Re: [webauthn] Authenticators that do not recognize any handles shouldn't just be dropped on the floor

> I don't quite understand what you mean by that - notify the user about what? In the scenario where a laptop has a platform authenticator built in and navigator.credentials.get() is called with allowCredentials: [{ id: "foo" }], where foo is on a currently disconnected USB key, what would Chrome do?

Yeah, I wasn't clear. If 
a) the laptop had a platform authenticator and 
b) a request was made that *required* a platform authenticator but 
c) allowCredentials didn't have any matching credentials, 
Chrome would notify the user that the website is trying to use a credential that is not on the platform, and after dismissing the dialog Chrome would notify the RP of the same.

Otherwise, both RP and user would just sit there for the entire timeout with blank looks of confusion.

-- 
GitHub Notification of comment by kpaulh
Please view or discuss this issue at https://github.com/w3c/webauthn/issues/863#issuecomment-384363601 using your GitHub account

Received on Wednesday, 25 April 2018 17:12:21 UTC