The user-verification default of “preferred” is catching most sites out. #1253
Closed
Description
With the launch of PIN support in Chrome 75, we received a bug report that Chrome was now asking for a PIN when logging into Google. It turns out that our server-side team had missed that the default value for userVerification was “preferred” and weren't setting a value. The user in question was unaware that their authenticator had a PIN set, but it did and thus we were asking for it.
Dropbox and Twitter also have no value set for userVerification and that appears to be the same error. (Indeed, it's unclear to me what site would want the behaviour of “preferred”.)
Given that this is catching everyone out, and that setting the default to “discouraged” is backwards compatible, perhaps we should do that.
Metadata
Assignees
Type
Projects
Relationships
Participants
Activity
emlun commentedon Jul 4, 2019
For background, the previous discussion about the default is around here.
equalsJeffH commentedon Jul 13, 2019
See also: https://chromium.googlesource.com/chromium/src/+/master/content/browser/webauth/uv_preferred.md
Note this observation therein: There is not currently a way in WebAuthn to express that a site would like user verification if it's low-cost for the user so that later reauthentication may use WebAuthn rather than a password.
...that may merit it's own (related) issue.
agl commentedon Jul 18, 2019
From the call of 2019-07-17: this was discussed and it was decided to close this issue. @equalsJeffH opened #1259 to make the suggestion concrete and Akshay has replied there. There was also concern that changing the default would make things even more complex for RPs as different browsers might have different values as the default for some time.
We have changed Chrome so that, with Chrome 77, any WebAuthn call that doesn't set an explicit value for
userVerificationwill trigger a warning in the Javascript console pointing to this page. This can be silenced by specifying any explicit value. We hope this to point RPs towards considering whetherpreferredis their desired behaviour.