RE: WebAuthn and dealing with authenticator firmware updates

My assumption right now is external authenticators don't upgrade. Upgrading the firmware needs to be thought through in terms of how securely one can upgrade. Also due to different form factors, mechanisms will be different. RP keeping a list of firmwares, which one is good and which one is not, is messy. And that list needs to be updated regularly by all the RPs. Which is another nightmare.

From: Shane B Weeden <sweeden@au1.ibm.com>
Sent: Wednesday, February 20, 2019 10:43 AM
To: public-webauthn@w3.org
Subject: WebAuthn and dealing with authenticator firmware updates

Per posting at:
https://groups.google.com/a/fidoalliance.org/forum/#!topic/fido-dev/vNs52dde7oY<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgroups.google.com%2Fa%2Ffidoalliance.org%2Fforum%2F%23!topic%2Ffido-dev%2FvNs52dde7oY&data=02%7C01%7CAkshay.Kumar%40microsoft.com%7C56552f6a07c046848a0f08d69765c29c%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C1%7C636862860662164882&sdata=Iq1Z%2B8VLqJ%2FutGNkfERKmZwB8VayGuUlQ3pKVYn%2BN%2Fg%3D&reserved=0>

I'm considering opening a WebAuthn issue for this topic to see if there is a POV amongst webauthn authors on dealing with authenticator firmware version updates. This note is simply to solicit any comments on the list before I do that.

Thanks,
Shane..