public-webauthn@w3.org from November 2016 by date

Wednesday, 30 November 2016

• [w3c/webauthn] 8fac8d: properly ref 'normalize an algorithm' fixes #262; ... GitHub
• [webauthn] new commits pushed by equalsJeffH =JeffH via GitHub
• Re: [webauthn] Link to WebCrypto API is stale =JeffH via GitHub
• [w3c/webauthn] 3f91a6: fixup sample-authn example step 9. fixes #234 GitHub
• [webauthn] new commits pushed by equalsJeffH =JeffH via GitHub
• [w3c/webauthn] 931199: add @bzbarsky to acks GitHub
• [webauthn] new commits pushed by equalsJeffH =JeffH via GitHub
• [w3c/webauthn] 2791e1: Built by Travis-CI: f891d0cb3a756d0cc4c97259301b62... GitHub
• [webauthn] new commits pushed by WebAuthnBot WebAuthnBot via GitHub
• [w3c/webauthn] GitHub
• [w3c/webauthn] ad12bd: remove ScopedCredentialInfo.publicKey; use credent... GitHub
• [w3c/webauthn] 5f9172: tag Navigator w/ <a> GitHub
• [webauthn] new commits pushed by equalsJeffH =JeffH via GitHub
• Re: suggested issues to close (was: 11/30/2016 W3C Web Authentication WG Agenda Hodges, Jeff
• Re: [webauthn] Clarify how a user can authenticate from multiple devices =JeffH via GitHub
• Closed: [webauthn] Scoped credentials represent a relationship between user and RP =JeffH via GitHub
• Re: [webauthn] Scoped credentials represent a relationship between user and RP =JeffH via GitHub
• Re: [webauthn] also cite the other extant TLS channel binding mechanisms? =JeffH via GitHub
• Closed: [webauthn] also cite the other extant TLS channel binding mechanisms? =JeffH via GitHub
• Re: [webauthn] Clarify uses of ClientData gmandyam via GitHub
• Re: [webauthn] Clarify uses of ClientData =JeffH via GitHub
• RE: 11/30/2016 W3C Web Authentication WG Agenda Vijay Bharadwaj
• Re: [webauthn] Clarify uses of ClientData Vijay Bharadwaj via GitHub
• bridge for today's WebAuthn call Samuel Weiler
• Re: [webauthn] Can the "attestation" of a WebAuthnAttestation be a non-object? =JeffH via GitHub
• Re: 11/30/2016 W3C Web Authentication WG Agenda Richard Barnes

Tuesday, 29 November 2016

• 11/30/2016 W3C Web Authentication WG Agenda Anthony Nadalin

Wednesday, 23 November 2016

• Re: [webauthn] Refine meaning of ScopedCredentialType to be "signature & assertion format (and version thereof)" Rolf Lindemann via GitHub

Tuesday, 22 November 2016

• 11/23/2016 W3C WebAuthentication WG Agenda Anthony Nadalin
• [w3c/webauthn] 0049e1: Built by Travis-CI: a5e28e82c5e37b21ed5f29c44ac4e5... GitHub
• [webauthn] new commits pushed by WebAuthnBot WebAuthnBot via GitHub
• [w3c/webauthn] a5e28e: point at github milestones GitHub
• [webauthn] new commits pushed by samweiler samweiler via GitHub
• Re: 11/23/2016 W3C WebAuthentication WG Agenda Hodges, Jeff

Monday, 21 November 2016

• 11/23/2016 W3C WebAuthentication WG Agenda Anthony Nadalin

Saturday, 19 November 2016

• Re: [webauthn] should authenticator layer send hashed or unhashed rpId to authenticators? Angelo Liao via GitHub

Friday, 18 November 2016

• Re: [webauthn] Clarify uses of ClientData gmandyam via GitHub
• Re: [webauthn] Credential ID not signed Angelo Liao via GitHub
• Re: [webauthn] Clarify uses of ClientData Angelo Liao via GitHub
• Re: [webauthn] Move `allowList` from optional to default on `getAssertion` Angelo Liao via GitHub
• [webauthn] Throw "NotFoundError" when internal authenticator is not available or not found Angelo Liao via GitHub
• Re: [webauthn] The W3C HTML spec is broken, and probably shouldn't be referenced Boris Zbarsky via GitHub
• Re: [webauthn] The W3C HTML spec is broken, and probably shouldn't be referenced Angelo Liao via GitHub

