Intent to Experiment: WebAuthn attestationFormats

[Adam Langley]

Contact emails

a...@chromium.org

Specification

https://w3c.github.io/webauthn/#dom-publickeycredentialcreationoptions-attestationformats

Summary

Support the attestationFormats field from WebAuthn L3. WebAuthn L3 supports a site expressing an ordered preference for credential attestation formats in the new attestationFormats field[1]. We plan on running an origin trial for this new field to allow some interested sites to experiment with this field on the one OS that currently supports it (Android). At the end, we'll gauge whether it has sufficient utility to support on an ongoing basis.

Blink component

Blink>WebAuthentication

TAG review

None — this one extra field is one of many passed in WebAuthn from a browser to passkey providers and doesn't represent any meaningful change in design.

Risks

Interoperability and Compatibility

No risks in general. Users of this field trial will have to keep in mind that it'll expire, but this is true of all trials.

Gecko: No signal

WebKit: No signal

Web developers: No signals

Other signals:

WebView application risks

Does this intent deprecate or change behavior of existing APIs, such that it has potentially high risk for Android WebView-based applications?

No

Goals for experimentation

To let a handful of interested sites experiment with this functionality without having to support it ~forever in the broad Web Platform. At the end of the trial we'll consider whether full support is warranted.

Ongoing technical constraints

None

Debuggability

The usual tricks for inspecting WebAuthn requests still work, but much of the logic is implemented by the user's chosen passkey provider.

Will this feature be supported on all six Blink platforms (Windows, Mac, Linux, ChromeOS, Android, and Android WebView)?

No, because it can only be supported in cases where the underlying passkey provider infrastructure supports this field, which is currently only true on Android.

Is this feature fully tested by web-platform-tests?

No. If we decide in the future to ship this feature fully we'll add WebDriver support and flesh out the testing. But the need for integration into a virtual authenticator for testing makes this a non-trivial amount of work.

Requires code in //chrome?

No

Estimated milestones

Origin trial Android first	130
Origin trial Android last	<= 140

Link to entry on the Chrome Platform Status

https://chromestatus.com/feature/5121935290400768?gate=6201855156420608

[Mike Taylor]

Could you clarify which milestones you're requesting? Is it 130 to 140? If so, can you explain why you think 11 milestones are required for this experiment (vs 6, which is the default allowed)?

thx

--
You received this message because you are subscribed to the Google Groups "blink-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+...@chromium.org.
To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAL9PXLxCRDEFwvz-KrPymBz53OZh92PRHTChTeStDEOsYZe%3Dzw%40mail.gmail.com.

[Adam Langley]

On Fri, Aug 30, 2024 at 11:32 AM Mike Taylor <mike...@chromium.org> wrote:

Could you clarify which milestones you're requesting? Is it 130 to 140? If so, can you explain why you think 11 milestones are required for this experiment (vs 6, which is the default allowed)?

The sites who are interested in this are large and operate in the financial sector, so I expect they will proceed cautiously. Also, mid-November to mid-January may simply be production freeze periods for them and thus almost not count.

However, I wasn't aware of the 6-milestone norm. Happy to say 130–136 and revisit if needed, if that avoids cutting against the grain now.

Cheers

AGL

[Mike Taylor]

To be clear: you can get approval for 6 milestones w/ just 1 LGTM. Longer trials are definitely possible - but need justification and 3 LGTMs.

That said, LGTM to experiment from 130 to 136. If you'd prefer a longer trial just let us know here, and perhaps other owners will also LGTM.