[Webkit-unassigned] [Bug 213595] Is user activated event necessary for Touch ID/Face ID based WebAuthn?

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=213595

Paul McNamara <paul.mcnamara at theaccessgroup.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |paul.mcnamara at theaccessgrou
                   |                            |p.com

--- Comment #5 from Paul McNamara <paul.mcnamara at theaccessgroup.com> ---
Likewise it's great to see some real progress with WebAuthn on iOS. 

I agree with the other posters though - this will break our implementation and likely many others.

Would it not make more sense to simply have a native consent UI when "platform" is requested? Confirmation of this would meet the user activated requirement would it not?

If the goal is to prevent nuisance popup UIs then it's currently inconsistent as you still get one if create/get are not called from within a user-activated event handler.

No other browser implementations (including OSX Safari using the touchbar) work this way to my knowledge.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20200626/6db65737/attachment.htm>