search

w3c / secure-payment-confirmation

Secure Payment Confirmation (SPC)
https://w3c.github.io/secure-payment-confirmation/
Other
106 stars 48 forks source link

Add Support for Cross-Device Authentication #253

Open tblachowicz opened 1 year ago

tblachowicz commented 1 year ago

I'm not entirely sure if the matter relates to the specification or it's purely related to the browser vendor implementations. However, I'd like to raise that with the WPWG for discussion anyway.

Our observation has been that current SPC implementations [^1] do not support Cross-Device Authentication ^2. We believe it'd be great if SPC would allow use of any Public Key Credential with payment extension including credentials automatically synced between user's devices and cross-device authentication with the nearby device.

[^1]: Tested on Chrome on Windows & MacOS. Edge on Windows.

stephenmcgruer commented 1 year ago

Thanks for filing this issue! This has some relation to (but is not entirely the same as) issues #174 and #12

For clarity for others who may not be immediately familiar with Cross-Device Authentication (though the linked passkeys.dev article explains it well), this is the "hybrid" transport protocol in WebAuthn/FIDO. In Chrome MacOS, the WebAuthn experience for Cross-Device Authentication looks like:

Screenshot 2023-07-05 at 9 28 56 AM

Cross-Device Authentication and SPC

With regards to SPC, there is a fundamental issue that stands in the way of Cross-Device Authentication.

Currently, SPC requires the ability to silently determine if a credential is available for the current device (as well as silently determine if the credential is SPC-enabled). This is required because SPC's user flow forks on the availability of the credential:

  1. If credential is available, show the transaction UX
  2. Otherwise, do not show the transaction UX, and instead (in Chrome) show a "no matching credentials" UX. (The spec specifically just instructs the browser to maintain authentication ceremony privacy and allows the implementor to decide how).

For either remote authenticators or for Cross-Device Authentication, the issue is that we cannot tell if a given credential available or not. So we cannot do this forking of the user flow.

To resolve this, the WG needs to pick up the discussions on a different fallback experience (or a different user flow entirely), such that SPC doesn't strongly rely on being able to silently query for the credential being available.

ianbjacobs commented 11 months ago

See our March 2023 discussion of fallback UX ideas: https://www.w3.org/2023/03/27-wpwg-minutes.html#t04