Re: [webauthn] The user-verification default of “preferred” is catching most sites out. (#1253)

From the call of 2019-07-17: this was discussed and it was decided to close this issue. @equalsJeffH opened #1259 to make the suggestion concrete and Akshay has replied there. There was also concern that changing the default would make things even more complex for RPs as different browsers might have different values as the default for some time.

We have changed Chrome so that, with Chrome 77, any WebAuthn call that doesn't set an explicit value for `userVerification` will trigger a warning in the Javascript console pointing to [this page](https://chromium.googlesource.com/chromium/src/+/master/content/browser/webauth/uv_preferred.md). This can be silenced by specifying any explicit value. We hope this to point RPs towards considering whether `preferred` is their desired behaviour.

-- 
GitHub Notification of comment by agl
Please view or discuss this issue at https://github.com/w3c/webauthn/issues/1253#issuecomment-512559180 using your GitHub account

Received on Wednesday, 17 July 2019 20:38:22 UTC