Re: [webauthn] Headless API (#1924)

> The word "browser" only appears 12 times in the spec doc, whereas the word "web" appears 531 times. If this spec is truly only for a browser JS API then I would suggest making it explicitly stated in the abstract.

That's because we use the word [client](https://www.w3.org/TR/webauthn-2/#webauthn-client) generally to describe a browser in the spec. The word client appears a lot.

The most helpful link I can think of here would be for something like [SSH with FIDO2](https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.html), which is possible on Linux via OpenSSH 8.2p1 or later to use (and available in some other less-baked formats on Mac and Windows). One could think of some ways to configure ssh to use FIDO2 and then trigger additional actions after a user authenticates. 

As others like Firstyear and Shane have mentioned above, a human is necessary within WebAuthn transactions (called [ceremonies](https://www.w3.org/TR/webauthn-2/#ceremony)) so having M2M WebAuthn is out of scope. 

> Happy to take this conversation to a more appropriate place if you'll just point me to it.

We run the [WebAuthn Adoption Community Group](https://www.w3.org/community/webauthn-adoption/) and encourage you to drop by with any questions or concerns regarding adoption and implementation. 


-- 
GitHub Notification of comment by nicksteele
Please view or discuss this issue at https://github.com/w3c/webauthn/issues/1924#issuecomment-1642560856 using your GitHub account


-- 
Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config

Received on Wednesday, 19 July 2023 18:28:58 UTC