Web Authentication Working Group - Activity in 2026
No matches.
Past meetings
Participants
-
7 participants joined.
-
Matthew Miller (OneSpan) joined.
-
Artiom Casapu (Google LLC) joined.
-
sanchit singal (PayPal) joined.
-
Velvizhi Rajendran (PayPal) joined.
-
Animesh Kondiparthy (PayPal) joined.
-
Sharanya Chandrasekaran (PayPal) joined.
-
Siddharth Mangesh Gothoskar (PayPal) joined.
-
-
4 participants left.
-
Matthew Miller (Cisco) left.
-
Anthony Joseph Castillo (Rakuten Group, Inc.) left.
-
Ankit Kohli (PayPal) left.
-
Haribalu V (PayPal) left.
-
-
6 organizations joined.
-
NCSC joined.
-
Apple Inc. joined.
-
Rakuten Group, Inc. joined.
-
Futurae Technologies AG joined.
-
PayPal joined.
-
Amazon joined.
-
GitHub
w3c/webauthn
-
3 issues opened.
-
Document the prfAlreadyHashed extension Android sends for hybrid PRF requests w3c/webauthn#2489, by @mimi89999.
-
Cannot validate the origin of a credential with multiple levels of framing w3c/webauthn#2488, by @micolous.
-
Wording around P1 on NFCCTAP_MSG w3c/webauthn#2484, by @My1.
-
-
1 issue closed.
-
Wording around P1 on NFCCTAP_MSG w3c/webauthn#2484.
-
-
4 issues received 9 new comments.
-
[PQ] Post Quantum Crypto and WebAuthn Transition for RP w3c/webauthn#2417 (1 comment by @Progdrasil)
-
Deprecate AuthenticatorAttachment in favor of PublicKeyCredentialHints. w3c/webauthn#2053 (1 comment by @Buer-Nahida)
-
3 pull requests opened.
-
[PQ] Make cmtgKeys extension output a list w3c/webauthn#2487, by @nsatragno.
-
Update Conditional UI without autofill explainer w3c/webauthn#2486, by @kenrb.
-
Conditional UI without autofill w3c/webauthn#2485, by @kenrb.
-
-
1 pull request merged.
-
Update Conditional UI without autofill explainer w3c/webauthn#2486.
-
-
4 pull requests received 7 new comments.
-
Add "Credential Manager Trust Group (CMTG) Key" extension w3c/webauthn#2377 (1 comment by @nsatragno)
Lifecycle
TR publications
-
1 document published.
-
Web Authentication: An API for accessing Public Key Credentials - Level 4 published as a First Public Working Draft. History of Web Authentication: An API for accessing Public Key Credentials - Level 4
-
Past meetings
Participants
-
4 participants joined.
-
Brent Zundel (Yubico) joined.
-
Michael Kohler (Interledger Foundation) joined.
-
Ioana Chiorean (Interledger Foundation) joined.
-
Sabine Schaller (Interledger Foundation) joined.
-
-
5 participants left.
-
Kaushik Satpathy (Yahoo Holdings Inc.) left.
-
Thanawat Kaewka (Yahoo Holdings Inc.) left.
-
Mert Coskuner (Yahoo Holdings Inc.) left.
-
Ronn George Jacob (Yahoo Holdings Inc.) left.
-
Melissa Sebastian (Entersekt) left.
-
-
18 organizations joined.
-
Mastercard Incorporated joined.
-
KDDI CORPORATION joined.
-
Capital One Discover Network joined.
-
1Password joined.
-
Microsoft Corporation joined.
-
Visa joined.
-
Yubico joined.
-
Entersekt joined.
-
Mozilla Foundation joined.
-
Netcetera joined.
-
IBM Corporation joined.
-
Bitwarden joined.
-
Google LLC joined.
-
Interledger Foundation joined.
-
OneSpan joined.
-
Cisco joined.
-
Meta joined.
-
Okta joined.
-
-
39 organizations left.
-
Social Web Foundation left.
-
Cybozu left.
-
Futurae Technologies AG left.
-
Capital One Discover Network left.
-
1Password left.
-
NCSC left.
-
PayPal left.
-
Jiangsu TPBlock Technology Co., Ltd. （江苏第三极区块链科技有限公司） left.
-
Netcetera left.
-
Mastercard Incorporated left.
-
Okta left.
-
Mattr Limited left.
-
Meta left.
-
360 left.
-
Samsung Electronics Co., Ltd. left.
-
Bitwarden left.
-
Apeleg Limited left.
-
Defense Information Systems Agency left.
-
KDDI CORPORATION left.
-
NTT, Inc. left.
-
American Express Company left.
-
Yahoo Holdings Inc. left.
-
National Institute of Standards and Technology (NIST) left.
