Web Authentication Working Group - Activity in 2025
No matches.
Past meetings
Participants
-
1 participant joined.
-
Hiroshi Ota (LY Corporation) joined.
-
-
1 participant left.
-
Hiroshi Ota (LY Corporation) left.
-
GitHub
w3c/webauthn
-
4 issues opened.
-
Drew w3c/webauthn#2374, by @newlife12022-hue.
-
spec-prod build failing w3c/webauthn#2370, by @emlun.
-
Ambiguous references to [=success=] w3c/webauthn#2368, by @emlun.
-
-
6 issues closed.
-
Drew w3c/webauthn#2374.
-
spec-prod build failing w3c/webauthn#2370.
-
Support registering and using security keys in different form factors w3c/webauthn#2361.
-
Ambiguous references to [=success=] w3c/webauthn#2368.
-
-
1 issue reopened.
-
Re-Open "confirmation" discussion (see PR#2020) w3c/webauthn#2352, by @christiaanbrand.
-
-
9 issues received 27 new comments.
-
Privacy risk from revealing allowed credentials w3c/webauthn#1246 (9 comments by @Firstyear, @getify, @manger, @timcappalli)
-
5.6. Abort Operations with AbortSignal needs updated for conditional mediation w3c/webauthn#2278 (6 comments by @emlun, @nsatragno)
-
Virtual authenticator should allow `counter` to always be `0` w3c/webauthn#2363 (3 comments by @MasterKale, @nicksteele, @nsatragno)
-
Re-Open "confirmation" discussion (see PR#2020) w3c/webauthn#2352 (2 comments by @christiaanbrand, @nadalin)
-
Forbid authenticator data from containing plaintext PRF outputs w3c/webauthn#2359 (1 comment by @emlun)
-
Support registering and using security keys in different form factors w3c/webauthn#2361 (1 comment by @MasterKale)
-
Deprecate AuthenticatorAttachment in favor of PublicKeyCredentialHints. w3c/webauthn#2053 (1 comment by @Gunni)
-
-
4 pull requests opened.
-
Forbid authenticator data from containing cleartext PRF outputs w3c/webauthn#2372, by @emlun.
-
Bump build-validate-publish workflow image w3c/webauthn#2371, by @emlun.
-
Disambiguate [=success=] autolinks w3c/webauthn#2369, by @emlun.
-
Delete inaccurate recommendation to abort on unfocus w3c/webauthn#2367, by @emlun.
-
-
4 pull requests merged.
-
Delete inaccurate recommendation to abort on unfocus w3c/webauthn#2367.
-
Bump build-validate-publish workflow image w3c/webauthn#2371.
-
Add a new optional `rpId` to Credential Record w3c/webauthn#2258.
-
Disambiguate [=success=] autolinks w3c/webauthn#2369.
-
-
3 pull requests received 9 new comments.
Past meetings
Participants
-
2 participants joined.
-
Johan Verrept (OneSpan) joined.
-
Isaiah Inuwa (Bitwarden) joined.
-
GitHub
w3c/webauthn
-
7 issues opened.
-
Limpiezaydesparasitada w3c/webauthn#2366, by @josepcory30-droid.
-
<=> w3c/webauthn#2365, by @josepcory30-droid.
-
Nuevadirectiva w3c/webauthn#2364, by @josepcory30-droid.
-
Virtual authenticator should allow `counter` to always be `0` w3c/webauthn#2363, by @MasterKale.
-
Support registering and using security keys in different form factors w3c/webauthn#2361, by @mlourie.
-
Client terminology hints for external authenticator form factors w3c/webauthn#2360, by @timcappalli.
-
Forbid authenticator data from containing plaintext PRF outputs w3c/webauthn#2359, by @zacknewman.
-
-
3 issues closed.
-
<=> w3c/webauthn#2365.
-
Limpiezaydesparasitada w3c/webauthn#2366.
-
Nuevadirectiva w3c/webauthn#2364.
-
-
14 issues received 35 new comments.
-
Support registering and using security keys in different form factors w3c/webauthn#2361 (4 comments by @MasterKale, @mlourie, @timcappalli)
-
Forbid authenticator data from containing plaintext PRF outputs w3c/webauthn#2359 (4 comments by @arnar, @zacknewman)
-
Client terminology hints for external authenticator form factors w3c/webauthn#2360 (3 comments by @timcappalli)
-
Feature: Allow RP to opt out of certain transports w3c/webauthn#2349 (3 comments by @harshlal028, @LBBO, @ve7jtb)
-
Provide a way for Web Extensions to hook into browser's Passkey autofill UI w3c/webauthn#1976 (2 comments by @arianvp, @emlun)
-
Should an RP be able to provide finer grained authenticator filtering in attestation options? w3c/webauthn#1688 (1 comment by @timcappalli)
-
document and mitigate fingerprinting and disclosure risk of capabilities and extensions w3c/webauthn#2320 (1 comment by @npdoty)
-
1 pull request opened.
-
Reference RFC 9864 for fully-specified algorithms w3c/webauthn#2362, by @selfissued.
-
-
2 pull requests merged.
-
Additional privacy recommendations for getClientCapabilities w3c/webauthn#2357.
-
Reference RFC 9864 for fully-specified algorithms w3c/webauthn#2362.
-
-
2 pull requests received 9 new comments.
-
[Do not review yet] Add `requestUserInfo` w3c/webauthn#2358 (4 comments by @emlun, @nsatragno, @pascoej)
Past meetings
Participants
-
4 participants joined.
-
Ki-Eun Shin (W3C Invited Experts) joined.
-
Nishant Kaushik (W3C Invited Experts) joined.
-
Masashi Hirano (Cybozu) joined.
-
Dario Salice (Futurae Technologies AG) joined.
-
-
1 participant left.
-
Ki-Eun Shin (W3C Invited Experts) left.
-
-
1 organization joined.
-
Cybozu joined.
-
GitHub
w3c/webauthn
-
15 issues opened.
-
[L3 CR] Transition Request Draft w3c/webauthn#2355, by @simoneonofri.
-
Re-Open "confirmation" discussion (see PR#2020) w3c/webauthn#2352, by @rlin1.
