PSA: Summary of changes in WebAuthn L2 WD-02 relative to WebAuthn L2 FPWD (WD-01)

Diff of  WebAuthn L2 WD-02 relative to WebAuthn L2 FPWD (WD-01)
<https://services.w3.org/htmldiff?doc1=https%3A%2F%2Fwww.w3.org%2FTR%2F2019%2FWD-webauthn-2-20190604%2F&doc2=https%3A%2F%2Fwww.w3.org%2FTR%2F2019%2FWD-webauthn-2-20191126%2F>

HTH,

=JeffH

[ Note: the links below are to a dynamically-constructed diff thus it takes
a while for a given link to load. ]

   - New Features and technical changes:

   - FIDO AppID Exclusion Extension (appidExclude)
      <https://services.w3.org/htmldiff?doc1=https%3A%2F%2Fwww.w3.org%2FTR%2F2019%2FWD-webauthn-2-20190604%2F&doc2=https%3A%2F%2Fwww.w3.org%2FTR%2F2019%2FWD-webauthn-2-20191126%2F#sctn-appid-exclude-extension>
      - This change adds a registration-only “appidExclude” extension that
         allows platforms to make excludeCredentials effective when
transitioning
         from U2F.

         - User Agent Automation
      <https://services.w3.org/htmldiff?doc1=https%3A%2F%2Fwww.w3.org%2FTR%2F2019%2FWD-webauthn-2-20190604%2F&doc2=https%3A%2F%2Fwww.w3.org%2FTR%2F2019%2FWD-webauthn-2-20191126%2F#sctn-automation>
         - This feature enables automated testing of browsers' WebAuthn
         implementations, via Web Platform Tests, e.g.:
         https://github.com/web-platform-tests/wpt/blob/master/webauthn/webauthn-testdriver-basic.https.html

         - Support for "Lightning" Transport
      <https://services.w3.org/htmldiff?doc1=https%3A%2F%2Fwww.w3.org%2FTR%2F2019%2FWD-webauthn-2-20190604%2F&doc2=https%3A%2F%2Fwww.w3.org%2FTR%2F2019%2FWD-webauthn-2-20191126%2F#enum-transport>

      - Feature Policy integration
      <https://services.w3.org/htmldiff?doc1=https%3A%2F%2Fwww.w3.org%2FTR%2F2019%2FWD-webauthn-2-20190604%2F&doc2=https%3A%2F%2Fwww.w3.org%2FTR%2F2019%2FWD-webauthn-2-20191126%2F#sctn-feature-policy>

      - Cross-origin iFrame support
      <https://services.w3.org/htmldiff?doc1=https%3A%2F%2Fwww.w3.org%2FTR%2F2019%2FWD-webauthn-2-20190604%2F&doc2=https%3A%2F%2Fwww.w3.org%2FTR%2F2019%2FWD-webauthn-2-20191126%2F#sctn-iframe-guidance>
      (due to Feature Policy support)

      - More-fine-grained and explicit Relying Party operations
      <https://services.w3.org/htmldiff?doc1=https%3A%2F%2Fwww.w3.org%2FTR%2F2019%2FWD-webauthn-2-20190604%2F&doc2=https%3A%2F%2Fwww.w3.org%2FTR%2F2019%2FWD-webauthn-2-20191126%2F#sctn-rp-operations>

      - Including allowing Client Platforms to unilaterally set extensions.

