News for hackers. Stuff that matters.

A comment on Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard. Parent comment

Re:Apple, Google and Microsoft Commit to Expanded Support fo... by Hamuko on Thursday May 05, 2022 @11:27AM (#31274585)
Tell the services you interact with that they're basically going against the spec.

"Relying Parties SHOULD allow and encourage users to register multiple credentials to the same account. Relying Parties SHOULD make use of the excludeCredentials and user.id options to ensure that these different credentials are bound to different authenticators."

[ Parent | on HN ]
Re:Apple, Google and Microsoft Commit to Expanded Support fo... by 2OEH8eoCRo0 on Thursday May 05, 2022 @11:37AM (#31274714)
Is it a SHOULD vs SHALL issue? Link to full spec?
[ Parent | on HN ]
Re:Apple, Google and Microsoft Commit to Expanded Support fo... by Hamuko on Thursday May 05, 2022 @11:41AM (#31274772)
It's SHOULD as per RFC2119, so basically you need to have a good reason with an understanding of the implications to ignore it.

One of the implications here being that you have zero available authenticators if your main authenticator breaks.

https://www.w3.org/TR/webauthn-2/

[ Parent | on HN ]