Re: [webauthn] Privacy risk from revealing allowed credentials (#1246)

I do something similar. I have a small set of {number-of-credentials, length-of-credential-ids, transports} tuples, weighted by popularity. Pick a tuple and the credential IDs using a pseudo-random number generator seeded with the entered email address.

It is important to normalise the email address. alice@example.com and alice@Example.COM need to return the same mock passkeys; as does ALICE@example.com (since the local-part is almost always case-insensitive).

I also configure what fraction of emails have any passkeys. When first adding support for passkeys almost no account had them. Years later, say, 50% have a passkey. So the fraction should be updated to reflect that.

-- 
GitHub Notification of comment by manger
Please view or discuss this issue at https://github.com/w3c/webauthn/issues/1246#issuecomment-3678546210 using your GitHub account


-- 
Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config

Received on Sunday, 21 December 2025 07:19:28 UTC