Re: [webauthn] Why not email/username as user.id / user handle? (#1763)

Yes, but platform authenticators are presumably protected by the local login on the device. For external security keys the opposite is true: they may reveal user handles without authentication but not `name`s and `displayName`s.

-- 
GitHub Notification of comment by emlun
Please view or discuss this issue at https://github.com/w3c/webauthn/issues/1763#issuecomment-1176480523 using your GitHub account


-- 
Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config

Received on Wednesday, 6 July 2022 17:15:42 UTC