You’re now watching this thread. If you’ve opted in to email or web notifications, you’ll be notified when there’s activity. Click again to stop watching or visit your profile to manage watched threads and notifications.
You’ve stopped watching this thread and will no longer receive emails or web notifications when there’s activity. Click again to start watching.
Is there a way to detect if the Passkey used for authentication came from the same device orthey used a Passkey from a different device by scanning a QR code.
Is there any plans for supporting cross domain Passkey usage if they RP owns multiple domains. Looks like spec has support for at least authentication within an iFrame https://w3c.github.io/webauthn/#sctn-iframe-guidance . Any plans to support this in WebKit.
Yes, you can look at the transport for the assertion. The cross-device flow uses the transport "hybrid".
Per the linked section of the spec, "The signature counter's purpose is to aid Relying Parties in detecting cloned authenticators." With passkeys, replication is a core feature, so signCount doesn't really make sense.
Apple doesn't comment on future plans. WebKit currently supports cross-origin same-domain iframes, but not cross-domain iframes.
Systems Engineer
OP
Apple
Accepted Answer
Yes, you can look at the transport for the assertion. The cross-device flow uses the transport "hybrid".
Per the linked section of the spec, "The signature counter's purpose is to aid Relying Parties in detecting cloned authenticators." With passkeys, replication is a core feature, so signCount doesn't really make sense.
Apple doesn't comment on future plans. WebKit currently supports cross-origin same-domain iframes, but not cross-domain iframes.
