
-
-
16 issues received 37 new comments.
-
Proposal for password-only authentication using ES256 w3c/webauthn#2091 (10 comments by @dolda2000, @emlun, @Firstyear, @sbweeden)
-
Add `publicKey` and `publicKeyAlgorithm` to `AuthenticatorAssertionResponseJSON` w3c/webauthn#2105 (3 comments by @emlun, @zacknewman)
-
Passkey - Disable authentication with another device w3c/webauthn#2090 (3 comments by @emlun, @timcappalli)
-
Make `AuthenticatorAttestationResponseJSON.publicKeyAlgorithm` optional w3c/webauthn#2106 (2 comments by @StemmlerSisters, @zacknewman)
-
UTF-8 decode should not be required for response.clientDataJSON and cData w3c/webauthn#2100 (2 comments by @zacknewman)
-
Use URI instead of URL for related origins w3c/webauthn#2103 (2 comments by @opotonniee, @timcappalli)
-
Add `topOrigin` to the limited verification algorithm w3c/webauthn#2102 (2 comments by @agl, @zacknewman)
-
CredentialCreationOptions/mediation not yet defined in CredMan w3c/webauthn#2079 (1 comment by @emlun)
-
Align the order of fields in PublicKeyCredentialDescriptorJSON with PublicKeyCredentialDescriptor w3c/webauthn#2082 (1 comment by @MasterKale)
-
Does Related Origins introduce a need for "Related RP IDs" support in `.get()`? w3c/webauthn#2099 (1 comment by @timcappalli)
-
Support NoCredentialsError and UserCancelledError codes w3c/webauthn#2062 (1 comment by @MasterKale)
-
-
7 pull requests opened.
-
Add PR template w3c/webauthn#2108, by @timcappalli.
-
Make `AuthenticatorAttestationResponseJSON.publicKeyAlgorithm` optional. w3c/webauthn#2107, by @zacknewman.
-
Add topOrigin to the limited verification algorithm. w3c/webauthn#2104, by @zacknewman.
-
Relax PublicKeyCredentialRequestOptions.rpId to DOMString w3c/webauthn#2098, by @emlun.
-
Structured confirmation extension w3c/webauthn#2097, by @rlin1.
-
Alternative error codes w3c/webauthn#2095, by @MasterKale.
-
Add Signal API w3c/webauthn#2093, by @nsatragno.
-
-
5 pull requests merged.
-
Relax PublicKeyCredentialRequestOptions.rpId to DOMString w3c/webauthn#2098.
-
Apply RFC 8264 enforcement only to non-empty strings w3c/webauthn#2073.
-
adds Related Origin Requests w3c/webauthn#2040.
-
Fix type of AuthenticatorAttestationResponseJSON.publicKeyAlgorithm w3c/webauthn#2071.
-
-
2 pull requests closed.
-
Make `AuthenticatorAttestationResponseJSON.publicKeyAlgorithm` optional. w3c/webauthn#2107.
-
Align RP ID string types w3c/webauthn#2074.
-
-
12 pull requests received 205 new comments.
-
Add Signal API w3c/webauthn#2093 (78 comments by @arnar, @emlun, @Firehed, @kopy, @MasterKale, @nsatragno, @pascoej, @timcappalli)
-
Help RP's understand actionable exceptions from `create()` and `get()` w3c/webauthn#2047 (60 comments by @emlun, @marcoscaceres, @MasterKale, @nsatragno)
-
adds Related Origin Requests w3c/webauthn#2040 (22 comments by @emlun, @Firehed, @LeviSchuck, @MasterKale, @timcappalli)
-
Make `AuthenticatorAttestationResponseJSON.publicKeyAlgorithm` optional. w3c/webauthn#2107 (3 comments by @agl, @zacknewman)
-
Various improvements to conditionalCreate/Mediation discoverability and uniformity w3c/webauthn#2046 (2 comments by @nsatragno, @pascoej)
-
Relax PublicKeyCredentialRequestOptions.rpId to DOMString w3c/webauthn#2098 (1 comment by @nsatragno)
-
Past meetings
Participants
-
1 participant left.
-
Paulo Lopes (IBM Corporation) left.
