Information

  • This event is part of TPAC 2024.
  • You need to register to attend this group meeting.

Web Authentication Working Group
  • Past
  • Confirmed
  • Group Meetings

Meeting

Event details

Date:
– Pacific Daylight Time
Status:
Confirmed
Location:
4 Concourse Level - Oceanside
Groups:
Web Authentication Working Group ( View calendar)
Participants:
Christy Chen, Matt Gibson, Wendy Seltzer
Big meeting:
TPAC 2024 (Calendar)

Agenda

 View agenda

Power back earlier, bridge is open

L3 Target Publication Schedule discussion

  1. Deadline for wide review Sunday, October 27 0024
  2. Group Call for Consensus (CfC) to move to Candidate Recommendation, wide review is done Monday, October 28 0024
  3. Transition request to Candidate Recommendation Thursday, November 7 0024

L3 WD02 open pull requests and open issues

Issues · w3c/webauthn (github.com) (30 open technical issues on L3 to resolve or move to futures)

Pull requests · w3c/webauthn (github.com) (3 technical pull requests on L3 to resolve or move to futures)

Pull requests · w3c/webauthn (github.com)

  1. Add userName and userDisplayName to webdriver by nsatragno · Pull Request #2148 · w3c/webauthn (github.com)
  2. Clarify behaviour of duplicate hints by emlun · Pull Request #2145 · w3c/webauthn (github.com)
  3. Update Use Cases for L3 by timcappalli · Pull Request #2139 · w3c/webauthn (github.com)
  4. Update obsolete privacy concerns about throwing errors early by emlun · Pull Request #2134 · w3c/webauthn (github.com)
  5. Clarify meaning of "unless" in UP flag validation by emlun · Pull Request #2126 · w3c/webauthn (github.com)
  6. Cleanup: Manual References by timcappalli · Pull Request #2111 · w3c/webauthn (github.com)
  7. https://github.com/w3c/webauthn/pulls?q=is%3Aopen+is%3Apr+milestone%3AL3-WD-02
  8. Clarify TPM attestation verification instructions by sbweeden · Pull Request #1926 · w3c/webauthn (github.com

Pull requests · w3c/webauthn (github.com)

  1. Exclude all platform authenticators that use self attesation from hav… by zacknewman · Pull Request #2150 · w3c/webauthn (github.com)
  2. Remove bikeshed workaround by dwaite · Pull Request #2149 · w3c/webauthn (github.com)

Issues · w3c/webauthn (github.com)

