Re: [w3ctag/design-reviews] WebAuthn Level 3: Related Origin Requests (Issue #1127)

martinthomson left a comment (w3ctag/design-reviews#1127)

The TAG has reviewed this and finds that the mechanism here is too similar to related website sets, for which we have provided [more extensive feedback](https://github.com/w3ctag/design-reviews/blob/main/reviews/first_party_sets_feedback.md).

Overall, we're not satisfied that this is the right way to authorize cross-site communication or cross-site release of identification information. We do want to acknowledge that there are some redeeming aspects of this that make this more manageable than RWS. The use of prompting/choice UX that might look similar in nature to FedCM does a lot to mitigate the downsides of this approach, but we are not confident that this has been as carefully thought out as the FedCM interactions.

If those UX interactions prove to be as good as FedCM, then the method by which different sites authorize each other seems redundant in that context; a simpler approach is probably enough.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/w3ctag/design-reviews/issues/1127#issuecomment-3187773295
You are receiving this because you are subscribed to this thread.

Message ID: <w3ctag/design-reviews/issues/1127/3187773295@github.com>