Refer to IntersectionObserver from the Security Considerations

[jcjones]

IntersectionObserver1 and/or IntersectionObserver2 could be valuable to relying parties to determine whether an iframe they are utilizing for WebAuthn is being clearly shown to the user as intended. We should consider adding text to the Security Considerations section referring to the appropriate (final) version(s) of this.

[jcjones]

See also: https://docs.google.com/presentation/d/1sK9hhI0y25iioyLGMKwdhtpe-sVRV7Ln4pMHR2JXApw/edit#slide=id.g3ad57c9b5b_0_13

[jcjones]

Per discussion on 31 July call: J.C. was thinking we should try and write an example, but Jeff argued that we could write verbiage saying something akin to: "When WebAuthn is being rendered in an embedded frame, IntersectionObserver should be used to ensure that the intended UI is displayed by the user agent and is not obscured or occluded in any way."

[jcjones]

On 30 Oct 2019 call, decided to close this one per the argument at TPAC that practically, iframes can always be obscured or made not-credibly-visible.

[rlin1]

IntersectionObserver v2 seems to be here: https://szager-chromium.github.io/IntersectionObserver/

--
update by @equalsJeffH on 1-Nov-2019:

The another current link to IntersectionObserver v2 Editors' Draft spec (but without the diff highlighting): https://w3c.github.io/IntersectionObserver/v2/ ("IOv2")

A google blog post wrt IOv2: https://developers.google.com/web/updates/2019/02/intersectionobserver-v2

IOv2 Explainer (the above blog post was based in part on this):
https://github.com/w3c/IntersectionObserver/blob/v2/explainer.md

ChromeStatus on Intersection Observer v2:
https://www.chromestatus.com/feature/5878481493688320

[equalsJeffH]

@jcjones:

per the argument at TPAC that practically, iframes can always be obscured or made not-credibly-visible

hm, I cannot find that discussion/argument in the webauthn TPAC 2019 minutes -- did we have it during a regular concall? my search-fu is failing me at the moment... re-opening this because I think we oiught to point to the discussion or summarize it in more detail if we can.