W3C home > Mailing lists > Public > public-webauthn@w3.org > March 2021

Re: [webauthn] WebAuthn assertion disabled by default in cross-origin iframes (Emv 3D Secure flow) (#1589)

From: Adam Langley via GitHub <sysbot+gh@w3.org>
Date: Wed, 31 Mar 2021 20:54:47 +0000
To: public-webauthn@w3.org
Message-ID: <issue_comment.created-811458767-1617224086-sysbot+gh@w3.org>
We sympathise with the challenges of coordinating many websites. But the alternative is to enable WebAuthn in _all_ existing iframes, which seems surprising and potentially dangerous. As such, I'm afraid that we still believe that an explicit opt-in by the embedder is the right path.

-- 
GitHub Notification of comment by agl
Please view or discuss this issue at https://github.com/w3c/webauthn/issues/1589#issuecomment-811458767 using your GitHub account


-- 
Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config
Received on Wednesday, 31 March 2021 20:54:49 UTC

This archive was generated by hypermail 2.4.0 : Tuesday, 5 July 2022 07:26:43 UTC