-
GitHub
w3c/webauthn
-
6 issues opened.
-
Add examples for PRF extension w3c/webauthn#2088, by @akshayku.
-
Add support for IDNs and display domain names in Unicode for a more user friendly UX w3c/webauthn#2087, by @Rodrigue2g.
-
Add support for hinting at verbiage other than "sign in" during authentication w3c/webauthn#2086, by @Firehed.
-
Dictionary members should be ordered lexicographically per Web IDL Standard w3c/webauthn#2083, by @zacknewman.
-
-
3 issues closed.
-
Remove the UVM extension from WebAuthn L3 (potentially) w3c/webauthn#2069.
-
Dictionary members should be ordered lexicographically per Web IDL Standard w3c/webauthn#2083.
-
-
11 issues received 32 new comments.
-
Support NoCredentialsError and UserCancelledError codes w3c/webauthn#2062 (5 comments by @MasterKale, @sbweeden, @timcappalli, @Zhirui-Zhang)
-
Add support for hinting at verbiage other than "sign in" during authentication w3c/webauthn#2086 (5 comments by @emlun, @Firehed, @Kieun, @lgarron, @timcappalli)
-
Add support for IDNs and display domain names in Unicode for a more user friendly UX w3c/webauthn#2087 (4 comments by @pascoej, @Rodrigue2g, @timcappalli)
-
Allow conditional mediation flow without username or password field, I.E. from button press w3c/webauthn#2084 (4 comments by @MasterKale, @rsheasby, @timcappalli)
-
TPM attestation verification steps inconsistent with FIDO conformance testing tool w3c/webauthn#1925 (3 comments by @mwiseman-byid, @sbweeden, @yackermann)
-
Dictionary members should be ordered lexicographically per Web IDL Standard w3c/webauthn#2083 (3 comments by @emlun, @zacknewman)
-
Align the order of fields in PublicKeyCredentialDescriptorJSON with PublicKeyCredentialDescriptor w3c/webauthn#2082 (2 comments by @emlun)
-
-
1 pull request opened.
-
Remove UVM extension w3c/webauthn#2085, by @timcappalli.
-
-
1 pull request merged.
-
Remove UVM extension w3c/webauthn#2085.
-
-
1 pull request closed.
-
Include enterpriseAttestation in getClientClientCapabilities w3c/webauthn#2051.
-
-
10 pull requests received 60 new comments.
-
adds Related Origin Requests w3c/webauthn#2040 (29 comments by @emlun, @MasterKale, @sbweeden, @timcappalli)
-
Help RP's understand actionable exceptions from `create()` and `get()` w3c/webauthn#2047 (16 comments by @emlun, @MasterKale, @nsatragno, @sbweeden, @timcappalli)
-
Improved version of extension for Transaction Confirmation w3c/webauthn#2020 (2 comments by @jaiminbhatt7)
-
Clarify TPM attestation verification instructions w3c/webauthn#1926 (2 comments by @mwiseman-byid, @yackermann)
-
Apply RFC 8264 enforcement only to non-empty strings w3c/webauthn#2073 (2 comments by @MasterKale, @nsatragno)
-
Include enterpriseAttestation in getClientClientCapabilities w3c/webauthn#2051 (1 comment by @timcappalli)
-
Various improvements to conditionalCreate/Mediation discoverability and uniformity w3c/webauthn#2046 (1 comment by @MasterKale)
-
Past meetings
Participants
-
1 participant left.
-
Neha Mankal (American Express Company) left.
-
GitHub
w3c/webauthn
-
12 issues opened.
-
CredentialCreationOptions/mediation not yet defined in CredMan w3c/webauthn#2079, by @emlun.
-
Does WebAuthn supports User-Verifying Roaming Authenticators w3c/webauthn#2076, by @chunsfire.
-
supplementalPubKeys attestation incompatible with most verification procedures w3c/webauthn#2075, by @emlun.
-
Support for WebDriver BiDi w3c/webauthn#2072, by @jimevans.
-
Resident key removal w3c/webauthn#2070, by @erionpc.
-
Remove the UVM extension from WebAuthn L3 (potentially) w3c/webauthn#2069, by @timcappalli.
