Emily Stark

Allow more flexibility in how 401s/407s are handled?

22

About a year ago, I refactored how HTTP authentication prompts work in Chrome, and I recently learned (https://bugs.chromium.org/p/chromium/issues/detail?id=1159476) that this refactor is kind of incompatible with fetch() and Service Workers,...

Test sites for Expect CT?

4

Hey @lgarron, we wanted to set up a couple test sites for Expect CT. Do you think we could use badssl.com for this? For example, it would be awesome to...

Certificates should have a maximum lifetime, and SPAKE2 identities should be SPKI not cert fingerprint

1

To encourage certificate agility, consider adding a relatively short maximum lifetime as in WebTransport (https://w3c.github.io/webtransport/#custom-certificate-requirements). This change would imply that the SPAKE2 identity should be formed from the subject public...

Update Android intents documentation about redirects

1

Per https://bugs.chromium.org/p/chromium/issues/detail?id=814721, it has been the case for a long time that redirects from a typed-in URL *will* in fact launch intents. We don't currently have plans to change this,...

Flags with "Nothing detected"

6

I've twice now seen a "1" badge on an orange flag with "Nothing detected" after I open the extension. This happened both times on Google-internal sites and didn't persist after...

If you use `fstream.Reader({ path: , type: 'Directory' })` and `tar` to tar up a directory whose first entry is a non-writeable file, you can't untar it with `tar`. It...

[Remote CryptoKeys] Relationship to WebAuthn PRF extension?

3

Is there any relationship between the Remote CryptoKeys proposal and the [WebAuthn PRF extension](https://github.com/w3c/webauthn/wiki/Explainer:-PRF-extension)? At first glance, my impression is that the WebAuthn PRF extension could be used for some...