-
Spec doesn't build with bikeshed 5.0.3 or higher w3c/webauthn#2351, by @nsatragno.
-
Consider RP ID migration use cases w3c/webauthn#2350, by @MasterKale.
-
Feature: Allow RP to opt out of certain transports w3c/webauthn#2349, by @denniskniep.
-
thalinda w3c/webauthn#2347, by @thalinda-oss.
-
16.2. ES256 Credential with No Attestation test vector misses extraData content w3c/webauthn#2345, by @viralpoetry.
-
WebAuthn requirePlatformBackupEligibleCredential w3c/webauthn#2342, by @nsatragno.
-
Add hybrid fallback URL extension w3c/webauthn#2341, by @harshlal028.
-
Discovery of migrated credentials w3c/webauthn#2340, by @sbweeden.
-
Add Credential Manager Trust Group Key (CMTG) extension w3c/webauthn#2338, by @timcappalli.
-
Same PRF regardless of UV? w3c/webauthn#2337, by @My1.
-
WebAuthn requestUserInfo -- easier account creation w3c/webauthn#2336, by @nsatragno.
-
-
9 issues closed.
-
Merge changes since L3WD2 into changes since L2 w3c/webauthn#2302.
-
[L3 CR] Horizontal Review: Security & Privacy w3c/webauthn#2244.
-
Spec doesn't build with bikeshed 5.0.3 or higher w3c/webauthn#2351.
-
WebAuthn requirePlatformBackupEligibleCredential w3c/webauthn#2342.
-
thalinda w3c/webauthn#2347.
-
Malware w3c/webauthn#2343.
-
naming of hints is confusing w3c/webauthn#2322.
-
Feature Request: disableAutoSelect for PublicKeyCredentialRequestOptions w3c/webauthn#2335.
-
-
26 issues received 117 new comments.
-
Feature: Allow RP to opt out of certain transports w3c/webauthn#2349 (26 comments by @denniskniep, @emlun, @Firstyear, @joostd, @LBBO, @nsatragno, @ntrojanowska, @rlin1, @timcappalli)
-
Consider RP ID migration use cases w3c/webauthn#2350 (12 comments by @Firstyear, @kreichgauer, @MasterKale, @nsatragno, @timcappalli)
-
Same PRF regardless of UV? w3c/webauthn#2337 (11 comments by @Firstyear, @iinuwa, @My1, @nsatragno, @ve7jtb)
-
WebAuthn requestUserInfo -- easier account creation w3c/webauthn#2336 (10 comments by @emlun, @iinuwa, @MasterKale, @nsatragno)
-
Allow immediate mode w3c/webauthn#2228 (10 comments by @kenrb, @marcoscaceres, @MasterKale, @rmondello, @timcappalli)
-
WebAuthn requirePlatformBackupEligibleCredential w3c/webauthn#2342 (9 comments by @akshayku, @emlun, @Firstyear, @james-d-elliott, @MasterKale, @nsatragno)
-
Add Credential Manager Trust Group Key (CMTG) extension w3c/webauthn#2338 (7 comments by @arnar, @Firstyear, @nsatragno)
-
[L3 CR] Transition Request Draft w3c/webauthn#2355 (6 comments by @emlun, @nsatragno, @simoneonofri)
-
Update: COSE elliptic curve signatures 'in the wild' from small RustyKey® alpha-test user base w3c/webauthn#2339 (5 comments by @antonymott, @james-d-elliott, @timcappalli)
-
16.2. ES256 Credential with No Attestation test vector misses extraData content w3c/webauthn#2345 (3 comments by @emlun, @viralpoetry)
-
document and mitigate fingerprinting and disclosure risk of capabilities and extensions w3c/webauthn#2320 (1 comment by @timcappalli)
-
user verification discouraged should consider privacy impact or UA advice w3c/webauthn#2323 (1 comment by @timcappalli)
-
Mechanism for encoding *direction* metadata may need more work w3c/webauthn#1644 (1 comment by @xfq)
-
Numbering in the step needs update in 7.1. Registering a New Credential w3c/webauthn#2030 (1 comment by @zll600)
-
Feature Request: disableAutoSelect for PublicKeyCredentialRequestOptions w3c/webauthn#2335 (1 comment by @MasterKale)
-
-
8 pull requests opened.
-
[Do not review yet] Add `requestUserInfo` w3c/webauthn#2358, by @nsatragno.
-
Additional privacy recommendations for getClientCapabilities w3c/webauthn#2357, by @timcappalli.
-
Fold changes since L3WD2 into changes since L2 w3c/webauthn#2356, by @emlun.
-
Fixes some typos w3c/webauthn#2354, by @timcappalli.
-
chore: Adds a CSpell configuration w3c/webauthn#2353, by @timcappalli.
-
Fix typo w3c/webauthn#2348, by @nsatragno.
-
Create SECURITY.md for security policy w3c/webauthn#2344, by @edgreal.
-
-
5 pull requests merged.
-
Fold changes since L3WD2 into changes since L2 w3c/webauthn#2356.
-
Fixes some typos w3c/webauthn#2354.
-
chore: Adds a CSpell configuration w3c/webauthn#2353.
-
Fix typo w3c/webauthn#2348.
-
-
1 pull request closed.
-
Create SECURITY.md for security policy w3c/webauthn#2344.
-
-
6 pull requests received 21 new comments.
-
Include base64url encoding of extra_client_data in test vectors; regenerate without b64 padding w3c/webauthn#2346 (11 comments by @emlun, @MasterKale, @viralpoetry)
-
Additional privacy recommendations for getClientCapabilities w3c/webauthn#2357 (3 comments by @nsatragno, @timcappalli)
-
Fold changes since L3WD2 into changes since L2 w3c/webauthn#2356 (3 comments by @emlun, @MasterKale)
-
Past meetings
Participants
-
2 participants joined.
-
Valerii Hvozdiev (Futurae Technologies AG) joined.
-
Spyros Vlachos (Futurae Technologies AG) joined.
-
GitHub
w3c/webauthn
-
4 issues opened.