Wednesday, 16 November 2016

• Re: [webauthn] I don't understand how to create a ClientData in makeCredential J.C. Jones via GitHub
• Fwd: Intent to Implement: Web Authentication API for Chrome aczeskis@google.com
• Re: [webauthn] callerOrigin isn't actually the origin of the caller; it's the origin of the callee Boris Zbarsky via GitHub
• Re: [webauthn] callerOrigin isn't actually the origin of the caller; it's the origin of the callee Angelo Liao via GitHub
• [w3c/webauthn] 26f20b: put back vijay's suggestion that got dropped GitHub
• [webauthn] new commits pushed by leshi Alexei Czeskis via GitHub
• [w3c/webauthn] fb4f3e: Adds authenticator attachement to credential optio... GitHub
• [webauthn] new commits pushed by leshi Alexei Czeskis via GitHub
• Re: [webauthn] Can the "attestation" of a WebAuthnAttestation be a non-object? Angelo Liao via GitHub

Tuesday, 15 November 2016

• Re: [webauthn] Enforce strict same-origin policy on rpId Angelo Liao via GitHub

Monday, 14 November 2016

• FYI: Intent to implement and ship: Web Authentication Hodges, Jeff

Saturday, 12 November 2016

• Re: [webauthn] TAG review feedback: Align Credential interface with Credential Management? jeisinger via GitHub

Wednesday, 9 November 2016

• Re: [webauthn] Why is the only value of ScopedCredentialType "ScopedCred" as opposed to "ScopedCredential"? =JeffH via GitHub
• [w3c/webauthn] f54fd0: Built by Travis-CI: 7c59dd38730d46db68d4a4fb1d48c9... GitHub
• [webauthn] new commits pushed by WebAuthnBot WebAuthnBot via GitHub
• [w3c/webauthn] GitHub
• [w3c/webauthn] 5f9172: tag Navigator w/ <a> GitHub
• Closed: [webauthn] Grammar of makeCredential/getAssertion step 1 is a bit odd =JeffH via GitHub
• Closed: [webauthn] "an Relying Party" should be "a Relying Party" =JeffH via GitHub
• [webauthn] new commits pushed by equalsJeffH =JeffH via GitHub
• [webauthn] Move {#sample-scenarios} (currently Section 10) to the top of the doc Vijay Bharadwaj via GitHub
• [webauthn] Update attestation format identifiers in registry to match spec Vijay Bharadwaj via GitHub
• Re: [webauthn] Jeffh editorial cleanups 3 Vijay Bharadwaj via GitHub
• Re: [webauthn] Moving callers from U2F to WebAuthn Vijay Bharadwaj via GitHub
• Closed: [webauthn] Moving callers from U2F to WebAuthn Vijay Bharadwaj via GitHub
• [w3c/webauthn] GitHub
• [w3c/webauthn] 2d6a7a: Adding fido appid extension (#229) GitHub
• [webauthn] new commits pushed by vijaybh Vijay Bharadwaj via GitHub
• [webauthn] Timeouts should be in ms not seconds Vijay Bharadwaj via GitHub
• Re: [webauthn] Adds authenticator attachement to credential options =JeffH via GitHub
• [w3c/webauthn] 0281c7: use Vijay's examples GitHub
• [webauthn] new commits pushed by leshi Alexei Czeskis via GitHub
• Re: [webauthn] Spec should not mandate behavior of server =JeffH via GitHub
• [w3c/webauthn] 5f9172: tag Navigator w/ <a> GitHub
• [webauthn] new commits pushed by equalsJeffH =JeffH via GitHub
• Re: [webauthn] remove ScopedCredentialInfo.publicKey; use "credential public key" term consistently =JeffH via GitHub

