- From: Aditya Mitra via GitHub <sysbot+gh@w3.org>
- Date: Sun, 17 Sep 2023 03:04:07 +0000
- To: public-webauthn@w3.org
This prompt appears when a WebAuthn call is made from a Python application, which is shown in the second line of the prompt.  However, this is prompt when WebAuthn is called from a legitimate browser. It shows the call was made from "msedge.exe"  Now it is clear that the webauthn.dll driver in windows already knows which application is making the webauthn call. I would suggest passing the same onto the authenticator by adding it to the publicKeyCredentials object. The authenticator might reflect the same on the ClientDataJSON, whose hash is signed by the authenticator. Hence, in this way, the RP can know what application was used to perform the WebAuthn call. Then, the RP server can decide whether to allow the user or not. -- GitHub Notification of comment by AdityaMitra5102 Please view or discuss this issue at https://github.com/w3c/webauthn/issues/1965#issuecomment-1722377403 using your GitHub account -- Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config
Received on Sunday, 17 September 2023 03:04:09 UTC