Re: [webauthn] Add a new "note" to registration options for RP's to help users distinguish credentials (#1852)

I would be in favour of adding a few examples showing these use cases for `user.displayName` and/or `user.name`. There's no reason `user.name` would have to be the account's primary email address (if any), it could easily accommodate something like `mmiller (FooBank via AcmeIAM)` if the RP has several distinct namespaces (like some IAM services do). I guess we just hadn't considered that use case much, so the examples are a bit lacking.

Maybe we should also add a symmetric mention of "determining the difference" to `displayName` - the `name` description currently reads:

>[...] It is intended only for display, i.e., aiding the user in determining the difference between user accounts with similar [displayName](https://w3c.github.io/webauthn/#dom-publickeycredentialuserentity-displayname)s. [...]

but `displayName` does not have a similar mention of disambiguating similar `name`s. There's really not much reason either should be more or less likely to be similar between credentials.

-- 
GitHub Notification of comment by emlun
Please view or discuss this issue at https://github.com/w3c/webauthn/issues/1852#issuecomment-1429451409 using your GitHub account


-- 
Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config

Received on Tuesday, 14 February 2023 10:00:45 UTC