         -  Updated timeout considerations (for the timeout member of the
      options passed to create() or get())

      - Icon member removed from PublicKeyCredentialEntity
      <https://services.w3.org/htmldiff?doc1=https%3A%2F%2Fwww.w3.org%2FTR%2F2019%2FWD-webauthn-2-20190604%2F&doc2=https%3A%2F%2Fwww.w3.org%2FTR%2F2019%2FWD-webauthn-2-20191126%2F#dictionary-pkcredentialentity>



   - Editorial polishing, including:

   - Moving Sample API Usage Scenarios
      <https://services.w3.org/htmldiff?doc1=https%3A%2F%2Fwww.w3.org%2FTR%2F2019%2FWD-webauthn-2-20190604%2F&doc2=https%3A%2F%2Fwww.w3.org%2FTR%2F2019%2FWD-webauthn-2-20191126%2F#sctn-sample-scenarios>
      to Section 1


   - Spec Roadmap
      <https://services.w3.org/htmldiff?doc1=https%3A%2F%2Fwww.w3.org%2FTR%2F2019%2FWD-webauthn-2-20190604%2F&doc2=https%3A%2F%2Fwww.w3.org%2FTR%2F2019%2FWD-webauthn-2-20191126%2F#sctn-spec-roadmap>
text
      improvements

      - Clarifications/improvements of various terminology
      <https://services.w3.org/htmldiff?doc1=https%3A%2F%2Fwww.w3.org%2FTR%2F2019%2FWD-webauthn-2-20190604%2F&doc2=https%3A%2F%2Fwww.w3.org%2FTR%2F2019%2FWD-webauthn-2-20191126%2F#sctn-terminology>
      definitions and listing of synonymous terms:
         - Authenticator
         WebAuthn Authenticator
         - Client-side-resident Public Key Credential Source
         Resident Credential
         - Credential  Key Pair
         Credential Private Key
         Credential Public Key
         User Public Key
         - Credential Properties
         - Relying Party Identifier
         RP ID
         - Server-side-resident Public Key Credential Source
         Non-Resident Credential
         - User Verification
         - WebAuthn Relying Party
         - WebAuthn Signature

         - Spec Roadmap
      <https://services.w3.org/htmldiff?doc1=https%3A%2F%2Fwww.w3.org%2FTR%2F2019%2FWD-webauthn-2-20190604%2F&doc2=https%3A%2F%2Fwww.w3.org%2FTR%2F2019%2FWD-webauthn-2-20191126%2F#sctn-spec-roadmap>
text
      improvements

      - Feature Policy
      <https://services.w3.org/htmldiff?doc1=https%3A%2F%2Fwww.w3.org%2FTR%2F2019%2FWD-webauthn-2-20190604%2F&doc2=https%3A%2F%2Fwww.w3.org%2FTR%2F2019%2FWD-webauthn-2-20191126%2F#sctn-feature-policy>
      integration complete (in this spec)
         - enables cross-origin iframe usage if allowed by policy

         - Authenticator Taxonomy
      <https://services.w3.org/htmldiff?doc1=https%3A%2F%2Fwww.w3.org%2FTR%2F2019%2FWD-webauthn-2-20190604%2F&doc2=https%3A%2F%2Fwww.w3.org%2FTR%2F2019%2FWD-webauthn-2-20191126%2F#sctn-authenticator-taxonomy>
text
      improvements

      - String Handling
      <https://services.w3.org/htmldiff?doc1=https%3A%2F%2Fwww.w3.org%2FTR%2F2019%2FWD-webauthn-2-20190604%2F&doc2=https%3A%2F%2Fwww.w3.org%2FTR%2F2019%2FWD-webauthn-2-20191126%2F#sctn-strings>
      clarifications

      - Various clarifications/improvements to Security Considerations
      <https://services.w3.org/htmldiff?doc1=https%3A%2F%2Fwww.w3.org%2FTR%2F2019%2FWD-webauthn-2-20190604%2F&doc2=https%3A%2F%2Fwww.w3.org%2FTR%2F2019%2FWD-webauthn-2-20191126%2F#sctn-security-considerations>
and
      Privacy Considertations
      <https://services.w3.org/htmldiff?doc1=https%3A%2F%2Fwww.w3.org%2FTR%2F2019%2FWD-webauthn-2-20190604%2F&doc2=https%3A%2F%2Fwww.w3.org%2FTR%2F2019%2FWD-webauthn-2-20191126%2F#sctn-privacy-considerations>



end