- From: Akshay Kumar via GitHub <sysbot+gh@w3.org>
- Date: Mon, 30 Aug 2021 16:34:20 +0000
- To: public-webauthn@w3.org
> Today, WebAuthn can be used (at least for Get operations) in iFrames. And, as far as I know, up until this point, we were fine with it. There's nothing an RP can do to prevent (and I also don't think they need to be able to do that). It has no impact on either security or privacy from my perspective. Any disagreements on that? No disagreements on this, but I think we can improve it to be more granular between allowing it to be iFrames vs no iFrames which browser can do for every RP, instead of RP having to do it. With this third class of RPs who are OK with SPC, I have some design in mind, but want to confirm first the above questions. Usability is something I am concerned about and I don't want current property of no-one else being able to ask for my credentials to remain. That property of allowing only RP to decide what they want is something I want to explore technically. -- GitHub Notification of comment by akshayku Please view or discuss this issue at https://github.com/w3c/webauthn/issues/1667#issuecomment-908495016 using your GitHub account -- Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config
Received on Monday, 30 August 2021 16:34:22 UTC