-
LY Corporation left.
-
OneSpan left.
-
Rakuten Group, Inc. left.
-
Amazon left.
-
Visa left.
-
Google LLC left.
-
IBM Corporation left.
-
Alibaba Group left.
-
Apple Inc. left.
-
Entersekt left.
-
Spruce Systems, Inc. left.
-
Cisco left.
-
Microsoft Corporation left.
-
Mozilla Foundation left.
-
Ping Identity left.
-
Yubico left.
-
GitHub
w3c/webauthn
-
4 issues opened.
-
Targeting EUDI Wallet et. al. for payments w3c/webauthn#2480, by @cyberphone.
-
Add device binding to cross-device fallback URL extension w3c/webauthn#2478, by @iinuwa.
-
Credential Backup clarification (note about older authenticators) w3c/webauthn#2477, by @My1.
-
12 issues closed.
-
[Editorial] Truncation description inaccurate w3c/webauthn#1645.
-
Me w3c/webauthn#2035.
-
Sha w3c/webauthn#2036.
-
Merge changes made in L3-CR branch into main w3c/webauthn#2405.
-
Explainer for Level 4 w3c/webauthn#2297.
-
Clearly define the way how RP handles the extensions w3c/webauthn#1258.
-
export definitions? w3c/webauthn#1049.
-
Targeting EUDI Wallet et. al. for payments w3c/webauthn#2480.
-
Re-Open "confirmation" discussion (see PR#2020) w3c/webauthn#2352.
-
Call for editors for WebAuthn L4 w3c/webauthn#2406.
-
-
18 issues received 35 new comments.
-
Add a way for RPs to ensure registration of certain authenticator-supported UV methods w3c/webauthn#2482 (11 comments by @khurramhaneef-bit, @MasterKale, @micolous, @serianox, @ve7jtb)
-
Credential Backup clarification (note about older authenticators) w3c/webauthn#2477 (4 comments by @micolous, @My1)
-
Consider portable evidence manifests for attestation auditability w3c/webauthn#2436 (2 comments by @emlun, @timcappalli)
-
Targeting EUDI Wallet et. al. for payments w3c/webauthn#2480 (2 comments by @cyberphone, @timcappalli)
-
Add device binding to cross-device fallback URL extension w3c/webauthn#2478 (2 comments by @iinuwa, @timcappalli)
-
Hint to deprioritize credential providers that hold a credential in excludeCredentials w3c/webauthn#2458 (1 comment by @timcappalli)
-
double check whether the Secure Payment Confirmation effort has implications on the WebAuthn spec w3c/webauthn#1492 (1 comment by @timcappalli)
-
Mechanism for encoding *direction* metadata may need more work w3c/webauthn#1644 (1 comment by @MasterKale)
-
-
6 pull requests opened.
-
Update conditional UI without autofill explainer w3c/webauthn#2483, by @kenrb.
-
Update main for WebAuthn Level 4 w3c/webauthn#2481, by @simoneonofri.
-
Merge L3-REC into main w3c/webauthn#2479, by @emlun.
-
Update alg upgrade explainer w3c/webauthn#2476, by @nsatragno.
-
[PQ] Back up and restore overridden credentials w3c/webauthn#2475, by @nsatragno.
-
Update algorithm upgrades explainer w3c/webauthn#2474, by @nsatragno.
-
-
5 pull requests merged.
-
Update conditional UI without autofill explainer w3c/webauthn#2483.
-
Merge L3-REC into main w3c/webauthn#2479.
-
Remove files that haven't been touched in years w3c/webauthn#2463.
-
Update alg upgrade explainer w3c/webauthn#2476.
-
Update algorithm upgrades explainer w3c/webauthn#2474.
-
-
6 pull requests received 25 new comments.
-
Add "Credential Manager Trust Group (CMTG) Key" extension w3c/webauthn#2377 (9 comments by @emlun, @timcappalli)
-
Add Cross Device Fallback URL extension for hybrid transport authentication w3c/webauthn#2380 (5 comments by @harshlal028, @iinuwa, @MasterKale, @pascoej)
-
Lifecycle
-
1 charter extension.
-
Charter extended until 30 October 2026.
-
TR publications
-
1 document published.
Past meetings
Participants
-
1 participant joined.
-
Shubham Sharma (Amazon) joined.
-
-
1 participant left.
-
Andre Büttner (W3C Invited Experts) left.
-
GitHub
w3c/webauthn
-
10 issues opened.
-
[PQ] SHA-256 usage w3c/webauthn#2471, by @timcappalli.
-
Consider deprecating COSE algorithm identifier -7 in favour of -9. w3c/webauthn#2469, by @nsatragno.
