Re: [webauthn] Removing “lightning” from AuthenticatorTransport (#1294)

I am loading 13.2 on my test phone now.  When you say landed what release will that show up in?

I believe the goal is to not prompt the user to tap if there are no NFC credentials and not prompt to plugin if there are no USB credentials.

I think the idea is that for something like brave on iOS the goal is to only prompt the user to insert a key if they have one or more credentials marked as lightning. 

I don't personally think most RP are going to collect the transports and send the hints.  However I do know of atleast one that is doing that. 

If standard usb-c keys can work with iPad pros and with an adaptor on lightning devices then the hint has less value.  

Right now I don't think that it hurts anything.  The YK 5Ci identified as both USB and lightning. 

I would like to understand why you think it is a problem, or do you just think it is unneccicary for Safari?  

It should be noted that in WebAuthn level 2 this string is also used in CTAP to report the transports to the platform and from the platform to the RP.  This allows the RP to get the transport hints without a attestation. 
.
So it touches a couple of places. 

I know some people really wanted it listed as a separate transport.  There was also talk of listing the External Accessory framework separately as a transport. 
We decided to go with one hint that implies both the phisical and logical connection.

Again I hope that atleast for new versions of iOS it may become irelivent once the HID interface is available, or iOS provides a API like windows and Android for native apps (best solution in my opinion). 
John B.  




-- 
GitHub Notification of comment by ve7jtb
Please view or discuss this issue at https://github.com/w3c/webauthn/issues/1294#issuecomment-528163202 using your GitHub account

Received on Thursday, 5 September 2019 02:00:50 UTC