-
Empty strings are not valid RFC 8266 Nicknames w3c/webauthn#2068, by @zacknewman.
-
Provide a mechanism to indicate backend registration success or failure w3c/webauthn#2067, by @Firehed.
-
Make PublicKeyCredentialRequestOptions.rpId a DOMString w3c/webauthn#2066, by @zacknewman.
-
Make AuthenticatorAttestationResponseJSON.publicKeyAlgorithm a long w3c/webauthn#2065, by @zacknewman.
-
10 issues closed.
-
Does WebAuthn supports User-Verifying Roaming Authenticators w3c/webauthn#2076.
-
Provide a mechanism to indicate backend registration success or failure w3c/webauthn#2067.
-
Non-modal registration during conditional assertion w3c/webauthn#1929.
-
Resident key removal w3c/webauthn#2070.
-
Enterprise attestaion is a bool in WebAuthn and an Int in CTAP2.1 w3c/webauthn#1795.
-
Show only passkey based autofill w3c/webauthn#2037.
-
16 issues received 42 new comments.
-
Provide a mechanism to indicate backend registration success or failure w3c/webauthn#2067 (8 comments by @arianvp, @emlun, @Firehed, @sbweeden, @timcappalli)
-
Remove the UVM extension from WebAuthn L3 (potentially) w3c/webauthn#2069 (5 comments by @emlun, @Firehed, @timcappalli, @ve7jtb)
-
Authenticator Attestation Response's [[transports]] should be an attribute rather than an internal slot. w3c/webauthn#2080 (4 comments by @emlun, @nbrr)
-
Does WebAuthn supports User-Verifying Roaming Authenticators w3c/webauthn#2076 (4 comments by @arianvp, @chunsfire, @timcappalli)
-
Deprecate AuthenticatorAttachment in favor of PublicKeyCredentialHints. w3c/webauthn#2053 (3 comments by @emlun, @MasterKale, @zacknewman)
-
Make PublicKeyCredentialRequestOptions.rpId a DOMString w3c/webauthn#2066 (3 comments by @emlun, @jschanck, @zacknewman)
-
§6.1. Steps to generate authenticator data should include BE and BS flags w3c/webauthn#2064 (2 comments by @emlun, @zacknewman)
-
How does First-factor roaming authenticator registration happens with RP (involving client) w3c/webauthn#2077 (2 comments by @emlun, @timcappalli)
-
Empty strings are not valid RFC 8266 Nicknames w3c/webauthn#2068 (2 comments by @emlun, @selfissued)
-
Make AuthenticatorAttestationResponseJSON.publicKeyAlgorithm a long w3c/webauthn#2065 (2 comments by @emlun, @selfissued)
-
Support NoCredentialsError and UserCancelledError codes w3c/webauthn#2062 (2 comments by @MasterKale, @sbweeden)
-
CredentialCreationOptions/mediation not yet defined in CredMan w3c/webauthn#2079 (1 comment by @pascoej)
-
Authenticator data flags reserved bits must be 0 or the figures would ideally be changed w3c/webauthn#2063 (1 comment by @emlun)
-
Enterprise attestaion is a bool in WebAuthn and an Int in CTAP2.1 w3c/webauthn#1795 (1 comment by @ve7jtb)
-
-
4 pull requests opened.
-
Add "sign" extension w3c/webauthn#2078, by @emlun.
-
Align RP ID string types w3c/webauthn#2074, by @emlun.
-
Apply RFC 8264 enforcement only to non-empty strings w3c/webauthn#2073, by @selfissued.
-
Fix type of AuthenticatorAttestationResponseJSON.publicKeyAlgorithm w3c/webauthn#2071, by @emlun.
-
-
4 pull requests merged.
-
Explicitly specify binary encoding for string truncation w3c/webauthn#2017.
-
Conditional mediation client capability consistency w3c/webauthn#2061.
-
Initial text for conditional create w3c/webauthn#1951.
-
Don't zero platform-authenticator AAGUIDs. w3c/webauthn#2058.
-
-
9 pull requests received 45 new comments.