-
Should a CTAP2 virtual authenticator support CTAP1/U2F? w3c/webauthn#2468, by @micolous.
-
Document risks of allowing multiple origins w3c/webauthn#2466, by @emlun.
-
Hints should not take precendence over transports in an authentication ceremony w3c/webauthn#2465, by @sbweeden.
-
Virtual authenticator add credential command should handle default parameters better w3c/webauthn#2464, by @nsatragno.
-
`pkOptions.pubKeyCredParams` default will be unsafe after Q-day w3c/webauthn#2462, by @nsatragno.
-
Cross-RP batch enrollment of a backup security key w3c/webauthn#2460, by @yubinhu.
-
4 issues closed.
-
[L3 REC] Transition Request Draft w3c/webauthn#2399.
-
Consider deprecating COSE algorithm identifier -7 in favour of -9. w3c/webauthn#2469.
-
`pkOptions.pubKeyCredParams` default will be unsafe after Q-day w3c/webauthn#2462.
-
Virtual authenticator should allow `counter` to always be `0` w3c/webauthn#2363.
-
-
1 issue reopened.
-
Support for WebDriver BiDi w3c/webauthn#2072, by @nsatragno.
-
-
13 issues received 35 new comments.
-
Document risks of allowing multiple origins w3c/webauthn#2466 (8 comments by @emlun, @FiloSottile, @Firstyear, @james-d-elliott)
-
[PQ] Add new batch attestation type for Merkle tree certificates w3c/webauthn#2456 (5 comments by @iinuwa, @timcappalli, @ve7jtb, @zacknewman)
-
`pkOptions.pubKeyCredParams` default will be unsafe after Q-day w3c/webauthn#2462 (3 comments by @MasterKale, @nsatragno, @ve7jtb)
-
Consider deprecating COSE algorithm identifier -7 in favour of -9. w3c/webauthn#2469 (2 comments by @emlun, @nsatragno)
-
[PQ] Default Algorithems for Authenticators perhaps need updating. w3c/webauthn#2448 (2 comments by @nsatragno, @ve7jtb)
-
Hints should not take precendence over transports in an authentication ceremony w3c/webauthn#2465 (1 comment by @sbweeden)
-
Virtual authenticator should allow `counter` to always be `0` w3c/webauthn#2363 (1 comment by @MasterKale)
-
Conditional creation incompatible with `uvInitialized` semantics in Chapter 7? w3c/webauthn#2295 (1 comment by @arianvp)
-
-
3 pull requests opened.
-
Add algorithm upgrade explainer w3c/webauthn#2473, by @nsatragno.
-
Fix indentation of step to invoke authenticatorMakeCredential w3c/webauthn#2470, by @emlun.
-
Remove files that haven't been touched in years w3c/webauthn#2463, by @MasterKale.
-
-
1 pull request merged.
-
Add algorithm upgrade explainer w3c/webauthn#2473.
-
-
6 pull requests received 66 new comments.
-
Add Cross Device Fallback URL extension for hybrid transport authentication w3c/webauthn#2380 (38 comments by @christiaanbrand, @harshlal028, @iinuwa, @kreichgauer, @timcappalli)
-
Add virtual authenticator support for CMTG keys w3c/webauthn#2445 (10 comments by @MasterKale, @nsatragno)
-
Add "Credential Manager Trust Group (CMTG) Key" extension w3c/webauthn#2377 (8 comments by @harshlal028)
-
Past meetings
Participants
-
1 participant left.
-
Tom Clancy (MITRE Corporation) left.
-
-
2 organizations left.
-
MITRE Corporation left.
-
Discover Financial Services LLC left.
-
GitHub
w3c/webauthn
-
13 issues opened.
-
Hint to deprioritize credential providers that hold a credential in excludeCredentials w3c/webauthn#2458, by @kokukuma.
-
Multiple independent applications on one host w3c/webauthn#2457, by @spbooth.
-
[PQ] Add new batch attestation type for Merkle tree certificates w3c/webauthn#2456, by @ve7jtb.
-
[PQ] Default Algorithems for Authenticators perhaps need updating. w3c/webauthn#2448, by @ve7jtb.
-
"Invoke the authenticatorMakeCredential operation" step is accidentally indented w3c/webauthn#2444, by @emlun.
-
Extension input processing directions are inconsistent w3c/webauthn#2439, by @emlun.
-
2 issues closed.
-
Fix compatibility with Bikeshed 7 w3c/webauthn#2428.
-
8 issues received 17 new comments.
