W3C home > Mailing lists > Public > public-webauthn@w3.org > January 2019

Re: [webauthn] No way to verify requireResidentKey during registration step at RP side (#1060)

From: Emil Lundberg via GitHub <sysbot+gh@w3.org>
Date: Wed, 16 Jan 2019 19:09:38 +0000
To: public-webauthn@w3.org
Message-ID: <issue_comment.created-454901716-1547665776-sysbot+gh@w3.org>
@herrjemand the `requireResidentKey` parameter is not signed over, so it's not possible for the RP to verify that the client passed the intended value through to the authenticator. But it's probably not a huge deal since a malicious client could do way worse things anyway.

-- 
GitHub Notification of comment by emlun
Please view or discuss this issue at https://github.com/w3c/webauthn/issues/1060#issuecomment-454901716 using your GitHub account
Received on Wednesday, 16 January 2019 19:09:39 UTC

This archive was generated by hypermail 2.4.0 : Friday, 17 January 2020 18:59:00 UTC