Skip to content

Commit

Permalink
Clarify that the platform authenticator must be local.
Browse files Browse the repository at this point in the history
Since hybrid allows remote platform authenticators to be used, the
previous wording was potentially ambiguous.
  • Loading branch information
Adam Langley committed Jul 12, 2023
1 parent cd4bded commit c5064ef
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion index.bs
Original file line number Diff line number Diff line change
Expand Up @@ -3957,7 +3957,7 @@ Note: The {{PublicKeyCredentialHints}} enumeration is deliberately not reference
:: Indicates that the [=[RP]=] believes that users will satisfy this request with a physical security key. For example, an enterprise [=[RP]=] may set this hint if they have issued security keys to their employees and will only accept those [=authenticators=] for [=registration ceremony|registration=] and [=authentication ceremony|authentication=]. For compatibility with older user agents, when this hint is used in {{PublicKeyCredentialCreationOptions}}, the {{AuthenticatorSelectionCriteria/authenticatorAttachment}} SHOULD be set to {{AuthenticatorAttachment/cross-platform}}.

: <dfn>local-device</dfn>
:: Indicates that the [=[RP]=] believes that users will satisfy this request with a [=platform authenticator=]. For compatibility with older user agents, when this hint is used in {{PublicKeyCredentialCreationOptions}}, the {{AuthenticatorSelectionCriteria/authenticatorAttachment}} SHOULD be set to {{AuthenticatorAttachment/platform}}.
:: Indicates that the [=[RP]=] believes that users will satisfy this request with a [=platform authenticator=] attached to the local device. For compatibility with older user agents, when this hint is used in {{PublicKeyCredentialCreationOptions}}, the {{AuthenticatorSelectionCriteria/authenticatorAttachment}} SHOULD be set to {{AuthenticatorAttachment/platform}}.

: <dfn>hybrid</dfn>
:: Indicates that the [=[RP]=] believes that users will satisfy this request with general-purpose [=authenticators=] such as smartphones. For example, a consumer [=[RP]=] may believe that only a small fraction of their customers possesses dedicated security keys. This option also implies that the local [=platform authenticator=] should not be promoted in the UI. For compatibility with older user agents, when this hint is used in {{PublicKeyCredentialCreationOptions}}, the {{AuthenticatorSelectionCriteria/authenticatorAttachment}} SHOULD be set to {{AuthenticatorAttachment/cross-platform}}.
Expand Down

0 comments on commit c5064ef

Please sign in to comment.