-
Missing validation of rpId before Related Origins fetch w3c/webauthn#2422 (6 comments by @iinuwa, @nadalin, @nsatragno, @pascoej)
-
[PQ] Default Algorithems for Authenticators perhaps need updating. w3c/webauthn#2448 (4 comments by @akshayku, @MasterKale, @zacknewman)
-
Multiple independent applications on one host w3c/webauthn#2457 (2 comments by @spbooth, @timcappalli)
-
Virtual authenticator should specify the error code when the signature counter is missing. w3c/webauthn#2454 (1 comment by @nsatragno)
-
5.4.3 "the user handle ought not be" -> RFC 2119 Terminology w3c/webauthn#2431 (1 comment by @thejangid)
-
[PQ] Post Quantum Crypto and WebAuthn Transition for RP w3c/webauthn#2417 (1 comment by @MasterKale)
-
-
8 pull requests opened.
-
Simplify algPolicy Further - Explainer Update. w3c/webauthn#2455, by @akshayku.
-
Clarify that credentialId in Virtual Authenticator URLs is base64url encoded w3c/webauthn#2451, by @homayounmmdy.
-
Add explainer for simple PQC migration. w3c/webauthn#2449, by @nsatragno.
-
Add virtual authenticator support for CMTG keys w3c/webauthn#2445, by @nsatragno.
-
Adds mise to local tooling w3c/webauthn#2443, by @timcappalli.
-
Upgrade to Bikeshed 7 w3c/webauthn#2442, by @MasterKale.
-
Introduce a better local development setup w3c/webauthn#2441, by @MasterKale.
-
Simplify Algorithm Migration Proposal Explainer w3c/webauthn#2440, by @akshayku.
-
-
8 pull requests merged.
-
Update Virtual Authenticator API to better emulate synced passkey behavior w3c/webauthn#2382.
-
Simplify algPolicy Further - Explainer Update. w3c/webauthn#2455.
-
Introduce a better local development setup w3c/webauthn#2441.
-
Add explainer for simple PQC migration. w3c/webauthn#2449.
-
Adds mise to local tooling w3c/webauthn#2443.
-
Upgrade to Bikeshed 7 w3c/webauthn#2442.
-
chore: removing type attribute for HTML validation during spec generation w3c/webauthn#2429.
-
Simplify Algorithm Migration Proposal Explainer w3c/webauthn#2440.
-
-
10 pull requests received 95 new comments.
-
Support Algorithm Migration w3c/webauthn#2437 (35 comments by @akshayku, @harshlal028, @MasterKale, @nsatragno)
-
Update Virtual Authenticator API to better emulate synced passkey behavior w3c/webauthn#2382 (15 comments by @kreichgauer, @MasterKale, @nsatragno)
-
Upgrade to Bikeshed 7 w3c/webauthn#2442 (11 comments by @akshayku, @emlun, @MasterKale, @simoneonofri)
-
Add "Credential Manager Trust Group (CMTG) Key" extension w3c/webauthn#2377 (10 comments by @bjorn3, @MasterKale, @nsatragno, @timcappalli)
-
Add Cross Device Fallback URL extension for hybrid transport authentication w3c/webauthn#2380 (6 comments by @harshlal028, @MasterKale, @timcappalli)
-
Add virtual authenticator support for CMTG keys w3c/webauthn#2445 (5 comments by @nsatragno, @timcappalli)
-
Past meetings
Participants
-
3 participants left.
-
Jorge Vargas (Discover Financial Services LLC) left.
-
Sridhar Muppidi (IBM Corporation) left.
-
Henna Kapur (Visa) left.
-
GitHub
w3c/webauthn
-
2 issues opened.
-
Consider portable evidence manifests for attestation auditability w3c/webauthn#2436, by @GXP53.
-
Discourage bootstrapping new credential provider as part of CREATE call w3c/webauthn#2432, by @rlin1.
-
-
8 issues received 20 new comments.
-
Discourage bootstrapping new credential provider as part of CREATE call w3c/webauthn#2432 (6 comments by @dwaite, @Firstyear, @rlin1)
-
[PQ] Post Quantum Crypto and WebAuthn Transition for RP w3c/webauthn#2417 (2 comments by @MasterKale)
-
-
5 pull requests opened.
-
algPolicy Extension and acceptedAlgs Explainer Update w3c/webauthn#2438, by @akshayku.
-
Support Algorithm Migration w3c/webauthn#2437, by @akshayku.
-
Ambient explainer update w3c/webauthn#2435, by @kenrb.
-
Create npm-publish.yml w3c/webauthn#2434, by @smarthomespropertieske-pixel.
-
[WIP] PQC Migration Explainer w3c/webauthn#2433, by @akshayku.
-
-
3 pull requests merged.
-
algPolicy Extension and acceptedAlgs Explainer Update w3c/webauthn#2438.
-
Ambient explainer update w3c/webauthn#2435.
-
[WIP] PQC Migration Explainer w3c/webauthn#2433.
