Re: [webauthn] Either UV or UP should be enough

>their operation (tapping a NFC smart card to a reader, inserting a buttonless USB authenticator) does actually prove to a relying party that the user is present.

I agree, but it's debatable whether a USB device left plugged in for an extended time (perhaps with a PIN cached for the session) should still be regarded as guaranteeing user presence.

-- 
GitHub Notification of comment by emlun
Please view or discuss this issue at https://github.com/w3c/webauthn/issues/1037#issuecomment-412885589 using your GitHub account

Received on Tuesday, 14 August 2018 14:11:28 UTC