-
Feature Request: disableAutoSelect for PublicKeyCredentialRequestOptions w3c/webauthn#2335, by @jychab.
-
65.LD w3c/webauthn#2334, by @azerah885-Bryon65.
-
RS256 test vector has seemingly incorrect key size of 3482 bits w3c/webauthn#2333, by @ghost.
-
Push due date of milestone to after we reconvene w3c/webauthn#2332, by @nicksteele.
-
-
2 issues closed.
-
65.LD w3c/webauthn#2334.
-
RS256 test vector has seemingly incorrect key size of 3482 bits w3c/webauthn#2333.
-
-
6 issues received 29 new comments.
-
Feature Request: disableAutoSelect for PublicKeyCredentialRequestOptions w3c/webauthn#2335 (20 comments by @emlun, @irew, @jychab, @MasterKale, @timcappalli)
-
RS256 test vector has seemingly incorrect key size of 3482 bits w3c/webauthn#2333 (3 comments by @emlun, @ghost)
-
Which "pubKeyCredParams" to use? w3c/webauthn#1757 (3 comments by @petrdvorak, @SagePtr, @tylerccarson)
-
Add onlyCreate to prevent creation of a new key for existing user w3c/webauthn#2313 (1 comment by @davidje13)
-
-
1 pull request received 1 new comment.
Past meetings
Participants
-
1 participant joined.
-
Frederik Mennes (OneSpan) joined.
-
-
4 participants left.
-
Steve Venema (Microsoft Corporation) left.
-
Juliana Cafik (Microsoft Corporation) left.
-
Sue Koomen (American Express Company) left.
-
Vesa Parkkinen (Entersekt) left.
-
-
1 organization joined.
-
Futurae Technologies AG joined.
-
GitHub
w3c/webauthn
-
8 issues opened.
-
Need to have authenticator-only extensions w3c/webauthn#2331, by @joshzhao.
-
are user handles in the wild including user data? w3c/webauthn#2324, by @npdoty.
-
user verification discouraged should consider privacy impact or UA advice w3c/webauthn#2323, by @npdoty.
-
naming of hints is confusing w3c/webauthn#2322, by @npdoty.
-
privacy implications of cross-origin iframe w3c/webauthn#2321, by @npdoty.
-
document and mitigate fingerprinting and disclosure risk of capabilities and extensions w3c/webauthn#2320, by @npdoty.
-
related origins enables sharing across relying parties w3c/webauthn#2319, by @npdoty.
-
Section 6.5.5. should be moved to section 6.6. w3c/webauthn#2318, by @dannyniu.
-
-
5 issues closed.
-
[L3 CR] Horizontal Review: Wide Review w3c/webauthn#2248.
-
Section 6.5.5. should be moved to section 6.6. w3c/webauthn#2318.
-
Add onlyCreate to prevent creation of a new key for existing user w3c/webauthn#2313.
-
Use of in-field metadata not preferred w3c/webauthn#1643.
-
-
13 issues received 29 new comments.
-
Need to have authenticator-only extensions w3c/webauthn#2331 (11 comments by @akshayku, @emlun, @Firstyear, @joshzhao, @nsatragno, @sbweeden, @timcappalli)
-
Drop generic client extension processing? w3c/webauthn#1730 (4 comments by @emlun, @joshzhao, @timcappalli)
-
Section 6.5.5. should be moved to section 6.6. w3c/webauthn#2318 (3 comments by @authorizenetsuite-hash, @timcappalli)
-
5.6. Abort Operations with AbortSignal needs updated for conditional mediation w3c/webauthn#2278 (2 comments by @MasterKale, @nsatragno)
-
related origins enables sharing across relying parties w3c/webauthn#2319 (1 comment by @timcappalli)
-
document and mitigate fingerprinting and disclosure risk of capabilities and extensions w3c/webauthn#2320 (1 comment by @timcappalli)
-
user verification discouraged should consider privacy impact or UA advice w3c/webauthn#2323 (1 comment by @timcappalli)
-
Add onlyCreate to prevent creation of a new key for existing user w3c/webauthn#2313 (1 comment by @MasterKale)
-
-
2 pull requests merged.
-
Deprecate in-field language/direction metadata w3c/webauthn#2308.
-
Clarify that DER lengths vary with INTEGER magnitude and curve size w3c/webauthn#2315.
-
-
2 pull requests received 3 new comments.
-
Clarify that DER lengths vary with INTEGER magnitude and curve size w3c/webauthn#2315 (1 comment by @nadalin)
Past meetings
Participants
-
1 participant joined.
-
Will LaSala (OneSpan) joined.
-
-
1 participant left.
-
Sebastian Elfors (IDnow GmbH) left.
-
-
1 organization left.
-
IDnow GmbH left.
-
GitHub
w3c/webauthn
-
6 issues opened.
-
Clarify DER encoding rules apply to signature format encoding in section 6.5.5 w3c/webauthn#2314, by @rlin1.
-
Add onlyCreate to prevent creation of a new key for existing user w3c/webauthn#2313, by @mitar.
-
Add a note about `appid` extension not compatible with related origin requests w3c/webauthn#2312, by @jaiminbhatt7.
-
New `userVerification` value with conditional behavior w3c/webauthn#2310, by @mscdex.
-
Add excludeUsers to prevent creation of new keys for known users w3c/webauthn#2309, by @mitar.
-
Document privacy considerations of immediate mediation w3c/webauthn#2307, by @martinthomson.
-
-
9 issues closed.
-
Require clients to support new fully-specified COSEAlgorithmIdentifiers w3c/webauthn#2276.
-
Reflect caching of user verification in WebAuthn assertion w3c/webauthn#2023.
-
Add excludeUsers to prevent creation of new keys for known users w3c/webauthn#2309.
-
Support a "create or get [or replace]" credential re-association operation w3c/webauthn#1568.
-
Revised txAuthSimple extension w3c/webauthn#2022.
-
Should credentials requested with attestation=none include an AAGUID? w3c/webauthn#1962.
-
PublicKeyCredentialParameters can't select curve (E.g. ed448) w3c/webauthn#1446.
-
-
26 issues received 73 new comments.