-
Help RP's understand actionable exceptions from `create()` and `get()` w3c/webauthn#2047 (17 comments by @emlun, @MasterKale, @yackermann)
-
Apply RFC 8264 enforcement only to non-empty strings w3c/webauthn#2073 (8 comments by @emlun, @Firstyear, @MasterKale, @selfissued, @zacknewman)
-
Don't zero platform-authenticator AAGUIDs. w3c/webauthn#2058 (4 comments by @emlun, @jschanck, @timcappalli, @ve7jtb)
-
Explicitly specify binary encoding for string truncation w3c/webauthn#2017 (3 comments by @agl, @emlun)
-
Improved version of extension for Transaction Confirmation w3c/webauthn#2020 (2 comments by @MasterKale)
-
Lifecycle
Past meetings
GitHub
w3c/webauthn
-
8 issues opened.
-
§6.1. Steps to generate authenticator data should include BE and BS flags w3c/webauthn#2064, by @emlun.
-
Support NoCredentialsError and UserCancelledError codes w3c/webauthn#2062, by @AdamEisfeld.
-
Make AuthenticatorAttestationResponseJSON.clientDataJSON a DOMString or USVString w3c/webauthn#2060, by @zacknewman.
-
Additional guidance/clarification on RP ID and origin validation w3c/webauthn#2059, by @zacknewman.
-
excludeCredentials on Get w3c/webauthn#2057, by @christiaanbrand.
-
Clarification on UVM extension w3c/webauthn#2055, by @zacknewman.
-
-
6 issues closed.
-
Dependencies section is out of date and duplicates terms index w3c/webauthn#1797.
-
Clarification on CBOR-encoding of COSE keys w3c/webauthn#2054.
-
Clarification on UVM extension w3c/webauthn#2055.
-
Clarify usage of credentialRecord.transports w3c/webauthn#2016.
-
Numbering in the step needs update in 7.1. Registering a New Credential w3c/webauthn#2030.
-
-
10 issues received 27 new comments.
-
Deprecate AuthenticatorAttachment in favor of PublicKeyCredentialHints. w3c/webauthn#2053 (7 comments by @MasterKale, @zacknewman)
-
Support NoCredentialsError and UserCancelledError codes w3c/webauthn#2062 (5 comments by @AdamEisfeld, @timcappalli)
-
Authenticator data flags reserved bits must be 0 or the figures would ideally be changed w3c/webauthn#2063 (4 comments by @emlun, @james-d-elliott, @zacknewman)
-
Make AuthenticatorAttestationResponseJSON.clientDataJSON a DOMString or USVString w3c/webauthn#2060 (4 comments by @emlun, @MasterKale, @zacknewman)
-
Editorial convention: Semantic line breaks w3c/webauthn#2045 (2 comments by @MasterKale, @nicksteele)
-
§6.1. Steps to generate authenticator data should include BE and BS flags w3c/webauthn#2064 (1 comment by @emlun)
-
-
2 pull requests opened.
-
Conditional mediation client capability consistency w3c/webauthn#2061, by @timcappalli.
-
Don't zero platform-authenticator AAGUIDs. w3c/webauthn#2058, by @agl.
-
-
4 pull requests merged.
-
Update Dependencies section w3c/webauthn#2039.
-
Fix out-of-sync numbers in algorithm step references w3c/webauthn#2032.
-
Include supported extensions in getClientCapabilities. w3c/webauthn#2041.
-
-
9 pull requests received 42 new comments.
-
Improved version of extension for Transaction Confirmation w3c/webauthn#2020 (10 comments by @rlin1)
-
Initial text for conditional create w3c/webauthn#1951 (7 comments by @emlun, @pascoej, @timcappalli)
-
Include enterpriseAttestation in getClientClientCapabilities w3c/webauthn#2051 (4 comments by @emlun, @nsatragno, @timcappalli)
-
Various improvements to conditionalCreate/Mediation discoverability and uniformity w3c/webauthn#2046 (3 comments by @emlun, @timcappalli)
-
Acceptable UV caching time affordance extension added w3c/webauthn#2021 (2 comments by @emlun, @timcappalli)
-
Include supported extensions in getClientCapabilities. w3c/webauthn#2041 (2 comments by @emlun, @nsatragno)
-
Lifecycle
-
1 charter extension.