Tuesday, 8 November 2016

• Re: [webauthn] remove ScopedCredentialInfo.publicKey; use "credential public key" term consistently =JeffH via GitHub
• [w3c/webauthn] 92fe6c: fix not-properly-closed <div> GitHub
• [webauthn] new commits pushed by equalsJeffH =JeffH via GitHub
• [w3c/webauthn] 2f723d: Jeffh editorial cleanups 2 (#236) GitHub
• [w3c/webauthn] 276018: attestation statement definition GitHub
• [webauthn] new commits pushed by equalsJeffH =JeffH via GitHub
• [webauthn] new commits pushed by equalsJeffH =JeffH via GitHub
• Re: 11/09/2016 W3C Web Authentication WG Agenda Adam Powers
• RE: 11/09/2016 W3C Web Authentication WG Agenda Anthony Nadalin
• 11/09/2016 W3C Web Authentication WG Agenda Anthony Nadalin
• [webauthn] Do we need "Algorithm Usage Location(s)" and "JOSE Implementation Requirements" in the IANA Considerations section? Vijay Bharadwaj via GitHub
• Re: [webauthn] "JSON serialization" in makeCredential probably needs to be defined more clearly Boris Zbarsky via GitHub
• Re: [webauthn] section verification of WebAuthnAssertion added. See #102 Vijay Bharadwaj via GitHub
• Re: [webauthn] "JSON serialization" in makeCredential probably needs to be defined more clearly Vijay Bharadwaj via GitHub

Monday, 7 November 2016

• Closed: [webauthn] "relaxing the same-origin restriction" =JeffH via GitHub
• Re: [webauthn] "relaxing the same-origin restriction" =JeffH via GitHub
• Closed: [webauthn] Clarify how AAGUID is generated to avoid collisions =JeffH via GitHub
• Re: [webauthn] Clarify how AAGUID is generated to avoid collisions =JeffH via GitHub
• Re: [webauthn] Why are some of the attestation interfaces [SecureContext] while others are not? Vijay Bharadwaj via GitHub
• Re: [webauthn] Which of the attestation format interfaces are expected to be exposed in UAs? Vijay Bharadwaj via GitHub
• Re: [webauthn] Can the "attestation" of a WebAuthnAttestation be a non-object? Vijay Bharadwaj via GitHub
• Re: [webauthn] Need to clearly define what it means to SHA-256 hash the "host" output of the document.domain setter Anne van Kesteren via GitHub
• Re: [webauthn] Can the "attestation" of a WebAuthnAttestation be a non-object? Boris Zbarsky via GitHub
• Re: [webauthn] Various attributes of ScopedCredentialInfo should probably be [SameObject] Boris Zbarsky via GitHub
• Re: [webauthn] ScopedCredentialDescriptor can contain BufferSources that are processed async Boris Zbarsky via GitHub
• Re: [webauthn] "JSON serialization" in makeCredential probably needs to be defined more clearly Boris Zbarsky via GitHub
• Re: [webauthn] Exception handling in cryptoParameters processing needs to be clarified Boris Zbarsky via GitHub
• Re: [webauthn] When talking about "normalizing an algorithm", please just link to it Boris Zbarsky via GitHub
• Re: [webauthn] Why are various predefined extensions defined as extensions, and not just parts of the spec? =JeffH via GitHub
• Re: [webauthn] Can the "attestation" of a WebAuthnAttestation be a non-object? =JeffH via GitHub
• Re: [webauthn] Why are some of the attestation interfaces [SecureContext] while others are not? =JeffH via GitHub
• Re: [webauthn] Various attributes of ScopedCredentialInfo should probably be [SameObject] =JeffH via GitHub
• Re: [webauthn] ScopedCredentialDescriptor can contain BufferSources that are processed async =JeffH via GitHub
• Re: [webauthn] "JSON serialization" in makeCredential probably needs to be defined more clearly =JeffH via GitHub
• Re: [webauthn] Exception handling in cryptoParameters processing needs to be clarified =JeffH via GitHub
• Re: [webauthn] When talking about "normalizing an algorithm", please just link to it =JeffH via GitHub
• Re: [webauthn] Please coordinate with the HTML spec to extract the relevant bits of the document.domain setter so you can call them Boris Zbarsky via GitHub
• Re: [webauthn] Link to WebCrypto API is stale =JeffH via GitHub
• Re: [webauthn] "authentication" attribute on Navigator should be [SecureContext] Boris Zbarsky via GitHub
• Re: [webauthn] The W3C HTML spec is broken, and probably shouldn't be referenced Boris Zbarsky via GitHub
• Re: [webauthn] Need to clearly define what it means to SHA-256 hash the "host" output of the document.domain setter Boris Zbarsky via GitHub
• Re: [webauthn] Need to clearly define what it means to SHA-256 hash the "host" output of the document.domain setter =JeffH via GitHub
• Re: [webauthn] The W3C HTML spec is broken, and probably shouldn't be referenced =JeffH via GitHub
• Re: referencing W3C or WhatWG specs (was: [webauthn] new commits pushed by equalsJeffH Hodges, Jeff