-
Support a "create or get [or replace]" credential re-association operation w3c/webauthn#1568 (25 comments by @akshayku, @emlun, @FlxMgdnz, @MasterKale, @mitar, @ryanhiebert, @timcappalli)
-
Add onlyCreate to prevent creation of a new key for existing user w3c/webauthn#2313 (5 comments by @dwaite, @emlun, @mitar, @zacknewman)
-
Conditional creation incompatible with `uvInitialized` semantics in Chapter 7? w3c/webauthn#2295 (5 comments by @emlun, @zacknewman)
-
Add excludeUsers to prevent creation of new keys for known users w3c/webauthn#2309 (5 comments by @Firstyear, @MasterKale, @mitar)
-
Prevent browsers from deleting credentials that the RP wanted to be server-side w3c/webauthn#1569 (4 comments by @akshayku, @lgarron)
-
Deprecate AuthenticatorAttachment in favor of PublicKeyCredentialHints. w3c/webauthn#2053 (4 comments by @akshayku, @emlun, @MasterKale)
-
Should an RP be able to provide finer grained authenticator filtering in attestation options? w3c/webauthn#1688 (4 comments by @deanyxu, @timcappalli)
-
New `userVerification` value with conditional behavior w3c/webauthn#2310 (2 comments by @emlun, @Firstyear)
-
Require clients to support new fully-specified COSEAlgorithmIdentifiers w3c/webauthn#2276 (2 comments by @akshayku, @emlun)
-
Provide a way for Web Extensions to hook into browser's Passkey autofill UI w3c/webauthn#1976 (1 comment by @arianvp)
-
The authenticator may hide the credential even if the RP signals unknown credentials w3c/webauthn#2192 (1 comment by @nsatragno)
-
Reflect caching of user verification in WebAuthn assertion w3c/webauthn#2023 (1 comment by @akshayku)
-
Clarify DER encoding rules apply to signature format encoding in section 6.5.5 w3c/webauthn#2314 (1 comment by @emlun)
-
Add a note about `appid` extension not compatible with related origin requests w3c/webauthn#2312 (1 comment by @kzaky)
-
See you F2F at TPAC 2026 in Kobe? Decide < 2025-06-20 w3c/webauthn#2303 (1 comment by @simoneonofri)
-
Should credentials requested with attestation=none include an AAGUID? w3c/webauthn#1962 (1 comment by @pascoej)
-
PublicKeyCredentialParameters can't select curve (E.g. ed448) w3c/webauthn#1446 (1 comment by @selfissued)
-
CollectedClientData.crossOrigin default value and whether it is required w3c/webauthn#1631 (1 comment by @MasterKale)
-
-
3 pull requests opened.
-
Clarify that DER lengths vary with INTEGER magnitude and curve size w3c/webauthn#2315, by @emlun.
-
Deprecate in-field language/direction metadata w3c/webauthn#2308, by @emlun.
-
-
1 pull request merged.
-
Fix typo w3c/webauthn#2311.
-
-
3 pull requests closed.
-
Replace in-field string metadata with resource-level default fields w3c/webauthn#2280.
-
8 pull requests received 11 new comments.
-
Replace in-field string metadata with resource-level default fields w3c/webauthn#2280 (3 comments by @emlun, @MasterKale)
-
Clarify that DER lengths vary with INTEGER magnitude and curve size w3c/webauthn#2315 (2 comments by @emlun, @rlin1)
-
Backup Preference Option for providers who support both backed-up and non-backed up credential w3c/webauthn#2259 (1 comment by @akshayku)
-
Backup preference for providers who support both backed-up and non-backed up credential w3c/webauthn#2253 (1 comment by @akshayku)
-
Add importCryptoKey input to PRF extension w3c/webauthn#1945 (1 comment by @cr6750903177Aguinaldok4)
-
Past meetings
Participants
-
2 participants left.
-
Juan Deng (Alibaba Group) left.
-
Fawad Nisar (Discover Financial Services LLC) left.
-
GitHub
w3c/webauthn
-
5 issues opened.
-
Please change the name of Explainer: Client Hints w3c/webauthn#2306, by @annevk.
-
See you F2F at TPAC 2026 in Kobe? Decide < 2025-06-20 w3c/webauthn#2303, by @simoneonofri.
-
Merge changes since L3WD2 into changes since L2 w3c/webauthn#2302, by @emlun.
-
Black on black in dark mode w3c/webauthn#2300, by @martinthomson.
-
Increase/remove maximum length requirement for credential ID w3c/webauthn#2299, by @zacknewman.
-
-
7 issues closed.
-
Please change the name of Explainer: Client Hints w3c/webauthn#2306.
-
Is `hmac-secret` required for `prf` for non-CTAP authenticators w3c/webauthn#2285.
-
Black on black in dark mode w3c/webauthn#2300.
-
Increase/remove maximum length requirement for credential ID w3c/webauthn#2299.
-
-
3 issues reopened.
-
Please change the name of Explainer: Client Hints w3c/webauthn#2306, by @emlun.
-
See you F2F at TPAC 2026 in Kobe? Decide < 2025-06-20 w3c/webauthn#2303, by @simoneonofri.
-
-
16 issues received 34 new comments.
-
Increase/remove maximum length requirement for credential ID w3c/webauthn#2299 (6 comments by @emlun, @sbweeden, @zacknewman)
-
Please change the name of Explainer: Client Hints w3c/webauthn#2306 (5 comments by @annevk, @emlun, @timcappalli)
-
Is `hmac-secret` required for `prf` for non-CTAP authenticators w3c/webauthn#2285 (3 comments by @emlun, @savely-krasovsky)
-
Conditional creation incompatible with `uvInitialized` semantics in Chapter 7? w3c/webauthn#2295 (2 comments by @arianvp, @emlun)
-
Broken links in Web Authentication: An API for accessing Public Key Credentials - Level 3 w3c/webauthn#2272 (2 comments by @dontcallmedom, @timcappalli)
-
Allow conditional mediation flow without username or password field, I.E. from button press w3c/webauthn#2084 (2 comments by @rsheasby, @timcappalli)
-
See you F2F at TPAC 2026 in Kobe? Decide < 2025-06-20 w3c/webauthn#2303 (1 comment by @simoneonofri)
-
Should an RP be able to provide finer grained authenticator filtering in attestation options? w3c/webauthn#1688 (1 comment by @MasterKale)
-
UTF-8 decode should not be required for response.clientDataJSON and cData w3c/webauthn#2100 (1 comment by @MasterKale)
-
Add support for hinting at verbiage other than "sign in" during authentication w3c/webauthn#2086 (1 comment by @MasterKale)
-
Surface platform authenticator status in the `create` (and maybe `get`) response / help RPs track UV/PA/RK w3c/webauthn#1567 (1 comment by @MasterKale)
-
-
3 pull requests opened.
