[webauthn] How to deal with discoverable credentials? (#1764)

dagnelies has just created a new issue for https://github.com/w3c/webauthn:

== How to deal with discoverable credentials? ==
Hi,

until now, I understood how the normal authentication works:

    Browser->Server: get challenge/credentialIds for "john.doe@example.com"
    Browser->Server: here is the signed challenge + payload
    Server: verifies challenge, signature, payload...

However, I fail to understand how it would work for discoverable credentials.

    Browser->Server: get challenge for ???
    Browser->Server: here is a signed random challenge for we don't know who yet
    Server: verify what ???

Basically, you cannot associate the challenge to a specific user anymore. So, do you ignore the challenge completely? Do you store like a bunch of them? Do you use something like expiring JWTs as challenge?

And as last dumb question: what is the purpose of these discoverable credentials anyway? I mean, it's fairly common to let the user type its username/email or pick from a list trivially filled by autofill.

Please view or discuss this issue at https://github.com/w3c/webauthn/issues/1764 using your GitHub account


-- 
Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config

Received on Wednesday, 6 July 2022 07:15:56 UTC