- From: Arnaud Dagnelies via GitHub <sysbot+gh@w3.org>
- Date: Wed, 06 Jul 2022 07:04:18 +0000
- To: public-webauthn@w3.org
dagnelies has just created a new issue for https://github.com/w3c/webauthn: == Why not email/username as user.id / user handle? == The specs [says](https://w3c.github.io/webauthn/#dictionary-user-credential-params): > The [user handle](https://w3c.github.io/webauthn/#user-handle) MUST NOT contain personally identifying information about the user, such as a username or e-mail address Or [here](https://w3c.github.io/webauthn/#sctn-user-handle-privacy): > the [Relying Party](https://w3c.github.io/webauthn/#relying-party) MUST NOT include personally identifying information, e.g., e-mail addresses or usernames, in the [user handle](https://w3c.github.io/webauthn/#user-handle) However, I fail to understand the reasoning behind it since: 1. the authenticators store the user.name / user.displayName anyway (that's also what they display when you let it pick) 2. the user id/handle is neither transmitted nor necessary during authentication (what you need is the "real" identifier like email/username) 3. ...what's the privacy issue anyway?! Please view or discuss this issue at https://github.com/w3c/webauthn/issues/1763 using your GitHub account -- Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config
Received on Wednesday, 6 July 2022 07:04:20 UTC