- From: Thomas Duboucher via GitHub <sysbot+gh@w3.org>
- Date: Sat, 16 Sep 2023 18:54:42 +0000
- To: public-webauthn@w3.org
If the user is already tricked into self-XSS, the attacker could just directly extract the session data? At this point, hardening WebAuthn against self-XSS is a plaster on a wooden leg, no? -- GitHub Notification of comment by serianox Please view or discuss this issue at https://github.com/w3c/webauthn/issues/1965#issuecomment-1722293375 using your GitHub account -- Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config
Received on Saturday, 16 September 2023 18:54:44 UTC