Re: [webauthn] Privacy risk from revealing allowed credentials (#1246)

Thanks for pointing this out, we're aware of the issue but it hasn't been a high priority since we're not aware of much interest in using non-resident keys for 1st factor authentication.

I guess we could note in the suggestion of fake credential IDs that the same idea could be used to obfuscate a list containing real credential IDs as well. We could also propose using password authentication as a first step before the WebAuthn ceremony, but that would be a different use case than the one you're considering.

-- 
GitHub Notification of comment by emlun
Please view or discuss this issue at https://github.com/w3c/webauthn/issues/1246#issuecomment-507268983 using your GitHub account

Received on Monday, 1 July 2019 13:40:21 UTC