Re: [webauthn] Add a `hints` element for both `create` and `get`. (#1884)

For the record, in general we've been fine with how browsers handle authentication when we return `transports` during auth. Thus I'm evaluating this all through the lens of "how can we guide users to successful **registration**."

My higher-level requirement has been centered around the desire to individually trigger browsers' "security key" and "hybrid" flows so that we could show corresponding verbiage shown beforehand. The verbiage would help users understand what the browser will ask of them since some aspects of passkeys registration are still relatively new.

If I'm understanding this correctly, the intent of `hints` would be that an RP like me adds the new property to our registration options to "suggest" to the browser that it only show the hybrid flow?

```js
{
  // ...
  authenticatorSelection: {
    authenticatorAttachment: 'cross-platform'
  },
  hints: ['non-security-key'],
}
```

> Maybe "smartphone" is a good answer?

What about `"other-device"` or `external-device`? It leaves the door open for other form factors to participate (e.g. someone could use an iPad, which doesn't really fit into the idea of "smartphone")

-- 
GitHub Notification of comment by MasterKale
Please view or discuss this issue at https://github.com/w3c/webauthn/pull/1884#issuecomment-1536511075 using your GitHub account


-- 
Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config

Received on Friday, 5 May 2023 16:42:19 UTC