-
-
1 pull request closed.
-
Create npm-publish.yml w3c/webauthn#2434.
-
-
7 pull requests received 17 new comments.
-
Add Cross Device Fallback URL extension for hybrid transport authentication w3c/webauthn#2380 (4 comments by @harshlal028, @kreichgauer)
-
Add "Credential Manager Trust Group (CMTG) Key" extension w3c/webauthn#2377 (4 comments by @MasterKale, @nsatragno, @timcappalli)
-
Update Virtual Authenticator API to better emulate synced passkey behavior w3c/webauthn#2382 (1 comment by @MasterKale)
-
TR publications
-
1 document published.
-
Web Authentication: An API for accessing Public Key Credentials - Level 3 published as a Candidate Recommendation Snapshot. History of Web Authentication: An API for accessing Public Key Credentials - Level 3
-
Past meetings
Participants
-
1 participant left.
-
Jason Cai (Amazon) left.
-
GitHub
w3c/webauthn
-
4 issues opened.
-
5.4.3 "the user handle ought not be" -> RFC 2119 Terminology w3c/webauthn#2431, by @My1.
-
Fix compatibility with Bikeshed 7 w3c/webauthn#2428, by @emlun.
-
remoteClientDataJSON Extension Inconsistencies w3c/webauthn#2423, by @akshayku.
-
-
9 issues closed.
-
Consider RP ID migration use cases w3c/webauthn#2350.
-
user verification discouraged should consider privacy impact or UA advice w3c/webauthn#2323.
-
Ensure hard-coded step references are correct w3c/webauthn#2418.
-
Need to have authenticator-only extensions w3c/webauthn#2331.
-
New `userVerification` value with conditional behavior w3c/webauthn#2310.
-
Document privacy considerations of immediate mediation w3c/webauthn#2307.
-
Eliminate duplicate terminology w3c/webauthn#1648.
-
remoteClientDataJSON Extension Inconsistencies w3c/webauthn#2423.
-
-
14 issues received 19 new comments.
-
5.4.3 "the user handle ought not be" -> RFC 2119 Terminology w3c/webauthn#2431 (3 comments by @My1, @timcappalli)
-
remoteClientDataJSON: default allowlist 'none' is not yet defined in Permissions Policy spec w3c/webauthn#2430 (2 comments by @bobomb, @kreichgauer)
-
user verification discouraged should consider privacy impact or UA advice w3c/webauthn#2323 (1 comment by @timcappalli)
-
Update: COSE elliptic curve signatures 'in the wild' from small RustyKey® alpha-test user base w3c/webauthn#2339 (1 comment by @emlun)
-
New `userVerification` value with conditional behavior w3c/webauthn#2310 (1 comment by @timcappalli)
-
Document privacy considerations of immediate mediation w3c/webauthn#2307 (1 comment by @timcappalli)
-
-
5 pull requests opened.
-
chore: removing type attribute for HTML validation during spec generation w3c/webauthn#2429, by @simoneonofri.
-
Document compatible Bikeshed version for L3 w3c/webauthn#2427, by @emlun.
-
Editorial tweaks to PR #2377 w3c/webauthn#2426, by @emlun.
-
Rebase w3c/webauthn#2425, by @Brunojoe1994.
-
remoteClientDataJSONCorrection Typos/Inconsistencies w3c/webauthn#2424, by @akshayku.
-
-
5 pull requests merged.
-
Document compatible Bikeshed version for L3 w3c/webauthn#2427.
-
Editorial tweaks to PR #2377 w3c/webauthn#2426.
-
Bikeshed lint: Set section ID for "Well-Known URI Registration" w3c/webauthn#2420.
-
Update hard-coded numbers in references to algorithm steps w3c/webauthn#2419.
-
remoteClientDataJSONCorrection Typos/Inconsistencies w3c/webauthn#2424.
-
-
1 pull request closed.
-
Rebase w3c/webauthn#2425.
-
-
4 pull requests received 60 new comments.
-
Add Cross Device Fallback URL extension for hybrid transport authentication w3c/webauthn#2380 (47 comments by @harshlal028, @kreichgauer, @MasterKale, @nsatragno)
-
Add "Credential Manager Trust Group (CMTG) Key" extension w3c/webauthn#2377 (11 comments by @arnar, @emlun, @nsatragno, @timcappalli)
-
Update hard-coded numbers in references to algorithm steps w3c/webauthn#2419 (1 comment by @simoneonofri)
-
Lifecycle
-
1 charter extension.
-
Charter extended until 30 July 2026.
-
Past meetings
Participants
-
1 participant joined.
-
Tina B (Microsoft Corporation) joined.
-
-
2 participants left.