Sunday, 6 November 2016

• Re: [webauthn] Please coordinate with the HTML spec to extract the relevant bits of the document.domain setter so you can call them =JeffH via GitHub
• Re: [webauthn] "authentication" attribute on Navigator should be [SecureContext] =JeffH via GitHub
• Re: [webauthn] Should the "authentication" attribute on Navigator be [SameObject]? =JeffH via GitHub
• Re: [webauthn] It would be nice if the definition of "Scoped Credential" said something about what `identifier` and `type` are =JeffH via GitHub
• [webauthn] Refine meaning of ScopedCredentialType to be "signature & assertion format (and version thereof)" =JeffH via GitHub

Saturday, 5 November 2016

• Re: Android Key Attestation is "Self Attestation" ? Hodges, Jeff

Friday, 4 November 2016

• [webauthn] Why are various predefined extensions defined as extensions, and not just parts of the spec? Boris Zbarsky via GitHub
• [webauthn] Authenticator selection extension needs to define snapshotting behavior Boris Zbarsky via GitHub
• [webauthn] Please ensure that all ArrayBuffer creations are done explicitly, in the correct global Boris Zbarsky via GitHub
• Re: [webauthn] What ensures any semblance of interop for WebAuthnExtensions? Boris Zbarsky via GitHub
• Re: [webauthn] What does "which has no other operations in progress" mean in practice? Boris Zbarsky via GitHub
• [webauthn] What does "which has no other operations in progress" mean in practice? Boris Zbarsky via GitHub
• [webauthn] Why is the only value of ScopedCredentialType "ScopedCred" as opposed to "ScopedCredential"? Boris Zbarsky via GitHub
• [webauthn] What ensures any semblance of interop for WebAuthnExtensions? Boris Zbarsky via GitHub
• [webauthn] Can the "attestation" of a WebAuthnAttestation be a non-object? Boris Zbarsky via GitHub
• Re: [webauthn] Is there a reason "WebAuthnAssertion" is not "WebAuthenticationAssertion"? Boris Zbarsky via GitHub
• [webauthn] Is there a reason "WebAuthnAssertion" is not "WebAuthenticationAssertion"? Boris Zbarsky via GitHub
• [webauthn] Which of the attestation format interfaces are expected to be exposed in UAs? Boris Zbarsky via GitHub
• [webauthn] Why are some of the attestation interfaces [SecureContext] while others are not? Boris Zbarsky via GitHub
• [webauthn] Various attributes of ScopedCredentialInfo should probably be [SameObject] Boris Zbarsky via GitHub
• [webauthn] Description of ScopedCredentialInfo.credential seems odd Boris Zbarsky via GitHub
• [webauthn] authenticatorCancel seems like it can cancel too much Boris Zbarsky via GitHub
• [webauthn] Creation of WebAuthnAssertion in getAssertion should probably be more explicit Boris Zbarsky via GitHub
• [webauthn] What does it mean to "get assertions" in getAssertion step 7? Boris Zbarsky via GitHub
• [webauthn] "might be present on this authenticator" could use a clearer definition Boris Zbarsky via GitHub
• Re: [webauthn] ScopedCredentialDescriptor can contain BufferSources that are processed async Boris Zbarsky via GitHub
• Re: [webauthn] excludeList/allowList can be defaulted to a zero-length sequence in IDL instead of prose Boris Zbarsky via GitHub
• Re: [webauthn] "JSON serialization" in makeCredential probably needs to be defined more clearly Boris Zbarsky via GitHub
• Re: [webauthn] I don't understand how to create a ClientData in makeCredential Boris Zbarsky via GitHub
• Re: [webauthn] callerOrigin isn't actually the origin of the caller; it's the origin of the callee Boris Zbarsky via GitHub
• Re: [webauthn] Processing model for extensions is very underdefined Boris Zbarsky via GitHub
• Re: [webauthn] "If extensions was specified" should instead use the "present" terminology Boris Zbarsky via GitHub
• Re: [webauthn] Please coordinate with the HTML spec to extract the relevant bits of the document.domain setter so you can call them Boris Zbarsky via GitHub
• Re: [webauthn] Setting _rpId_ to _callerOrigin_ doesn't make sense Boris Zbarsky via GitHub
• Re: [webauthn] There is no "current settings object" in algorithm steps that are executing in parallel Boris Zbarsky via GitHub
• Re: [webauthn] Does "Then asynchronously continue executing the following steps" mean "in parallel"? Boris Zbarsky via GitHub
• [webauthn] getAssertion needs to not go async before making a copy of the assertionChallenge Boris Zbarsky via GitHub