-
Consistently refer to COSE IDs as "int (name)" instead of "name (int)" w3c/webauthn#2305, by @emlun.
-
Fix COSEAlgorithmIdentifier in section 5.4 w3c/webauthn#2304, by @lennartkloock.
-
Add change history since Level 3 Working Draft 2 w3c/webauthn#2301, by @emlun.
-
-
4 pull requests merged.
-
Generalize PRF extension processing to non-CTAP authenticators w3c/webauthn#2298.
-
Fix COSEAlgorithmIdentifier in section 5.4 w3c/webauthn#2304.
-
Consistently refer to COSE IDs as "int (name)" instead of "name (int)" w3c/webauthn#2305.
-
Add change history since Level 3 Working Draft 2 w3c/webauthn#2301.
-
-
1 pull request closed.
-
Structured confirmation extension w3c/webauthn#2097.
-
-
6 pull requests received 35 new comments.
-
Generalize PRF extension processing to non-CTAP authenticators w3c/webauthn#2298 (28 comments by @emlun, @MasterKale, @nadalin, @nsatragno, @zacknewman)
-
Fix COSEAlgorithmIdentifier in section 5.4 w3c/webauthn#2304 (2 comments by @lennartkloock, @w3cbot)
-
Exclude all platform authenticators that use self attesation from hav… w3c/webauthn#2150 (1 comment by @MasterKale)
-
Past meetings
Participants
-
1 Team contact stepped down.
-
Philippe Le Hegaret stepped down as a Team contact.
-
-
1 participant joined.
-
Ehsan Toreini (Samsung Electronics Co., Ltd.) joined.
-
-
3 participants left.
-
David Turner (W3C Invited Experts) left.
-
Philippe Le Hegaret (W3C) left.
-
Alisa Gorelova (Rakuten Group, Inc.) left.
-
GitHub
w3c/webauthn
-
3 issues opened.
-
Explainer for Level 4 w3c/webauthn#2297, by @timcappalli.
-
Conditional create with existing passkey w3c/webauthn#2296, by @kreichgauer.
-
Conditional creation incompatible with `uvInitialized` semantics in Chapter 7? w3c/webauthn#2295, by @arianvp.
-
-
7 issues closed.
-
Conditional create with existing passkey w3c/webauthn#2296.
-
kike7laguna w3c/webauthn#1634.
-
Kike7laguna@gmail.com w3c/webauthn#1653.
-
"attestationFormats" should be added to the Revision History w3c/webauthn#2268.
-
Cross-window `Virtual Authenticator Database` w3c/webauthn#2117.
-
-
6 issues received 18 new comments.
-
Conditional create with existing passkey w3c/webauthn#2296 (7 comments by @kreichgauer, @MasterKale, @nov, @pascoej, @timcappalli)
-
Conditional creation incompatible with `uvInitialized` semantics in Chapter 7? w3c/webauthn#2295 (5 comments by @arianvp, @emlun, @pascoej)
-
Is `hmac-secret` required for `prf` for non-CTAP authenticators w3c/webauthn#2285 (3 comments by @emlun, @nsatragno, @zacknewman)
-
Allow conditional mediation flow without username or password field, I.E. from button press w3c/webauthn#2084 (1 comment by @timcappalli)
-
Update COSEAlgorithmIdentifier examples and recommendations to prefer fully-specified alg IDs w3c/webauthn#2282 (1 comment by @emlun)
-
-
6 pull requests opened.
-
Generalize PRF extension processing to non-CTAP authenticators w3c/webauthn#2298, by @emlun.
-
Add `attestationFormats` to the list of new features since L2 w3c/webauthn#2292, by @MasterKale.
-
Add Immediate uiMode w3c/webauthn#2291, by @kenrb.
-
Add and prefer fully-specified COSE algorithm identifers in test vectors w3c/webauthn#2290, by @emlun.
-
Add scripts used to generate test vectors w3c/webauthn#2289, by @emlun.
-
Create Tição Baby w3c/webauthn#2288, by @TicaoBaby.
-
-
5 pull requests merged.
-
Account for new fully-specified ECDSA and Ed448 COSEAlgorithmIdentifiers w3c/webauthn#2283.
-
Add `attestationFormats` to the list of new features since L2 w3c/webauthn#2292.
-
Add and prefer fully-specified COSE algorithm identifers in test vectors w3c/webauthn#2290.
-
Add scripts used to generate test vectors w3c/webauthn#2289.
-
Add JSON partial dictionaries for extensions w3c/webauthn#2284.
-
-
2 pull requests closed.
-
Add script used to generate PRF test vectors w3c/webauthn#2281.
-
Create Tição Baby w3c/webauthn#2288.
-
-
8 pull requests received 73 new comments.
-
Account for new fully-specified ECDSA and Ed448 COSEAlgorithmIdentifiers w3c/webauthn#2283 (52 comments by @akshayku, @emlun, @OR13, @selfissued, @zacknewman)
-
Replace in-field string metadata with resource-level default fields w3c/webauthn#2280 (6 comments by @dwaite, @emlun, @MasterKale)
-
Add and prefer fully-specified COSE algorithm identifers in test vectors w3c/webauthn#2290 (4 comments by @emlun, @zacknewman)
-
Generalize PRF extension processing to non-CTAP authenticators w3c/webauthn#2298 (2 comments by @nsatragno, @zacknewman)
-
Add `attestationFormats` to the list of new features since L2 w3c/webauthn#2292 (2 comments by @emlun, @MasterKale)
-
Past meetings
Participants
-
3 participants joined.
