Akshay Kumar

@equalsJeffH , I would say that it gives flexibility in the future instead of mission creep. :)

> Whether the registration is for a user-verifying authenticator If RPs require user verification, they specify `userVerification` as `required`. RPs can always check for `uv` bit in the response to...

> How safe is it to assume that internal means platform authenticator? "Internal" means platform authenticator. However, mobiles can also act like a roaming authenticator. So in that case, in...

@agl Can an RP say that it does not want any other website to be able to invoke create command for them? Or only a allowlist of RPID that it...

The problem is around the existing platforms which are going to be there for a long time. Also, intention during credential creation should be create it if such a credential...

Looks like a real use case to me. But was wondering that if name (email) really changes?? In usernameless flows, this information cannot be provided in the authentication. In username...

Below is the our view on above proposal. This view is from RP, platform and platform authenticator perspective as we acts in all three categories. ### Background Most of the...

Isn't the makecredential response that thing?