webauthn user enum?

[bodik]

webauthn user enum?

post login username > webauthn true if user has registered credentials, getpkcco with allowed credentials ?

[bodik]

• https://github.com/w3c/webauthn/issues/1014
• https://w3c.github.io/webauthn/#sctn-username-enumeration

[bodik]

• user enumeration via webauthn authentication ceremony is possible in current implementation, but only for users with registered webauthn credentials
• most likely, username enumeration for any user is possible for timing attack (select user with username)
• the risk is acceptable for this project, and the issue is noted in known issues