-
Christian Rask (1Password) joined.
-
Afrizal Chen (Netcetera) joined.
-
Albert Schibani (Capital One Discover Network) joined.
-
-
1 participant left.
-
Tawanda Brandon Sibanda (Snake Nation) left.
-
-
1 organization joined.
-
Capital One Discover Network joined.
-
-
2 organizations left.
-
Snake Nation left.
-
Cloudflare left.
-
GitHub
w3c/webauthn
-
4 issues opened.
-
Add `cable` to `AuthenticatorTransport` w3c/webauthn#2286, by @zacknewman.
-
Is `hmac-secret` required for `prf` for non-CTAP authenticators w3c/webauthn#2285, by @zacknewman.
-
5.6. Abort Operations with AbortSignal needs updated for conditional mediation w3c/webauthn#2278, by @pascoej.
-
-
5 issues closed.
-
Add `cable` to `AuthenticatorTransport` w3c/webauthn#2286.
-
[L3 CR] Horizontal Review: Accessibility w3c/webauthn#2246.
-
Requiring user activation to call WebAuthn API w3c/webauthn#1293.
-
Provide a way for Web Extensions to hook into browser's Passkey autofill UI w3c/webauthn#1976.
-
-
22 issues received 42 new comments.
-
Provide a way for Web Extensions to hook into browser's Passkey autofill UI w3c/webauthn#1976 (7 comments by @arianvp, @irew, @lgarron, @nicksteele, @timcappalli)
-
Is `hmac-secret` required for `prf` for non-CTAP authenticators w3c/webauthn#2285 (5 comments by @kopy, @yackermann, @zacknewman)
-
Require clients to support new fully-specified COSEAlgorithmIdentifiers w3c/webauthn#2276 (5 comments by @emlun, @zacknewman)
-
[L3 CR] Horizontal Review: Wide Review w3c/webauthn#2248 (3 comments by @MasterKale, @nicksteele, @simoneonofri)
-
5.6. Abort Operations with AbortSignal needs updated for conditional mediation w3c/webauthn#2278 (2 comments by @nsatragno, @pascoej)
-
[L3 CR] Horizontal Review: TAG Design Reviews w3c/webauthn#2247 (2 comments by @MasterKale, @timcappalli)
-
"android-key" and "android-safetynet" are really basic attestation type support? w3c/webauthn#1819 (2 comments by @arnar, @timcappalli)
-
Allow conditional mediation flow without username or password field, I.E. from button press w3c/webauthn#2084 (1 comment by @timcappalli)
-
PublicKeyCredentialParameters can't select curve (E.g. ed448) w3c/webauthn#1446 (1 comment by @emlun)
-
-
6 pull requests opened.
-
add `cable` to `AuthenticatorTransport` w3c/webauthn#2287, by @zacknewman.
-
Add JSON partial dictionaries for extensions w3c/webauthn#2284, by @emlun.
-
Account for new fully-specified ECDSA and Ed448 COSEAlgorithmIdentifiers w3c/webauthn#2283, by @emlun.
-
Add script used to generate PRF test vectors w3c/webauthn#2281, by @emlun.
-
Replace in-field string metadata with resource-level default fields w3c/webauthn#2280, by @emlun.
-
Fix Bikeshed lint w3c/webauthn#2279, by @emlun.
-
-
2 pull requests merged.
-
Fix Bikeshed lint w3c/webauthn#2279.
-
Fix number of PRFs in AuthenticationExtensionsPRFOutputs.enabled description w3c/webauthn#2277.
-
-
3 pull requests closed.
-
add `cable` to `AuthenticatorTransport` w3c/webauthn#2287.
-
Improved version of extension for Transaction Confirmation w3c/webauthn#2020.
-
Add recovery extension w3c/webauthn#1425.
-
-
9 pull requests received 47 new comments.
-
Replace in-field string metadata with resource-level default fields w3c/webauthn#2280 (33 comments by @aphillips, @emlun, @MasterKale, @nadalin, @nsatragno, @selfissued)
-
Account for new fully-specified ECDSA and Ed448 COSEAlgorithmIdentifiers w3c/webauthn#2283 (2 comments by @nadalin, @zacknewman)
-
Add JSON partial dictionaries for extensions w3c/webauthn#2284 (2 comments by @MasterKale, @pascoej)
-
Fix number of PRFs in AuthenticationExtensionsPRFOutputs.enabled description w3c/webauthn#2277 (2 comments by @akshayku, @emlun)
-
Improved version of extension for Transaction Confirmation w3c/webauthn#2020 (1 comment by @timcappalli)
-
Past meetings
Participants
-
1 participant left.
-
Paul Knauer (Entersekt) left.
-
GitHub
w3c/webauthn
-
6 issues opened.
-
Require clients to support new fully-specified COSEAlgorithmIdentifiers w3c/webauthn#2276, by @emlun.
-
client extension results field name is unclear w3c/webauthn#2275, by @Firstyear.
-
Add -8 (Ed25519) to pubKeyCredParams sample code w3c/webauthn#2270, by @kura-lab.
-
Fix JavaScript sample code snippets w3c/webauthn#2269, by @kkoiwai.
-
"attestationFormats" should be added to the Revision History w3c/webauthn#2268, by @kkoiwai.
-
-
6 issues closed.
-
New Authenticator Extension: Time Since UV w3c/webauthn#2034.
-
Fix JavaScript sample code snippets w3c/webauthn#2269.
-
PublicKeyCredential.getClientCapabilities() - clarify required permission w3c/webauthn#2251.
-
Add -8 (Ed25519) to pubKeyCredParams sample code w3c/webauthn#2270.
-
-
17 issues received 34 new comments.