-
Charter extended until 13 May 2024.
-
Past meetings
Participants
-
1 Team contact appointed.
-
Simone Onofri became a Team contact.
-
-
3 participants joined.
-
Douglas Fisher (Visa) joined.
-
Simone Onofri (W3C) joined.
-
Nakjo Shishkov (Netcetera) joined.
-
-
1 organization joined.
-
Netcetera joined.
-
GitHub
w3c/webauthn
-
9 issues opened.
-
Clarification on CBOR-encoding of COSE keys w3c/webauthn#2054, by @zacknewman.
-
Deprecate AuthenticatorAttachment in favor of PublicKeyCredentialHints. w3c/webauthn#2053, by @akshayku.
-
7.2. Verifying an Authentication Assertion is missing steps 7 and 8 w3c/webauthn#2049, by @arianvp.
-
The standard is very web-centric, can be a bit confusing for app-only users w3c/webauthn#2048, by @JetForMe.
-
Editorial convention: Semantic line breaks w3c/webauthn#2045, by @emlun.
-
Show only passkey based autofill w3c/webauthn#2037, by @praveshShetty.
-
-
5 issues closed.
-
Support `discoverableCredential` field in the API. w3c/webauthn#1565.
-
7.2. Verifying an Authentication Assertion is missing steps 7 and 8 w3c/webauthn#2049.
-
The standard is very web-centric, can be a bit confusing for app-only users w3c/webauthn#2048.
-
Describe firmware OID usage in packed attestation w3c/webauthn#1952.
-
-
16 issues received 42 new comments.
-
How to guarantee created resident key is actually received by RP in adverse networking conditions? w3c/webauthn#2038 (7 comments by @arianvp, @timcappalli)
-
Deprecate AuthenticatorAttachment in favor of PublicKeyCredentialHints. w3c/webauthn#2053 (6 comments by @Firstyear, @MasterKale, @timcappalli)
-
The standard is very web-centric, can be a bit confusing for app-only users w3c/webauthn#2048 (5 comments by @boogerlad, @JetForMe, @timcappalli)
-
Show only passkey based autofill w3c/webauthn#2037 (5 comments by @nov, @praveshShetty, @timcappalli)
-
TPM attestation verification steps inconsistent with FIDO conformance testing tool w3c/webauthn#1925 (4 comments by @mwiseman-byid, @sbweeden, @yackermann)
-
Clarification on CBOR-encoding of COSE keys w3c/webauthn#2054 (3 comments by @MasterKale, @zacknewman)
-
Discussing mechanisms for enterprise RP's to enforce bound properties of credentials w3c/webauthn#1739 (2 comments by @arianvp, @MasterKale)
-
Reflect caching of user verification in WebAuthn assertion w3c/webauthn#2023 (2 comments by @MasterKale, @nicksteele)
-
7.2. Verifying an Authentication Assertion is missing steps 7 and 8 w3c/webauthn#2049 (1 comment by @emlun)
-
[Superset] Updating credential metadata and requesting deletion of stale credentials w3c/webauthn#1967 (1 comment by @timcappalli)
-
Ambiguous instructions in the Android Key Attestation Statement Format verification procedure w3c/webauthn#1980 (1 comment by @nadalin)
-
PublicKeyCredentialParameters can't select curve (E.g. ed448) w3c/webauthn#1446 (1 comment by @selfissued)
-
Split RP ops "Registering a new credential" into one with and one without attestation w3c/webauthn#1710 (1 comment by @dannyniu)
-
-
10 pull requests opened.
-
Adds timeSinceUv extension w3c/webauthn#2052, by @timcappalli.
-
Include enterpriseAttestation in getClientClientCapabilities w3c/webauthn#2051, by @timcappalli.
-
Help RP's understand actionable exceptions from `create()` and `get()` w3c/webauthn#2047, by @MasterKale.
-
Various improvements to conditionalCreate/Mediation discoverability and uniformity w3c/webauthn#2046, by @emlun.
-
Create SECURITY.md w3c/webauthn#2044, by @gorkem9940.
