Webauthn: Personal information updates & webauthn

[nsatragno]

This mirrors issue 914 on FIDO (CTAP).

At the moment, there is no straightforward way to update a user's personal information (name and displayName) associated to a credential. If a user wants to do it, they have to:

• If the credential is discoverable:
  
  
  
  • Have the relying party register a new credential using the same user handle.
    
    Note that this requires an implementation from the relying party to always use the same user handle for the same user. I expect many implementations to simply generate a random user handle for each credential and associate that to their actual user identity.
  
  
• If the credential is not discoverable:
  
  
  
  • Have the relying party register a new credential.
  
  
  • Have the relying party remove the old credential.
  
  

This situation is pretty bad. Users and relying parties might not even be aware of this issue, and it is easy to imagine an account picker with an old name appearing during log-in long after the user has updated their identity to the website.

--

To make this situation better, I propose the following check-list of changes:

• Add a authenticatorUpdateCredential operation on the authenticator model that allows updating displayName, name, and any other mutable metadata associated to the user the credential belongs to.
• For stateless credentials, disallow packing otherUI into the credential ID. otherUI might include mutable information such as the user's name. Credential IDs are meant to be immutable and I also see no reason for packing that information anyway since it doesn't seem to be surfaced later.
• Add a section under Relying Party Operations detailing the process to update the user information (at the moment it would be a description of the steps above... but maybe we can do better).
• Provide a better way to update the personal information without user action. One way I can think of is adding a credentials.get extension that specifies the new values for displayName / name for each credential on the allow-list. This would be fairly straightforward to implement but unfortunately wouldn't work for empty allow-lists. Perhaps if the RP uses empty allow-lists, then they could have their users go through a webauthn flow as part of the personal information update.
  A much more complex idea for platforms but probably better for users would be to provide a hook between returning a credential ID and finishing the webauthn request. Websites would be able to use this hook to query their back-end for personal information updates and have the browsers update that before finishing the request.

[emlun]

See also issue #1200

[arianvp]

I never really understood why Webauthn mandates we process the name of a user. Is it actually used by any browsers to even be displayed at the moment?

[ve7jtb]

It us used for discoverable/resident credentials in Windows 10 / Chrome / Safari.
They are displayed as part of the credential pick list when no allow list is sent.