-
Add a way to use webauthn without Javascript w3c/webauthn#1255 (6 comments by @AadaEa, @Firstyear, @james-d-elliott, @sycamoreoak, @yaleman)
-
client extension results field name is unclear w3c/webauthn#2275 (6 comments by @Firstyear, @james-d-elliott)
-
Can we document protections (if any) around userHandle (with user-verification)? w3c/webauthn#2266 (2 comments by @getify, @zacknewman)
-
Require clients to support new fully-specified COSEAlgorithmIdentifiers w3c/webauthn#2276 (1 comment by @selfissued)
-
Find out whether passkeys are supported without passing value to publicKey parameter in .get() w3c/webauthn#2262 (1 comment by @MasterKale)
-
PublicKeyCredential.getClientCapabilities() - clarify required permission w3c/webauthn#2251 (1 comment by @hamishwillee)
-
Support a "create or get [or replace]" credential re-association operation w3c/webauthn#1568 (1 comment by @mitar)
-
-
4 pull requests opened.
-
Fix number of PRFs in AuthenticationExtensionsPRFOutputs.enabled description w3c/webauthn#2277, by @emlun.
-
Fix spelling in README.md w3c/webauthn#2274, by @junderw.
-
Fix PublicKeyCredentialDescriptor attribute name w3c/webauthn#2273, by @joostd.
-
#2269 Fix JavaScript sample code snippets w3c/webauthn#2271, by @kkoiwai.
-
-
4 pull requests merged.
-
#2269 Fix JavaScript sample code snippets w3c/webauthn#2271.
-
Fix spelling in README.md w3c/webauthn#2274.
-
Fix PublicKeyCredentialDescriptor attribute name w3c/webauthn#2273.
-
Remove outdated notes about permissions policy on `isUVPAA()` and `getCC()` w3c/webauthn#2267.
-
-
2 pull requests closed.
-
Acceptable UV caching time affordance extension added w3c/webauthn#2021.
-
Adds timeSinceUv extension w3c/webauthn#2052.
-
-
7 pull requests received 20 new comments.
-
Improved version of extension for Transaction Confirmation w3c/webauthn#2020 (8 comments by @mage28, @petrdvorak, @timcappalli, @ve7jtb)
-
Past meetings
GitHub
w3c/webauthn
-
8 issues opened.
-
Can we document protections (if any) around userHandle (with user-verification)? w3c/webauthn#2266, by @getify.
-
[L3 CR] Internationalization Self-Review w3c/webauthn#2260, by @timcappalli.
-
User friendly credential ID string for troubleshooting w3c/webauthn#2256, by @timcappalli.
-
-
9 issues closed.
-
User friendly credential ID string for troubleshooting w3c/webauthn#2256.
-
Add a way to use webauthn without Javascript w3c/webauthn#1255.
-
WebAuthn available to Workers? aka "silent authentication" w3c/webauthn#199.
-
Support for PWA authenticators w3c/webauthn#1514.
-
[L3 CR] Implementation Requirements w3c/webauthn#2249.
-
Synced/multi-device user Credentials w3c/webauthn#1665.
-
-
23 issues received 96 new comments.
-
Can we document protections (if any) around userHandle (with user-verification)? w3c/webauthn#2266 (18 comments by @emlun, @Firstyear, @getify, @timcappalli, @ve7jtb)
-
Add a way to use webauthn without Javascript w3c/webauthn#1255 (15 comments by @bdougherty, @ghost, @kellytk, @Kerrick, @MasterKale, @selfissued, @smlx, @sycamoreoak, @tcannonfodder)
-
Provide a method to get the count of the credentials of a rely party on client device on user permission w3c/webauthn#2255 (15 comments by @bigradish, @emlun, @Firstyear, @nicksteele, @yackermann)
-
Give each authenticator a GUID and add an option to CredentialsContainer: create method to return this GUID if user permits w3c/webauthn#2263 (12 comments by @bigradish, @Firstyear, @MasterKale, @noloader, @timcappalli)
-
User friendly credential ID string for troubleshooting w3c/webauthn#2256 (4 comments by @abergs, @emlun, @james-d-elliott, @timcappalli)
-
Find out whether passkeys are supported without passing value to publicKey parameter in .get() w3c/webauthn#2262 (4 comments by @emlun, @nehalbhanushali, @timcappalli)
-
PublicKeyCredential.getClientCapabilities() - clarify required permission w3c/webauthn#2251 (3 comments by @MasterKale, @nsatragno)
-
Update Credential Record to suggest storing RP ID as well for better Related Origins support w3c/webauthn#2257 (3 comments by @emlun, @MasterKale, @timcappalli)
-
[L3 CR] Horizontal Review: Wide Review w3c/webauthn#2248 (2 comments by @simoneonofri, @timcappalli)
-
supplementalPubKeys attestation incompatible with most verification procedures w3c/webauthn#2075 (1 comment by @emlun)
-
WebAuthn available to Workers? aka "silent authentication" w3c/webauthn#199 (1 comment by @timcappalli)
-
[L3 CR] Horizontal Review: Internationalization (i18n) w3c/webauthn#2245 (1 comment by @timcappalli)
-
Missing tasks in parallel steps in Web Authentication: An API for accessing Public Key Credentials - Level 3 w3c/webauthn#2250 (1 comment by @timcappalli)
-
-
8 pull requests opened.
-
Remove outdated notes about permissions policy on `isUVPAA()` and `getCC()` w3c/webauthn#2267, by @MasterKale.
-
chore: try 3 for fixing the issue template w3c/webauthn#2265, by @timcappalli.
-
chore: Fix issue template contact links w3c/webauthn#2264, by @timcappalli.
-
Fix test vectors heading levels w3c/webauthn#2261, by @emlun.
-
Add a new optional `rpId` to Credential Record w3c/webauthn#2258, by @MasterKale.
-
Handle Bikeshed 5.0.3 w3c/webauthn#2254, by @tabatkins.
-
Backup preference for providers who support both backed-up and non-backed up credential w3c/webauthn#2253, by @akshayku.
-
-
4 pull requests merged.
-
Fix test vectors heading levels w3c/webauthn#2261.
-
chore: try 3 for fixing the issue template w3c/webauthn#2265.
-
chore: Fix issue template contact links w3c/webauthn#2264.
-
Handle Bikeshed 5.0.3 w3c/webauthn#2254.
-
-
5 pull requests received 13 new comments.