-
Upgrade Matthew Miller to Editor w3c/webauthn#2043, by @MasterKale.
-
Propose Tim Cappalli as editor w3c/webauthn#2042, by @timcappalli.
-
Include supported extensions in getClientCapabilities. w3c/webauthn#2041, by @agl.
-
adds Related Origin Requests w3c/webauthn#2040, by @timcappalli.
-
Update Dependencies section w3c/webauthn#2039, by @selfissued.
-
-
4 pull requests merged.
-
Propose Tim Cappalli as editor w3c/webauthn#2042.
-
Upgrade Matthew Miller to Editor w3c/webauthn#2043.
-
Add packed attestation optional firmware version attribute w3c/webauthn#1953.
-
Updated contributors with Tim & Anders w3c/webauthn#2033.
-
-
1 pull request closed.
-
Create SECURITY.md w3c/webauthn#2044.
-
-
10 pull requests received 127 new comments.
-
Improved version of extension for Transaction Confirmation w3c/webauthn#2020 (37 comments by @andrewkozlik, @emlun, @FlxMgdnz, @mage28, @MasterKale, @petrdvorak, @prusnak, @rlin1)
-
Initial text for conditional create w3c/webauthn#1951 (25 comments by @akshayku, @emlun, @MasterKale, @nov, @pascoej, @timcappalli, @ve7jtb)
-
adds Related Origin Requests w3c/webauthn#2040 (23 comments by @abergs, @emlun, @MasterKale, @sbweeden, @timcappalli)
-
Acceptable UV caching time affordance extension added w3c/webauthn#2021 (21 comments by @emlun, @Firstyear, @MasterKale, @rlin1, @sbweeden, @timcappalli)
-
Adds timeSinceUv extension w3c/webauthn#2052 (8 comments by @MasterKale, @rlin1, @sbweeden, @timcappalli)
-
Explicitly specify binary encoding for string truncation w3c/webauthn#2017 (5 comments by @aphillips, @emlun)
-
Include supported extensions in getClientCapabilities. w3c/webauthn#2041 (4 comments by @emlun, @g-davidson, @Kieun, @msft-bob)
-
Include enterpriseAttestation in getClientClientCapabilities w3c/webauthn#2051 (1 comment by @timcappalli)
-
Various improvements to conditionalCreate/Mediation discoverability and uniformity w3c/webauthn#2046 (1 comment by @emlun)
-
Past meetings
Participants
-
1 participant joined.
-
Johnny Clark (Visa) joined.
-
GitHub
w3c/webauthn
-
8 issues opened.
-
New Authenticator Extension: Time Since UV w3c/webauthn#2034, by @timcappalli.
-
Numbering in the step needs update in 7.1. Registering a New Credential w3c/webauthn#2030, by @dannyniu.
-
Defining new OIDs to facilitate WebAuthn interoperability with CMS w3c/webauthn#2026, by @corrideat.
-
Invoking the authenticatorMakeCredential operation clarification w3c/webauthn#2025, by @dimitribouniol.
-
Make user.displayName optional? w3c/webauthn#2024, by @emlun.
-
Reflect caching of user verification in WebAuthn assertion w3c/webauthn#2023, by @rlin1.
-
Revised txAuthSimple extension w3c/webauthn#2022, by @rlin1.
-
-
3 issues closed.
-
Make user.displayName optional? w3c/webauthn#2024.
-
Invoking the authenticatorMakeCredential operation clarification w3c/webauthn#2025.
-
-
11 issues received 31 new comments.
-
New Authenticator Extension: Time Since UV w3c/webauthn#2034 (5 comments by @abergs, @jschanck, @MasterKale, @sbweeden, @timcappalli)
-
Reflect caching of user verification in WebAuthn assertion w3c/webauthn#2023 (5 comments by @Firstyear, @sbweeden, @ve7jtb)
-
Section 13.1 makes confusing statement saying `CredentialID` is unsigned, where it's actually signed in some cases. w3c/webauthn#2028 (2 comments by @dannyniu, @emlun)
-
Non-modal registration during conditional assertion w3c/webauthn#1929 (2 comments by @madmath, @pascoej)
-
Invoking the authenticatorMakeCredential operation clarification w3c/webauthn#2025 (2 comments by @dimitribouniol, @emlun)
-
Support a "create or get [or replace]" credential re-association operation w3c/webauthn#1568 (1 comment by @rlin1)
-
Defining new OIDs to facilitate WebAuthn interoperability with CMS w3c/webauthn#2026 (1 comment by @agl)
-
Numbering in the step needs update in 7.1. Registering a New Credential w3c/webauthn#2030 (1 comment by @emlun)
-
7 pull requests opened.
