Remove unimplemented extensions

[ve7jtb]

At the F2F the work group decided to remove extensions that have not be implemented and are not testable from the Level 2 spec

The proposed list of extensions to be removed are:
Simple Transaction Authorization Extension (txAuthSimple)
Generic Transaction Authorization Extension (txAuthGeneric)
Authenticator Selection Extension (authnSel)
User Verification Index Extension (uvi)
Location Extension (loc)
User Verification Method Extension (uvm)
Biometric Authenticator Performance Bounds Extension (biometricPerfBounds)
and possibly
Supported Extensions Extension (exts)

Feedback on if this is the correct list.
please

[equalsJeffH]

on 2020-03-11 call, @agl notes that UVM is impl'd in Android (at this point) (and Edge android?). @ve7jtb sez he will do PR to remove the above list other than UVM extension.

[ve7jtb]

We may be able to get two implementations of UVM.
The caveat with UVM is that it is only implemented on Android for the platform authenticator, and even that may be removed due to the platform authenticator no longer knowing what UVM method was actually used.
We will see if we can get two implementations to get it into the final approved version of Level 2.

[ve7jtb]

EXTS is also out due to no implementations.

[rlin1]

Transaction Authorization provides a simple and effective method to implement the PSD2 Dynamic Linking requirement.
In the Browser case, Javascript injection attacks (as Adam Langley explained) are a problem for the relying party to know what the user really sees.
So I think it would be important to have Browsers implementing transaction authorization - rather than removing the extension.

We might even want to find a way to allow Browsers supporting Transaction Authorization even with authenticators that don’t have a display.
One idea would be to let the Browser include the transaction text in the “CollectedClientData” in the case the Authenticator doesn’t provide native support for txAuth.

With that the Browser would send the transaction text to the Authenticator if the authenticator support displaying it, and the browser would display the transaction if the authenticator doesn't support transaction confirmation, e.g. most security keys.

[ve7jtb]

I agree a extension like that would be good.

That may need to be a new extension however.

The problem is mostly that the browsers are hesitant to display RP provided text in the browser chrome.

That is probably the first issue that needs to be addressed.
John B.

[nadalin]

PSD2 Dynamic Linking requirement can be done without ANY involvement of FIDO/WebAuthn, I don't know why we would put this requirement on WebAuthn when it can be done elsewhere

[selfissued]

I advocate us deleting all the Level 1 extensions that have not been implemented in any shipping browser. Note that they can continue to be referenced in the L1 spec, even though they have been deleted from the L2 spec.

[akshayku]

I would also support removing these from L2. They can still be referenced in L1.

[agl]

Except for UVM, I also support this.

[ve7jtb]

Add Mike as a reviewer for pull request.