-
Add a new optional `rpId` to Credential Record w3c/webauthn#2258 (6 comments by @emlun, @MasterKale, @sbweeden, @timcappalli)
-
Backup preference for providers who support both backed-up and non-backed up credential w3c/webauthn#2253 (4 comments by @akshayku, @emlun, @sbweeden)
-
TR publications
-
1 document published.
Past meetings
Participants
-
6 participants joined.
-
Tom Clancy (MITRE Corporation) joined.
-
Ankit Kohli (PayPal) joined.
-
Adem Derinel (Google LLC) joined.
-
Max Crone (1Password) joined.
-
Rene Leveille (1Password) joined.
-
Nicholas Steele (1Password) joined.
-
-
3 participants left.
-
Abigail Fox (Apple Inc.) left.
-
Andreas Efthymiou (Visa) left.
-
Nicholas Steele (1Password) left.
-
-
2 organizations joined.
-
MITRE Corporation joined.
-
1Password joined.
-
GitHub
w3c/webauthn
-
21 issues opened.
-
PublicKeyCredential.getClientCapabilities() - clarify required permission w3c/webauthn#2251, by @hamishwillee.
-
[L3 CR] Implementation Requirements w3c/webauthn#2249, by @timcappalli.
-
[L3 CR] Horizontal Review: Wide Review w3c/webauthn#2248, by @timcappalli.
-
[L3 CR] Horizontal Review: TAG Design Reviews w3c/webauthn#2247, by @timcappalli.
-
[L3 CR] Horizontal Review: Accessibility w3c/webauthn#2246, by @timcappalli.
-
[L3 CR] Horizontal Review: Internationalization (i18n) w3c/webauthn#2245, by @timcappalli.
-
[L3 CR] Horizontal Review: Security & Privacy w3c/webauthn#2244, by @timcappalli.
-
Preventing registration on multiple devices w3c/webauthn#2241, by @mar1n3r0.
-
Standardize abort errors w3c/webauthn#2240, by @jespertheend.
-
Facebook reported w3c/webauthn#2238, by @khabebgregor.
-
Facebook report w3c/webauthn#2237, by @khabebgregor.
-
Facebook w3c/webauthn#2236, by @khabebgregor.
-
Facebook w3c/webauthn#2235, by @khabebgregor.
-
Reports w3c/webauthn#2234, by @khabebgregor.
-
Facebook w3c/webauthn#2233, by @khabebgregor.
-
§5.10 needs revision to mention cross-domain create in iframes w3c/webauthn#2229, by @emlun.
-
Allow immediate mode w3c/webauthn#2228, by @deephand.
-
Clean up bikeshed issues before L3 publish w3c/webauthn#2226, by @timcappalli.
-
Prepare for CR w3c/webauthn#2225, by @simoneonofri.
-
WD Requirement: adding Revision History section w3c/webauthn#2223, by @simoneonofri.
-
-
15 issues closed.
-
Update top level use cases to account for multi-device credentials w3c/webauthn#1720.
-
Preventing registration on multiple devices w3c/webauthn#2241.
-
Standardize abort errors w3c/webauthn#2240.
-
§5.10 needs revision to mention cross-domain create in iframes w3c/webauthn#2229.
-
Facebook w3c/webauthn#2233.
-
Reports w3c/webauthn#2234.
-
Facebook w3c/webauthn#2235.
-
Facebook w3c/webauthn#2236.
-
Facebook report w3c/webauthn#2237.
-
Facebook reported w3c/webauthn#2238.
-
WD Requirement: adding Revision History section w3c/webauthn#2223.
-
Clean up bikeshed issues before L3 publish w3c/webauthn#2226.
-
Are notes in webauthn normative or informative? w3c/webauthn#1979.
-
-
1 issue reopened.
-
Facebook w3c/webauthn#2235, by @MasterKale.
-
-
7 issues received 30 new comments.
-
Add a way to use webauthn without Javascript w3c/webauthn#1255 (10 comments by @arianvp, @ghost, @ignaloidas, @MasterKale, @noloader, @rlin1, @selfissued, @sycamoreoak, @tcannonfodder)
-
Update top level use cases to account for multi-device credentials w3c/webauthn#1720 (1 comment by @778040465)
-
8 pull requests opened.
-
Bikeshed fixes w3c/webauthn#2243, by @simoneonofri.
-
chore: Update issue template w3c/webauthn#2242, by @timcappalli.
-
Say that tokenBinding is RESERVED in History w3c/webauthn#2239, by @selfissued.
-
Add more to L3 revision history w3c/webauthn#2232, by @emlun.
-
Address cross-origin create() in §5.10 w3c/webauthn#2231, by @emlun.
-
Proposed changes from review of PR 2224 w3c/webauthn#2230, by @emlun.
-
Fix bikeshed warnings w3c/webauthn#2227, by @timcappalli.
-
Adding Revision history section w3c/webauthn#2224, by @simoneonofri.
-
-
11 pull requests merged.
-
Bikeshed fixes w3c/webauthn#2243.
-
Update Use Cases for L3 w3c/webauthn#2139.
-
chore: Update issue template w3c/webauthn#2242.
-
Say that tokenBinding is RESERVED in History w3c/webauthn#2239.
-
Address cross-origin create() in §5.10 w3c/webauthn#2231.
-
Adding Revision history section w3c/webauthn#2224.
-
Cleanup: Manual References w3c/webauthn#2111.
-
Fix bikeshed warnings w3c/webauthn#2227.
-
Add more to L3 revision history w3c/webauthn#2232.
-
Proposed changes from review of PR 2224 w3c/webauthn#2230.
-
Make NOTEs non-normative w3c/webauthn#2196.
-
-
1 pull request closed.
-
Fix AuthenticationExtensionsAuthenticatorInputs/Outputs CDDL w3c/webauthn#2219.
-
-
9 pull requests received 41 new comments.
-
Adding Revision history section w3c/webauthn#2224 (13 comments by @emlun, @selfissued, @simoneonofri)
-
Address cross-origin create() in §5.10 w3c/webauthn#2231 (6 comments by @emlun, @nadalin, @selfissued)
-
Fix AuthenticationExtensionsAuthenticatorInputs/Outputs CDDL w3c/webauthn#2219 (1 comment by @emlun)