-
Updated contributors with Tim & Anders w3c/webauthn#2033, by @abergs.
-
Fix out-of-sync numbers in algorithm step references w3c/webauthn#2032, by @emlun.
-
Clarify connection between credential record and PublicKeyCredentialDescriptor w3c/webauthn#2031, by @emlun.
-
Precisize that it's assertions that don't sign the credential ID w3c/webauthn#2029, by @emlun.
-
Fix indentation of step to invoke authenticatorMakeCredential w3c/webauthn#2027, by @emlun.
-
Acceptable UV caching time affordance extension added w3c/webauthn#2021, by @rlin1.
-
Improved version of extension for Transaction Confirmation w3c/webauthn#2020, by @rlin1.
-
-
5 pull requests merged.
-
Precisize that it's assertions that don't sign the credential ID w3c/webauthn#2029.
-
Adding example of localhost as allowed host/origin w3c/webauthn#2019.
-
Fix indentation of step to invoke authenticatorMakeCredential w3c/webauthn#2027.
-
Fix references to reserved tokenBinding member w3c/webauthn#2014.
-
-
9 pull requests received 50 new comments.
-
Acceptable UV caching time affordance extension added w3c/webauthn#2021 (15 comments by @emlun, @rlin1, @timcappalli)
-
Adding flexibility in client origin scheme validation to align with real world implementations w3c/webauthn#2018 (11 comments by @abergs, @barryp, @emlun, @nsatragno)
-
Improved version of extension for Transaction Confirmation w3c/webauthn#2020 (5 comments by @FlxMgdnz, @rlin1, @timcappalli)
-
Explicitly specify binary encoding for string truncation w3c/webauthn#2017 (4 comments by @aphillips, @emlun)
-
Add packed attestation optional firmware version attribute w3c/webauthn#1953 (4 comments by @dwaite, @emlun)
-
Adding example of localhost as allowed host/origin w3c/webauthn#2019 (3 comments by @abergs, @nsatragno)
-
Fix indentation of step to invoke authenticatorMakeCredential w3c/webauthn#2027 (3 comments by @dimitribouniol, @emlun)
-
Past meetings
Participants
-
8 participants joined.
-
Melissa Sebastian (Entersekt) joined.
-
Vesa Parkkinen (Entersekt) joined.
-
Kenneth Raymond Diaz (Entersekt) joined.
-
Ryan Watkins (Mastercard Incorporated) joined.
-
Tomasz Blachowicz (Mastercard Incorporated) joined.
-
Tim Cappalli (Okta) joined.
-
Tim Cappalli (Okta) joined.
-
Khaled Zaky (Amazon) joined.
-
-
2 participants left.
-
Tim Cappalli (Okta) left.
-
Tim Cappalli (Okta) left.
-
-
2 organizations joined.
-
Mastercard Incorporated joined.
-
Okta joined.
-
GitHub
w3c/webauthn
-
2 issues opened.
-
Clarify usage of credentialRecord.transports w3c/webauthn#2016, by @jameshartig.
-
Refine JSON serialization to use UTF-8 encoding for `user.id` and `userHandle` w3c/webauthn#2013, by @MasterKale.
-
-
13 issues closed.
-
Allow conditional and modal flows to run simultaneously w3c/webauthn#1854.
-
Proposal/discussion: non-extractable CryptoKey output from the prf extension w3c/webauthn#1895.
-
Remove isPPAA() and expand getClientCapabilities() w3c/webauthn#1937.
-
Conditional UI support by WebAuthn WebDriver Extension w3c/webauthn#2010.
-
Further clarification of Unsigned Extension Outputs w3c/webauthn#1964.
