Re: [webauthn] Privacy Considerations should describe risks of storing userID/displayName in "second-factor" authenticators

I recall Google did the encryption trick with their pairwise identifiers for openID 2, so it can work.

For privacy I agree that credentials without some sort of local pin (or other authenticated unlock) should not provide a display name.

-- 
GitHub Notification of comment by ve7jtb
Please view or discuss this issue at https://github.com/w3c/webauthn/issues/578#issuecomment-331196631 using your GitHub account

Received on Thursday, 21 September 2017 15:41:51 UTC