Deprecation warning for fido-u2f, apple, and android-safetynet? about webauthn

[timcappalli]

I'd also add that just because an authenticator implementation is not currently using an attestation format, does not mean it is deprecated and it could be used in the future.

[emlun]

fido-u2f attestation is not deprecated, it will always continue to be used by U2F security keys from before the release of FIDO2. The deprecation of the U2F JavaScript API has no effect on this; these security keys still remain compatible with the WebAuthn API (though not all features, like User Verification and discoverable keys).

I don't know about the other formats, though.

[vanbukin]

@emlun Yes, you are correct about fido-u2f. I apologize if it was misleading. However, as far as I understand, for fido-u2f there will be no userHandle, which is mandatory for the usernameless sign-in scenario (If the user was not identified before the authentication ceremony was initiated). Perhaps this point is worth mentioning.

[emlun]

This is mentioned in §2.2.1. Backwards Compatibility with FIDO U2F, and implied by the description of PublicKeyCredential.response.userHandle:

[...] The authenticator MUST always return a user handle if the allowCredentials option used in the authentication ceremony is empty, and MAY return one otherwise.

Since U2F authenticators must always be used with non-empty allowCredentials, this implies that they always MAY (and in fact always do) return userHandle: null.

[vanbukin]

Apologies, for fido-u2f there indeed are instructions about the nuances of its operation. Thank you for the clarification. And what about apple and android-safetynet? Is it suitable to mention deprecation for them?

[emlun]

2023-10-25 WG call: Apple reports they are not comfortable with calling apple attestation deprecated at this time. Google confirms that SafetyNet attestation is deprecated, but judging by the deprecation timeline, SafetyNet attestation will still be supported in some form until January 2025. The WG feels we should not make any change to the spec so long as the attestation format is being produced by authenticators. We hope to release L3 of the spec well before January 2025 (the WG charter ends in April 2024), so we will not make any change for this in L3.