  1. Add `userName` and `userDisplayName` to WebDriver's `Credential Parameters` JSON object · Issue #2143 · w3c/webauthn (github.com)
  2. Clarify behaviour of duplicate hints · Issue #2135 · w3c/webauthn (github.com)
  3. Review privacy concerns around error conditions · Issue #2132 · w3c/webauthn (github.com)
  4. Remove rp.name · Issue #2121 · w3c/webauthn (github.com)
  5. CollectedClientData.crossOrigin not referenced in RP ops · Issue #2113 · w3c/webauthn (github.com)
  6. UTF-8 decode should not be required for response.clientDataJSON and cData · Issue #2100 · w3c/webauthn (github.com)
  7. [[Create]] should not access the global object directly · Issue #2092 · w3c/webauthn (github.com)
  8. create() and get() return an algorithm, not a credential · Issue #1984 · w3c/webauthn (github.com)
  9. Ambiguous instructions in the Android Key Attestation Statement Format verification procedure · Issue #1980 · w3c/webauthn (github.com)
  10. Are notes in webauthn normative or informative? · Issue #1979 · w3c/webauthn (github.com)
  11. Extensions should specify partial dictionaries that modify AuthenticationExtensionsClient{Inputs, Outputs}JSON · Issue #1968 · w3c/webauthn (github.com)
  12. [Superset] Updating credential metadata and requesting deletion of stale credentials · Issue #1967 · w3c/webauthn (github.com)
  13. Should credentials requested with attestation=none include an AAGUID? · Issue #1962 · w3c/webauthn (github.com)
  14. Non-modal registration during conditional assertion · Issue #1929 · w3c/webauthn (github.com)
  15. Adding some sentences to describe credential sharing between multiple users · Issue #1921 · w3c/webauthn (github.com)
  16. Allow desired attestation format to be an ordered list · Issue #1917 · w3c/webauthn (github.com)
  17. Describe packed enterprise attestation · Issue #1916 · w3c/webauthn (github.com)
  18. Misaligned steps in Section 7.2 · Issue #1913 · w3c/webauthn (github.com)
  19. Prescriptive behaviours for Autofill UI · Issue #1800 · w3c/webauthn (github.com)
  20. Should enterprise attestation support be flagged explicitly? · Issue #1742 · w3c/webauthn · GitHub
  21. Discussing mechanisms for enterprise RP's to enforce bound properties of credentials · Issue #1739 · w3c/webauthn · GitHub
  22. Provide passwordless example, or update 1.3.2. to be a passwordless example · Issue #1735 · w3c/webauthn · GitHub
  23. Update top level use cases to account for multi-device credentials · Issue #1720 · w3c/webauthn · GitHub
  24. Public Key Credential Source and Extensions · Issue #1719 · w3c/webauthn · GitHub
  25. RP operations: some extension processing may assume that the encompassing signature is valid · Issue #1711 · w3c/webauthn · GitHub
  26. Split RP ops "Registering a new credential" into one with and one without attestation · Issue #1710 · w3c/webauthn (github.com)
  27. Switch to permissive copyright license? · Issue #1705 · w3c/webauthn (github.com)
  28. Should an RP be able to provide finer grained authenticator filtering in attestation options? · Issue #1688 · w3c/webauthn (github.com)
  29. Lookup Credential Source by Credential ID Algorithm returns sensitive data such as the credential private key · Issue #1678 · w3c/webauthn · GitHub
  30. Synced Credentials · Issue #1665 · w3c/webauthn · GitHub
  31. Cross-origin credential creation in iframes · Issue #1656 · w3c/webauthn (github.com)
  32. Trailing position of metadata · Issue #1646 · w3c/webauthn (github.com)
  33. [Editorial] Truncation description inaccurate · Issue #1645 · w3c/webauthn (github.com)
  34. Mechanism for encoding *direction* metadata may need more work · Issue #1644 · w3c/webauthn (github.com)
  35. Use of in-field metadata not preferred · Issue #1643 · w3c/webauthn (github.com)
  36. Unicode "tag" characters are deprecated for language tagging · Issue #1642 · w3c/webauthn (github.com)
  37. U+ notation incorrect · Issue #1641 · w3c/webauthn (github.com)
  38. Syncing Platform Keys, Recoverability and Security levels · Issue #1640 · w3c/webauthn (github.com)
  39. Possible experiences in a future WebAuthn · Issue #1637 · w3c/webauthn (github.com)
  40. Missing Test Vectors · Issue #1633 · w3c/webauthn (github.com)
  41. CollectedClientData.crossOrigin default value and whether it is required · Issue #1631 · w3c/webauthn (github.com)
  42. Support for remote desktops · Issue #1577 · w3c/webauthn (github.com)
  43. Prevent browsers from deleting credentials that the RP wanted to be server-side · Issue #1569 · w3c/webauthn (github.com)
  44. Support a "create or get [or replace]" credential re-association operation · Issue #1568 · w3c/webauthn (github.com)
  45. Adding info about HSTS for the RPID to client Data. · Issue #1554 · w3c/webauthn (github.com)
  46. Making PublicKeyCredentialDescriptor.transports mandatory · Issue #1522 · w3c/webauthn (github.com)
  47. cleanup <pre class=anchors> and use <pre class="link-defaults"> as appropriate · Issue #1489 · w3c/webauthn (github.com)
  48. Regarding the issue of Credential ID exposure(13.5.6), from what perspective should RP compare RK and NRK and which should be adopted? · Issue #1484 · w3c/webauthn (github.com)
  49. Requesting properties of created credentials. · Issue #1449 · w3c/webauthn (github.com)
  50. PublicKeyCredentialParameters can't select curve (E.g. ed448) · Issue #1446 · w3c/webauthn (github.com)
  51. Minor cleanups from PR 1270 review · Issue #1291 · w3c/webauthn (github.com)
  52. Clearly define the way how RP handles the extensions · Issue #1258 · w3c/webauthn (github.com)
  53. export definitions? · Issue #1049 · w3c/webauthn (github.com)
  54. undefined terms and terms we really ought to define · Issue #462 · w3c/webauthn (github.com)

Issues · w3c/webauthn · GitHub

  1. Allow `platform`-based self attestation with non-zero AAGUID when `AttestationConveyancePreferenceOption` `"none"` is used · Issue #2146 · w3c/webauthn (github.com)
  2. Cross-window `Virtual Authenticator Database` · Issue #2117 · w3c/webauthn (github.com)
  3. Make `AuthenticatorAttestationResponseJSON.publicKeyAlgorithm` optional · Issue #2106 · w3c/webauthn (github.com)
  4. Additional guidance/clarification on RP ID and origin validation · Issue #2059 · w3c/webauthn (github.com)
  5. excludeCredentials on Get · Issue #2057 · w3c/webauthn · GitHub
  6. CollectedClientData serialization is confusing WebIDL and/or Infra values for ECMAScript values · Issue #2056 · w3c/webauthn (github.com)
  7. Deprecate AuthenticatorAttachment in favor of PublicKeyCredentialHints. · Issue #2053 · w3c/webauthn (github.com)
  8. New Authenticator Extension: Time Since UV · Issue #2034 · w3c/webauthn (github.com)
  9. Reflect caching of user gestures in WebAuthn assertion · Issue #2023 · w3c/webauthn (github.com)
  10. Revised txAuthSimple extension · Issue #2022 · w3c/webauthn (github.com)
  11. Clarify the need for truly randomly generated challenges (aka challenge callback issue) · Issue #1856 · w3c/webauthn (github.com)
  12. Cross origin authentication without iframes (accommodating SPC in WebAuthn) · Issue #1667 · w3c/webauthn · GitHub

Other open issues or discussions

Adjourn

Minutes

 Read minutes

Export options

Personal Links

Please log in to export this event with all the information you have access to.

Public Links

The following links do not contain any sensitive information and can be shared publicly.

Feedback

Report feedback and issues on GitHub.