Results 11 issues of Adam Langley

Specifications often have algorithms with many (nested) ordered lists. In those algorithms, steps often refer to other steps by number. But those numbers currently have to be maintained manually and,...

Initially filing this as a placeholder for the level three charter: As WebAuthn becomes more common (yay!) the need to support remote desktop products becomes more salient. This is delicate...

type:technical
@Risk

In #1637 I wrote: > As a measure to potentially address some of the challenges of introducing syncable credentials we have [floated](https://github.com/w3c/webauthn/issues/1546) the idea that syncable credentials may be paired...

stat:pr-open

Dear WG members, With the publication of WebAuthn Level Two and CTAP 2.1, the WebAuthn standard is now reasonably mature. Google has been talking with some other parties about how...

type:technical
@Risk

In level two we supported cross-origin assertions (when [allowed](https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-iframe-guidance) by the top-level) but omitted cross-origin creation because there wasn't anyone with a use-case. We would like to revisit that and...

type:technical
@Risk

It is of somewhat limited value because getClientCapabilities can't know what extensions the user's authenticator will support, but it can be meaningful to know that an extension isn't supported. Absent...

### WebKittens @pascoej ### Title of the spec WebAuthn PRF extension ### URL to the spec https://w3c.github.io/webauthn/#prf-extension ### URL to the spec's repository https://github.com/w3c/webauthn ### Issue Tracker URL _No response_...

topic: authentication
venue: W3C Web Authentication WG

Tor can be really bad sometimes and the hard-coded limit of 15 errors is too low. Rather, the detachment should keep going while process is being made.

crypto_openssl.c uses functions from bio.h but does not include it. This happens to work with current versions of OpenSSL because other OpenSSL headers happen to include bio.h. However, this might...

As discussed at the face-to-face, this reflects current practice where the AAGUID of platform authenticators are passed through even when attestation is not requested. *** Preview | Diff

type:technical