Re: [webauthn] devicePubKey → supplementalPubKeys (#1957)

Since both the provider and device key signatures are over assertion data input, I assume this means the provider signature does not protect the device key. 

Is there a way to know that the device key is coming from a device within a provider, vs having an intermediary which overrides and provides a consistent key across devices?

-- 
GitHub Notification of comment by dwaite
Please view or discuss this issue at https://github.com/w3c/webauthn/pull/1957#issuecomment-1713954825 using your GitHub account


-- 
Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config

Received on Monday, 11 September 2023 14:02:59 UTC