• Re: [webauthn] Grammar of makeCredential step 1 is a bit odd Boris Zbarsky via GitHub
• [webauthn] AssertionOptions and ScopedCredentialOptions could both inherit from a dictionary which has their shared members Boris Zbarsky via GitHub
• [webauthn] Creation of ScopedCredentialInfo in makeCredential should probably be more explicit Boris Zbarsky via GitHub
• [webauthn] ScopedCredentialDescriptor can contain BufferSources that are processed async Boris Zbarsky via GitHub
• [webauthn] "excludeList" should probably be "the excludeList member of _options_" in makeCredential Boris Zbarsky via GitHub
• [webauthn] "JSON serialization" in makeCredential probably needs to be defined more clearly Boris Zbarsky via GitHub
• [webauthn] I don't understand how to create a ClientData in makeCredential Boris Zbarsky via GitHub
• [webauthn] Should attestationChallenge be snapshotted in makeCredential, or used before going async? Boris Zbarsky via GitHub
• Re: [webauthn] Enforce strict same-origin policy on rpId =JeffH via GitHub
• Re: [webauthn] remove ScopedCredentialInfo.publicKey; use "credential public key" term consistently =JeffH via GitHub
• [webauthn] callerOrigin isn't actually the origin of the caller; it's the origin of the callee Boris Zbarsky via GitHub
• [webauthn] Processing model for extensions is very underdefined Boris Zbarsky via GitHub
• [webauthn] "If extensions was specified" should instead use the "present" terminology Boris Zbarsky via GitHub
• [webauthn] excludeList can be defaulted to a zero-length sequence in IDL instead of prose Boris Zbarsky via GitHub
• [webauthn] The concept "empty" is not really defined for IDL sequences Boris Zbarsky via GitHub
• [webauthn] What does "If normalizedAlgorithm is empty" mean? Boris Zbarsky via GitHub
• [webauthn] What does normalizedParameters actually contain in makeCredential? Boris Zbarsky via GitHub
• Boris: Thanks for.. Hodges, Jeff
• [webauthn] Exception handling in cryptoParameters processing needs to be clarified Boris Zbarsky via GitHub
• [webauthn] WebCryptoAPI's "normalizing an algorithm" cannot be done as part of async steps Boris Zbarsky via GitHub
• [webauthn] When talking about "normalizing an algorithm", please just link to it Boris Zbarsky via GitHub
• [webauthn] Link to WebCrypto API is stale Boris Zbarsky via GitHub
• [webauthn] _rpId_ generation allows more relaxation of same-origin restrictions than document.domain does Boris Zbarsky via GitHub
• [webauthn] Is _rpId_ supposed to look like an origin serialization, or like a hostname? Boris Zbarsky via GitHub
• [webauthn] Need to clearly define what it means to SHA-256 hash the "host" output of the document.domain setter Boris Zbarsky via GitHub
• Re: [webauthn] The W3C HTML spec is broken, and probably shouldn't be referenced Boris Zbarsky via GitHub
• [webauthn] The W3C HTML spec is broken, and probably shouldn't be referenced Boris Zbarsky via GitHub
• [webauthn] Please coordinate with the HTML spec to extract the relevant bits of the document.domain setter so you can call them Boris Zbarsky via GitHub
• [webauthn] Setting _rpId_ to _callerOrigin_ doesn't make sense Boris Zbarsky via GitHub
• [webauthn] There is no "current settings object" in algorithm steps that are executing in parallel Boris Zbarsky via GitHub
• [webauthn] Does "Then asynchronously continue executing the following steps" mean "in parallel"? Boris Zbarsky via GitHub
• [webauthn] Grammar of makeCredential step 1 is a bit odd Boris Zbarsky via GitHub
• [webauthn] "authentication" attribute on Navigator should be [SecureContext] Boris Zbarsky via GitHub
• [webauthn] Should the "authentication" attribute on Navigator be [SameObject]? Boris Zbarsky via GitHub
• [webauthn] It would be nice if the definition of "Scoped Credential" said something about what `identifier` and `type` are Boris Zbarsky via GitHub
• [webauthn] "an Relying Party" should be "a Relying Party" Boris Zbarsky via GitHub
• Re: [webauthn] remove ScopedCredentialInfo.publicKey; use "credential public key" term consistently bifurcation via GitHub
• Re: [webauthn] section verification of WebAuthnAssertion added. See #102 Rolf Lindemann via GitHub
• [w3c/webauthn] 5a2dc5: section verification of WebAuthnAssertion added. S... GitHub
• Re: [webauthn] Add section describing verification of a WebAuthnAssertion Rolf Lindemann via GitHub
• [webauthn] new commits pushed by rlin1 Rolf Lindemann via GitHub

