Re: [w3ctag/design-reviews] Broadening the user base of WebAuthn (Issue #686)

Thanks for the thorough and thoughtful reply, @agl.

While we appreciate that you aren't keen for the spec to list mitigations or privacy protections on the part of the credential sync fabric providers — which we understand — it is useful to brainstorm them. You, as a working group, will have put more thought and energy into threat modelling than anyone else at this point. It's valuable to capture that.

We'd recommend that you include something in the spec, when you get to drafting it, to share some of this thinking with implementers (even something as simple as "users are trusting credential sync fabric providers to keep their keys secure. While the mechanisms of demonstrating that trust or keeping those credentials secure is out of scope for this spec, we are flagging to implementers that they may need to focus on this problem. Without it, the entire feature won't work."). 

While the implementers may choose to address the issue in different ways, it's still helpful to give them that warning/benefit of your advanced thinking.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/w3ctag/design-reviews/issues/686#issuecomment-1031734047

You are receiving this because you are subscribed to this thread.

Message ID: <w3ctag/design-reviews/issues/686/1031734047@github.com>