Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update browser.secureStorage proposal with authentication levels #226

Closed
wants to merge 1 commit into from

Conversation

oliverdunk
Copy link
Member

Following discussion at the last meeting (#215) and in #190, this PR updates the browser.secureStorage proposal to improve two aspects of the API:

  • Clearer, more generic authentication levels are now used which provide a higher level API. This allows the developer to request that a secret is protected by BIOMETRICS for example, without making things too specific and allowing them to specify a particular piece of hardware to use.
  • There is now documentation on how to handle implementations like Windows Hello where the OS does not provide the option for authentication methods to be specified. This is through the introduction of a new ANY authentication level.

The implementation key has also been added which the browser can use to share more data with the developer about the OS-specific hardware it might use. This is not standardised and is purely informational.

Resolves #190

@oliverdunk oliverdunk requested review from zombie, dotproto and xeenon June 8, 2022 23:57
@oliverdunk oliverdunk added the topic: secure storage Related to the secureStorage API proposal label Jun 8, 2022
Copy link
Member

@dotproto dotproto left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since this proposal is authored and edited by @oliverdunk, I'm inclined to accept whatever changes he makes in order to reduce the friction of iterating on this proposal. Discussions of specific concerns with the current draft can take place in appropriately tagged issues. What do you think @xeenon, @zombie, @mukul-p, and @Rob--W?

@oliverdunk
Copy link
Member Author

Since this proposal is authored and edited by @oliverdunk, I'm inclined to accept whatever changes he makes in order to reduce the friction of iterating on this proposal. Discussions of specific concerns with the current draft can take place in appropriately tagged issues. What do you think @xeenon, @zombie, @mukul-p, and @Rob--W?

I'm of course in favor of merging things, appreciate you trying to keep things moving! That said - don't feel a rush to merge this. There's no point merging things with no intent of implementing them so I see getting feedback here as really important.

Comment on lines +45 to +46
"MACOS_KEYCHAIN_FACE",
"MACOS_KEYCHAIN_TOUCHID"
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This would apply to iOS as well. I would prefer to not bake the platform into the contents like this. I much preferred the previous generic wording.

@oliverdunk
Copy link
Member Author

I synced with Simeon and got some feedback here. I'm going to make a new draft based on that soon.

@dotproto
Copy link
Member

@oliverdunk would you like to merge these changes as is or create a new PR for with the updates you're working on?

@oliverdunk
Copy link
Member Author

@dotproto: Let's close this for now and I'll re-open once I have a new draft. Thanks for checking in!

@oliverdunk oliverdunk closed this Jul 18, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
topic: secure storage Related to the secureStorage API proposal
Projects
None yet
Development

Successfully merging this pull request may close these issues.

browser.secureStorage: Discuss how to handle platforms with limited control over authentication methods
4 participants