Thursday, 3 November 2016

• Re: [webauthn] Enforce strict same-origin policy on rpId =JeffH via GitHub

Wednesday, 2 November 2016

• [webauthn] remove id requirement in ScopedCredentialDescriptor Angelo Liao via GitHub
• [w3c/webauthn] d1f5af: address vijay's comments GitHub
• Re: [webauthn] explicitly denote RSA signature scheme =JeffH via GitHub
• Re: [webauthn] Simplifying attestation, take two Alexei Czeskis via GitHub
• Re: [webauthn] explicitly denote RSA signature scheme =JeffH via GitHub
• Re: [webauthn] Simplifying attestation, take two Rolf Lindemann via GitHub
• Re: [webauthn] Add notion of internal/external to options =JeffH via GitHub
• [webauthn] Simplifying attestation, take two Vijay Bharadwaj via GitHub
• Re: [webauthn] explicitly denote RSA signature scheme Vijay Bharadwaj via GitHub
• Re: Regrets for today's call Hodges, Jeff
• Re: [webauthn] certifyinfo needs to be specified Vijay Bharadwaj via GitHub
• Re: [webauthn] remove ScopedCredentialInfo.publicKey; use "credential public key" term consistently Vijay Bharadwaj via GitHub
• Re: [webauthn] Adding u2f appid extension Vijay Bharadwaj via GitHub
• Re: [webauthn] Add notion of internal/external to options =JeffH via GitHub
• Regrets for today's call Vijay Bharadwaj
• Re: [webauthn] Add notion of internal/external to options Adam Powers via GitHub
• Re: [webauthn] Add notion of internal/external to options Alexei Czeskis via GitHub
• [w3c/webauthn] 558837: Adds authenticator attachement to credential optio... GitHub
• [webauthn] new commits pushed by leshi Alexei Czeskis via GitHub
• [w3c/webauthn] 700775: typo fix GitHub
• [webauthn] new commits pushed by leshi Alexei Czeskis via GitHub
• [w3c/webauthn] 2ca56e: addressing comments from issue peanut gallery :) GitHub
• [webauthn] new commits pushed by leshi Alexei Czeskis via GitHub
• RE: 11/02/2016 W3C Web Authentication WG Agenda Anthony Nadalin

Tuesday, 1 November 2016

• [webauthn] certifyinfo needs to be specified gmandyam via GitHub
• Re: [webauthn] Enforce strict same-origin policy on rpId =JeffH via GitHub
• [webauthn] Enforce strict same-origin policy on rpId Angelo Liao via GitHub
• Re: [webauthn] Add notion of internal/external to options Alexei Czeskis via GitHub
• Re: [webauthn] Add notion of internal/external to options Vijay Bharadwaj via GitHub

Last message date: Wednesday, 30 November 2016 23:54:42 UTC