Tim Cappalli
Tim Cappalli
Just another reminder that this is not a new capability and has existed in WebAuthn since L1 and is a critical part of the authenticator and credential data model. >...
@npdoty did the previous response sufficiently answer your questions about user handle?
This is not a spec concern as the spec does not dictate that clients filter extensions. Each client and user agent has their own security and privacy policies. I recommend...
> We can do deeper analysis than just that it's a risk and that someone could maybe mitigate it. Pull requests welcome. > Does 'supported' mean that there are available...
> We can do deeper analysis than just that it's a risk and that someone could maybe mitigate it. @npdoty do you know anyone who can help with this analysis...
> Is this intended to support signing in to one relying party when that party is embedded on a different site? Yes, the primary use case is a payment service...
@npdoty did my responses address your concerns?
Responses from @timcappalli @kreichgauer @nsatragno @MasterKale > How could this feature be abused? The main concern here would be user identification across (seemingly) unrelated sites. As with cross-origin iframes, this...