Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

double check language regarding requiring authorization gesture #1215

Closed
equalsJeffH opened this issue May 9, 2019 · 1 comment · Fixed by #1237
Closed

double check language regarding requiring authorization gesture #1215

equalsJeffH opened this issue May 9, 2019 · 1 comment · Fixed by #1237
Assignees
@equalsJeffH @emlun
Labels
stat:pr-open type:editorial
Milestone
L2-WD-02

Comments

@equalsJeffH
Copy link
Contributor

equalsJeffH commented May 9, 2019 •
edited

given that we have the notions of effective user verification requirement for credential creation and effective user verification requirement for assertion, we ought to grep thru the spec for places where authorization gesture is mentioned and ensure that it is being employed accurately. For example, in section 5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential’s [[Get]](options) Method, there is this claim:

since this specification requires an authorization gesture to create any credentials,

..which I do not believe is true any longer.
@equalsJeffH equalsJeffH added this to the L2-WD-02 milestone May 9, 2019
@emlun
Copy link
Member

emlun commented May 10, 2019

We've defined the term "authorization gesture" to mean any kind of human confirmation, including a test of user presence which is still required in authenticatorMakeCredential, so the claim

since this specification requires an authorization gesture to create any credentials,

is still true.

However we could tie things together better by rephrasing the authenticator operations a bit, since they currently don't reference the "authorization gesture" term at all.

@emlun emlun mentioned this issue Jun 19, 2019
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@equalsJeffH equalsJeffH

@emlun emlun

Labels
stat:pr-open type:editorial
Projects
None yet
Milestone
L2-WD-02
Development

Successfully merging a pull request may close this issue.

Use "authorization gesture" term in authenticator operations w3c/webauthn
2 participants
@equalsJeffH @emlun