-
Duy-Tung LUU (CANTON CONSULTING) left.
-
Jean-Yves ROSSI (CANTON CONSULTING) left.
-
-
1 organization left.
-
CANTON CONSULTING left.
-
GitHub
w3c/webauthn
-
10 issues opened.
-
Missing validation of rpId before Related Origins fetch w3c/webauthn#2422, by @a2kolbasov.
-
longraklongrk@gmail.com w3c/webauthn#2421, by @longraklongrk-afk.
-
Ensure hard-coded step references are correct w3c/webauthn#2418, by @emlun.
-
[PQ] Post Quantum Crypto and WebAuthn Transition for RP w3c/webauthn#2417, by @akshayku.
-
Related origin validation should reference the Fetch spec w3c/webauthn#2408, by @kreichgauer.
-
Call for editors for WebAuthn L4 w3c/webauthn#2406, by @nadalin.
-
Merge changes made in L3-CR branch into main w3c/webauthn#2405, by @selfissued.
-
Add CTAP2.3 version string for virtual authenticators w3c/webauthn#2404, by @emlun.
-
-
5 issues closed.
-
Support for remote desktops w3c/webauthn#1577.
-
longraklongrk@gmail.com w3c/webauthn#2421.
-
issue w3c/webauthn#2410.
-
issue w3c/webauthn#2411.
-
Forbid authenticator data from containing plaintext PRF outputs w3c/webauthn#2359.
-
-
5 issues received 22 new comments.
-
Related origin validation should reference the Fetch spec w3c/webauthn#2408 (9 comments by @jschanck, @kreichgauer)
-
Call for editors for WebAuthn L4 w3c/webauthn#2406 (7 comments by @akshayku, @dwaite, @emlun, @MasterKale, @nsatragno, @pascoej, @timcappalli)
-
Add Credential Manager Trust Group Key (CMTG) extension w3c/webauthn#2338 (3 comments by @arnar, @mimi89999)
-
Add a way to use webauthn without Javascript w3c/webauthn#1255 (2 comments by @ris-work, @sycamoreoak)
-
-
6 pull requests opened.
-
Bikeshed lint: Set section ID for "Well-Known URI Registration" w3c/webauthn#2420, by @emlun.
-
Update hard-coded numbers in references to algorithm steps w3c/webauthn#2419, by @emlun.
-
chore: Restore explainer images w3c/webauthn#2416, by @timcappalli.
-
Update the Immediate Mode explainer w3c/webauthn#2407, by @kenrb.
-
Reference CTAP 2.3 w3c/webauthn#2403, by @selfissued.
-
Updating Editors/Contributors for L3 w3c/webauthn#2402, by @simoneonofri.
-
-
7 pull requests merged.
-
remoteClientDataJSON Extension w3c/webauthn#2375.
-
chore: Restore explainer images w3c/webauthn#2416.
-
Forbid authenticator data from containing cleartext PRF outputs w3c/webauthn#2372.
-
Updating Editors/Contributors for L3 w3c/webauthn#2402.
-
Update the Immediate Mode explainer w3c/webauthn#2407.
-
Reference CTAP 2.3 w3c/webauthn#2403.
-
chore: Migrate Explainers from Wiki to repo w3c/webauthn#2398.
-
-
7 pull requests received 100 new comments.
-
Add Cross Device Fallback URL extension for hybrid transport authentication w3c/webauthn#2380 (27 comments by @harshlal028, @nsatragno, @sbweeden)
-
Deprecate Authenticator Attachment in favor of Hints w3c/webauthn#2383 (5 comments by @akshayku, @harshlal028, @nsatragno)
-
Bikeshed lint: Set section ID for "Well-Known URI Registration" w3c/webauthn#2420 (3 comments by @emlun, @Progdrasil)
Past meetings
GitHub
w3c/webauthn
-
4 issues opened.
-
Reconcile hybrid vs PXP throughout the spec w3c/webauthn#2401, by @timcappalli.
-
[L3 REC] Transition Request Draft w3c/webauthn#2399, by @simoneonofri.
-
Passkeys are phishing-resistant… but what if the device is compromised? w3c/webauthn#2396, by @aniketd1.
-
Virtual Authenticator support for the Credential Manager Trust Group Key extentsion w3c/webauthn#2395, by @timcappalli.
-
-
2 issues closed.
-
privacy implications of cross-origin iframe w3c/webauthn#2321.
-
related origins enables sharing across relying parties w3c/webauthn#2319.
-
-
7 issues received 13 new comments.
