search

duo-labs / webauthn.io

The source code for webauthn.io, a demonstration of WebAuthn.
https://webauthn.io
BSD 3-Clause "New" or "Revised" License
657 stars 121 forks source link

Google chrome asking to allow or block request when attestation is "direct" #12

Closed chrismccaw closed 5 years ago

chrismccaw commented 5 years ago

I am using Chrome and when selecting the attestation type to be "direct" an additional popup appears asking to "Allow" or "Block" my authenticator details. Even though I block the request I can still login. Is this expected?

Screen Shot 2019-07-08 at 2 21 31 PM
aseigler commented 5 years ago

Yes, that is totally normal and expected. Chrome, for privacy purposes, offers you the option of not providing your authenticator make/model (aka AAGUID) to the server. The server has the option of not allowing the session if you choose not to provide this detail, but for this demo site purposes, the server does not care. In the real world, your mileage may vary. An enterprise or bank for example might insist on knowing you are using an authenticator from a trusted vendor.

chrismccaw commented 5 years ago

Ah I see. Yeh, I noticed firefox does not present this popup so Chrome is just been transparent about the data being sent.