-
[[preventSilentAccess]] seems incorrect w3c/webauthn#1956.
-
Consider replacing "Github" with "GitHub" w3c/webauthn#2007.
-
-
22 issues received 43 new comments.
-
Refine JSON serialization to use UTF-8 encoding for `user.id` and `userHandle` w3c/webauthn#2013 (10 comments by @arianvp, @emlun, @kreichgauer, @lgarron, @MasterKale)
-
Clarify usage of credentialRecord.transports w3c/webauthn#2016 (5 comments by @emlun, @jameshartig, @sbweeden)
-
Should an RP be able to provide finer grained authenticator filtering in attestation options? w3c/webauthn#1688 (4 comments by @Firstyear, @jameshartig, @timcappalli)
-
Ambiguous instructions in the Android Key Attestation Statement Format verification procedure w3c/webauthn#1980 (2 comments by @agl, @arnar)
-
Conditional UI support by WebAuthn WebDriver Extension w3c/webauthn#2010 (2 comments by @agl, @nsatragno)
-
Proposal/discussion: non-extractable CryptoKey output from the prf extension w3c/webauthn#1895 (1 comment by @agl)
-
Should credentials requested with attestation=none include an AAGUID? w3c/webauthn#1962 (1 comment by @agl)
-
Discussing mechanisms for enterprise RP's to enforce bound properties of credentials w3c/webauthn#1739 (1 comment by @MasterKale)
-
Support a "create or get [or replace]" credential re-association operation w3c/webauthn#1568 (1 comment by @sameadis)
-
Clarify browser behavior when an authenticators return equivalent of "InvalidStateError" w3c/webauthn#1888 (1 comment by @MasterKale)
-
The default value of `attestation` member in `PublicKeyCredentialRequestOptions` should be null or must not have default value w3c/webauthn#1941 (1 comment by @emlun)
-
Extend WebAuthn spec to support interoperability in WebExtensions w3c/webauthn#1766 (1 comment by @irew)
-
Better specify what an unknown type credential descriptor being ignored means w3c/webauthn#1748 (1 comment by @agl)
-
Enterprise attestaion is a bool in WebAuthn and an Int in CTAP2.1 w3c/webauthn#1795 (1 comment by @nadalin)
-
Indicate that the credential could be backed up and restored, but not synchronized w3c/webauthn#1933 (1 comment by @timcappalli)
-
-
7 pull requests opened.
-
Adding example of localhost as allowed host/origin w3c/webauthn#2019, by @abergs.
-
Explicitly specify binary encoding for string truncation w3c/webauthn#2017, by @emlun.
-
Fix Bikeshed lint w3c/webauthn#2015, by @emlun.
-
Fix references to reserved tokenBinding member w3c/webauthn#2014, by @emlun.
-
Expand upon the definition of "unsigned extension outputs" w3c/webauthn#2012, by @agl.
-
Mark SPK's `signatures` output as required. w3c/webauthn#2011, by @agl.
-
-
6 pull requests merged.
-
Expand upon the definition of "unsigned extension outputs" w3c/webauthn#2012.
-
Fix Bikeshed lint w3c/webauthn#2015.
-
Drop assertion-time attestation. w3c/webauthn#1997.
-
Correct capitalization on "Github" w3c/webauthn#2009.
-
Mark SPK's `signatures` output as required. w3c/webauthn#2011.
-
Add new getClientCapabilities method w3c/webauthn#1923.
-
-
1 pull request closed.
-
10 pull requests received 42 new comments.
-
Explicitly specify binary encoding for string truncation w3c/webauthn#2017 (13 comments by @agl, @aphillips, @emlun)
-
Expand upon the definition of "unsigned extension outputs" w3c/webauthn#2012 (5 comments by @agl, @emlun, @MasterKale)
-
Adding flexibility in client origin scheme validation to align with real world implementations w3c/webauthn#2018 (3 comments by @abergs, @emlun)
-
Add packed attestation optional firmware version attribute w3c/webauthn#1953 (2 comments by @agl, @dwaite)
-
Make the default value for the attestation member in assertion options be null w3c/webauthn#1972 (1 comment by @MasterKale)
-