-
Client terminology hints for external authenticator form factors w3c/webauthn#2360 (5 comments by @harshlal028, @timcappalli)
-
Reconcile hybrid vs PXP throughout the spec w3c/webauthn#2401 (3 comments by @lgarron, @MasterKale, @zacknewman)
-
Passkeys are phishing-resistant… but what if the device is compromised? w3c/webauthn#2396 (1 comment by @timcappalli)
-
related origins enables sharing across relying parties w3c/webauthn#2319 (1 comment by @simoneonofri)
-
-
3 pull requests opened.
-
Restore inadvertently overwritten change to '[=RP ID=]' w3c/webauthn#2400, by @emlun.
-
chore: Migrate Explainers from Wiki to repo w3c/webauthn#2398, by @timcappalli.
-
Add software-enforced android-key test vector w3c/webauthn#2397, by @Unknown-Robot.
-
-
3 pull requests merged.
-
Restore inadvertently overwritten change to '[=RP ID=]' w3c/webauthn#2400.
-
Privacy considerations for cross-origin usage w3c/webauthn#2391.
-
Fix missing ASN.1 values in android-key test vector w3c/webauthn#2379.
-
-
1 pull request reopened.
-
Fix missing ASN.1 values in android-key test vector w3c/webauthn#2379, by @emlun.
-
-
6 pull requests received 33 new comments.
-
Add "Credential Manager Trust Group (CMTG) Key" extension w3c/webauthn#2377 (10 comments by @nsatragno, @timcappalli)
-
Privacy considerations for cross-origin usage w3c/webauthn#2391 (8 comments by @emlun, @nadalin, @npdoty, @timcappalli)
-
Add Cross Device Fallback URL extension for hybrid transport authentication w3c/webauthn#2380 (5 comments by @harshlal028, @timcappalli)
-
Fix missing ASN.1 values in android-key test vector w3c/webauthn#2379 (4 comments by @emlun, @simoneonofri, @Unknown-Robot)
-
Deprecate Authenticator Attachment in favor of Hints w3c/webauthn#2383 (2 comments by @harshlal028, @zacknewman)
-
Past meetings
Participants
-
1 participant joined.
-
Ruoshi Sun (Meta) joined.
-
-
1 participant left.
-
Douglas Fisher (Visa) left.
-
GitHub
w3c/webauthn
-
6 issues opened.
-
Extension to detect the use of Hybrid w3c/webauthn#2394, by @jovasco.
-
[PQ] Add ML-DSA test vectors w3c/webauthn#2393, by @emlun.
-
Proposal: Scoped Attestation Privacy + Practical CBOR Size Guidance (WebAuthn L3) w3c/webauthn#2390, by @fazoncore.
-
Rechartering WebAuthn w3c/webauthn#2388, by @simoneonofri.
-
frankjesusgonzales w3c/webauthn#2386, by @exstremeclouds-collab.
-
-
6 issues closed.
-
Push due date of milestone to after we reconvene w3c/webauthn#2332.
-
See you F2F at TPAC 2026 in Kobe? Decide < 2025-06-20 w3c/webauthn#2303.
-
frankjesusgonzales w3c/webauthn#2386.
-
6 issues received 17 new comments.
-
Proposal: Scoped Attestation Privacy + Practical CBOR Size Guidance (WebAuthn L3) w3c/webauthn#2390 (9 comments by @emlun, @fazoncore, @timcappalli)
-
Client terminology hints for external authenticator form factors w3c/webauthn#2360 (3 comments by @rlin1, @timcappalli)
-
Push due date of milestone to after we reconvene w3c/webauthn#2332 (2 comments by @nicksteele, @timcappalli)
-
https://github.com/w3c/webauthn/issues#:~:text=%E5%9C%A8-,w3c,-/webauthn%20%E4%B8%AD%E5%BB%BA%E7%AB%8B w3c/webauthn#2392 (1 comment by @h4795554-sudo)
-
Virtual authenticator should allow `counter` to always be `0` w3c/webauthn#2363 (1 comment by @MasterKale)
-
-
3 pull requests opened.
-
Privacy considerations for cross-origin usage w3c/webauthn#2391, by @timcappalli.
-
Added the hybrid fallback URL extension w3c/webauthn#2389, by @muditagrawal2007.
-
Adds additional hints for form factors w3c/webauthn#2387, by @timcappalli.
-
-
3 pull requests merged.
-
Fix incorrect ASN.1 encoding in android-key test vector w3c/webauthn#2378.
-
Fix single quote misinterpreted as possessive/contraction apostrophe w3c/webauthn#2384.
-
1 pull request closed.
-
Added the hybrid fallback URL extension w3c/webauthn#2389.
-
-
1 pull request reopened.
-
Fix missing ASN.1 values in android-key test vector w3c/webauthn#2379, by @emlun.
-
-
8 pull requests received 113 new comments.
