W3C home > Mailing lists > Public > public-webauthn@w3.org > October 2019

[webauthn] new commits pushed by jcjones

From: J.C. Jones via GitHub <sysbot+gh@w3.org>
Date: Wed, 30 Oct 2019 19:53:26 +0000
To: public-webauthn@w3.org
Message-ID: <push-28e8d9d1e5e69470e052b2dcc427a6fa4c50efa9-1572465205-sysbot+gh@w3.org>

The following commits were just pushed by jcjones to https://github.com/w3c/webauthn:

* Fix #1285 - Remove icons from PublicKeyCredentialEntity

As discussed in issue #1285, the image URL fields for PublicKeyCredentialEntity,
while intended for user interface design, are potent correlation mechanisms if
they are downloaded by RPs. RPs would have to take extraordinary care, beyond
reasonable measures, to avoid uses by RPs with mal-intent to cross-correlate
accounts. It is better for User Agents to use existing origin/icon mechanisms for
their UX designs, or to define new such mechanisms as-needed, that are
origin-wide rather than provide the possibility to embed detailed tracking
information into these URLs.
  by J.C. Jones

* Merge pull request #1337 from jcjones/1285-image_deprecation

Fix #1285 - Remove icons from PublicKeyCredentialEntity
  by J.C. Jones
Received on Wednesday, 30 October 2019 19:53:28 UTC

This archive was generated by hypermail 2.4.0 : Friday, 17 January 2020 18:59:08 UTC