- From: Emil Lundberg via GitHub <sysbot+gh@w3.org>
- Date: Mon, 27 May 2024 15:54:02 +0000
- To: public-webauthn@w3.org
> Doesn't `"hybrid"` mean both `"platform"` and `"cross-platform"` are allowed without preference to either one? No, the [`"hybrid"` hint](https://www.w3.org/TR/webauthn-3/#dom-publickeycredentialhints-hybrid) indicates a preference for a separate authenticator device using the [`"hybrid"` transport](https://www.w3.org/TR/webauthn-3/#dom-authenticatortransport-hybrid), meaning it is separate from the [client device](https://www.w3.org/TR/webauthn-3/#client-device) and therefore [cross-platform attached](https://www.w3.org/TR/webauthn-3/#cross-platform-attachment). You may be thinking of the use case for `hints: ["client-device", "hybrid"]`, which signals a preference for essentially anything except a dedicated external security key: an integrated platform authenticator or (most likely) the platform authenticator on another nearby general-purpose computing device such as a smartphone (mirroring the [`"passkeyPlatformAuthenticator"` client capability](https://w3c.github.io/webauthn/#dom-clientcapability-passkeyplatformauthenticator)). > The spec says "if two hints are contradictory, the first one controls" which seems to imply that something like `["security-key", "client-device"]` is equivalent to `["security-device"]` due to the two contradicting each other and `"security-key"` appearing first. Immediately preceding that, the spec says: >Hints are provided in order of decreasing preference [...] so no, your two examples are not equivalent - the former expresses a fallback preference of `"client-device"` while the latter expresses no fallback preference. For the purposes of mapping to a suitable value of `authenticatorSelection.authenticatorAttachment`, though: yes, in this case the first hint would determine the respective `authenticatorAttachment` setting, and unconditionally override any and all other hints following it. So as of now there are 4 partitions, as you put it: `["security-key", ...]` and `["hybrid", ...]` mapping to `"cross-platform"`, `["client-device", ...]` mapping to `"platform"` and `[]` mapping to `undefined` (absent). -- GitHub Notification of comment by emlun Please view or discuss this issue at https://github.com/w3c/webauthn/issues/2053#issuecomment-2133747641 using your GitHub account -- Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config
Received on Monday, 27 May 2024 15:54:03 UTC