-
Add "Credential Manager Trust Group (CMTG) Key" extension w3c/webauthn#2377 (31 comments by @nsatragno, @timcappalli)
-
Update Virtual Authenticator API to better emulate synced passkey behavior w3c/webauthn#2382 (30 comments by @emlun, @kreichgauer, @MasterKale, @nsatragno)
-
remoteClientDataJSON Extension w3c/webauthn#2375 (25 comments by @akshayku, @awakecoding, @kreichgauer, @MasterKale, @timcappalli)
-
Add JSON object properties table to Set User Verified virtual authenticator endpoint w3c/webauthn#2381 (6 comments by @emlun, @MasterKale, @nsatragno, @sbweeden)
-
Fix missing ASN.1 values in android-key test vector w3c/webauthn#2379 (3 comments by @emlun, @Unknown-Robot)
-
Fix single quote misinterpreted as possessive/contraction apostrophe w3c/webauthn#2384 (2 comments by @emlun, @simoneonofri)
-
TR publications
-
1 document published.
-
Web Authentication: An API for accessing Public Key Credentials - Level 3 published as a Candidate Recommendation Snapshot. History of Web Authentication: An API for accessing Public Key Credentials - Level 3
-
Past meetings
Participants
-
4 participants joined.
-
Andrew Comminos (Meta) joined.
-
Harsh Lal (Google LLC) joined.
-
Chandana Sathish (1Password) joined.
-
Sanjana Bonneau-Desai (1Password) joined.
-
-
1 participant left.
-
Albert Schibani (Capital One Discover Network) left.
-
-
1 organization joined.
-
Social Web Foundation joined.
-
GitHub
w3c/webauthn
-
1 issue opened.
-
Editors, Contributors and Acknowledgements Review w3c/webauthn#2385, by @nadalin.
-
-
6 issues closed.
-
[L3 CR] Transition Request Draft w3c/webauthn#2355.
-
[L3 CR] Internationalization Self-Review w3c/webauthn#2260.
-
[L3 CR] Horizontal Review: TAG Design Reviews w3c/webauthn#2247.
-
[L3 CR] Horizontal Review: Internationalization (i18n) w3c/webauthn#2245.
-
Prepare for CR w3c/webauthn#2225.
-
are user handles in the wild including user data? w3c/webauthn#2324.
-
-
6 issues received 14 new comments.
-
Virtual authenticator should allow `counter` to always be `0` w3c/webauthn#2363 (7 comments by @kreichgauer, @MasterKale)
-
Editors, Contributors and Acknowledgements Review w3c/webauthn#2385 (2 comments by @MasterKale, @nadalin)
-
Incorrect ASN.1 tagging (INTEGER vs ENUMERATED) in Android Key Attestation test vector w3c/webauthn#2373 (2 comments by @arnar, @emlun)
-
-
10 pull requests opened.
-
Fix single quote misinterpreted as possessive/contraction apostrophe w3c/webauthn#2384, by @emlun.
-
Deprecate Authenticator Attachment in favor of Hints w3c/webauthn#2383, by @akshayku.
-
Update Virtual Authenticator API to better emulate synced passkey behavior w3c/webauthn#2382, by @MasterKale.
-
Add JSON object properties table to Set User Verified virtual authenticator endpoint w3c/webauthn#2381, by @MasterKale.
-
Add Cross Device Fallback URL extension for hybrid transport authentication w3c/webauthn#2380, by @harshlal028.
-
Fix missing ASN.1 values in android-key test vector w3c/webauthn#2379, by @Unknown-Robot.
-
Fix incorrect ASN.1 encoding in android-key test vector w3c/webauthn#2378, by @emlun.
-
Add "Credential Manager Trust Group (CMTG) Key" extension w3c/webauthn#2377, by @timcappalli.
-
Add .well-known/webauthn registration w3c/webauthn#2376, by @selfissued.
-
remoteClientDataJSON Extension w3c/webauthn#2375, by @akshayku.
-
-
1 pull request merged.
-
Add .well-known/webauthn registration w3c/webauthn#2376.
-
-
6 pull requests received 24 new comments.
-
Deprecate Authenticator Attachment in favor of Hints w3c/webauthn#2383 (9 comments by @akshayku, @MasterKale, @timcappalli)
-
remoteClientDataJSON Extension w3c/webauthn#2375 (6 comments by @akshayku, @kreichgauer, @MasterKale)
-
Add Cross Device Fallback URL extension for hybrid transport authentication w3c/webauthn#2380 (3 comments by @arnar)
-
Fix incorrect ASN.1 encoding in android-key test vector w3c/webauthn#2378 (2 comments by @emlun, @Unknown-Robot)
-
Fix single quote misinterpreted as possessive/contraction apostrophe w3c/webauthn#2384 (1 comment by @emlun)
-