{"action":"closed","issue":{"url":"https://api.github.com/repos/w3c/webauthn/issues/204","repository_url":"https://api.github.com/repos/w3c/webauthn","labels_url":"https://api.github.com/repos/w3c/webauthn/issues/204/labels{/name}","comments_url":"https://api.github.com/repos/w3c/webauthn/issues/204/comments","events_url":"https://api.github.com/repos/w3c/webauthn/issues/204/events","html_url":"https://github.com/w3c/webauthn/issues/204","id":177561011,"number":204,"title":"Privacy across Account IDs","user":{"login":"yaronf","id":1265636,"avatar_url":"https://avatars0.githubusercontent.com/u/1265636?v=4","gravatar_id":"","url":"https://api.github.com/users/yaronf","html_url":"https://github.com/yaronf","followers_url":"https://api.github.com/users/yaronf/followers","following_url":"https://api.github.com/users/yaronf/following{/other_user}","gists_url":"https://api.github.com/users/yaronf/gists{/gist_id}","starred_url":"https://api.github.com/users/yaronf/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yaronf/subscriptions","organizations_url":"https://api.github.com/users/yaronf/orgs","repos_url":"https://api.github.com/users/yaronf/repos","events_url":"https://api.github.com/users/yaronf/events{/privacy}","received_events_url":"https://api.github.com/users/yaronf/received_events","type":"User","site_admin":false},"labels":[{"id":340916443,"url":"https://api.github.com/repos/w3c/webauthn/labels/stat:Discuss","name":"stat:Discuss","color":"207de5","default":false},{"id":723904637,"url":"https://api.github.com/repos/w3c/webauthn/labels/stat:pr-open","name":"stat:pr-open","color":"59f237","default":false},{"id":446006785,"url":"https://api.github.com/repos/w3c/webauthn/labels/subtype:privacy-cons","name":"subtype:privacy-cons","color":"bfd400","default":false},{"id":340917025,"url":"https://api.github.com/repos/w3c/webauthn/labels/type:editorial","name":"type:editorial","color":"fad8c7","default":false},{"id":340916444,"url":"https://api.github.com/repos/w3c/webauthn/labels/type:technical","name":"type:technical","color":"ffca04","default":false}],"state":"closed","locked":false,"assignee":{"login":"equalsJeffH","id":226571,"avatar_url":"https://avatars0.githubusercontent.com/u/226571?v=4","gravatar_id":"","url":"https://api.github.com/users/equalsJeffH","html_url":"https://github.com/equalsJeffH","followers_url":"https://api.github.com/users/equalsJeffH/followers","following_url":"https://api.github.com/users/equalsJeffH/following{/other_user}","gists_url":"https://api.github.com/users/equalsJeffH/gists{/gist_id}","starred_url":"https://api.github.com/users/equalsJeffH/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/equalsJeffH/subscriptions","organizations_url":"https://api.github.com/users/equalsJeffH/orgs","repos_url":"https://api.github.com/users/equalsJeffH/repos","events_url":"https://api.github.com/users/equalsJeffH/events{/privacy}","received_events_url":"https://api.github.com/users/equalsJeffH/received_events","type":"User","site_admin":false},"assignees":[{"login":"equalsJeffH","id":226571,"avatar_url":"https://avatars0.githubusercontent.com/u/226571?v=4","gravatar_id":"","url":"https://api.github.com/users/equalsJeffH","html_url":"https://github.com/equalsJeffH","followers_url":"https://api.github.com/users/equalsJeffH/followers","following_url":"https://api.github.com/users/equalsJeffH/following{/other_user}","gists_url":"https://api.github.com/users/equalsJeffH/gists{/gist_id}","starred_url":"https://api.github.com/users/equalsJeffH/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/equalsJeffH/subscriptions","organizations_url":"https://api.github.com/users/equalsJeffH/orgs","repos_url":"https://api.github.com/users/equalsJeffH/repos","events_url":"https://api.github.com/users/equalsJeffH/events{/privacy}","received_events_url":"https://api.github.com/users/equalsJeffH/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/w3c/webauthn/milestones/3","html_url":"https://github.com/w3c/webauthn/milestone/3","labels_url":"https://api.github.com/repos/w3c/webauthn/milestones/3/labels","id":1674727,"number":3,"title":"CR","description":"Issues and pull requests to be resolved before nominating the webatuhn spec to Candidate Recommendation (CR) maturity level. See https://www.w3.org/2015/Process-20150901/#maturity-levels","creator":{"login":"nadalin","id":7937635,"avatar_url":"https://avatars2.githubusercontent.com/u/7937635?v=4","gravatar_id":"","url":"https://api.github.com/users/nadalin","html_url":"https://github.com/nadalin","followers_url":"https://api.github.com/users/nadalin/followers","following_url":"https://api.github.com/users/nadalin/following{/other_user}","gists_url":"https://api.github.com/users/nadalin/gists{/gist_id}","starred_url":"https://api.github.com/users/nadalin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nadalin/subscriptions","organizations_url":"https://api.github.com/users/nadalin/orgs","repos_url":"https://api.github.com/users/nadalin/repos","events_url":"https://api.github.com/users/nadalin/events{/privacy}","received_events_url":"https://api.github.com/users/nadalin/received_events","type":"User","site_admin":false},"open_issues":11,"closed_issues":233,"state":"open","created_at":"2016-03-30T19:08:36Z","updated_at":"2018-02-07T18:13:18Z","due_on":"2018-02-28T08:00:00Z","closed_at":null},"comments":12,"created_at":"2016-09-17T07:09:31Z","updated_at":"2018-02-07T18:13:18Z","closed_at":"2018-02-07T18:13:18Z","author_association":"NONE","body":"4.5: `excludeList` allows an RP to tie different identities, i.e. to check if Alice and Bob are both used as identities on the same authenticator. This is because each of the `CredentialDescription` structures can contain a different id value, whereas if we only wanted to prevent multiple credentials for the same account, we would simply use the id value of the Account structure. Is this an attack we are willing to live with? Why not require (or allow) user consent for this step, e.g. \"RP X wants to see other identities you have with it, do you allow that?\"\n\n@vijaybh: One issue is that there are authenticators which have no local storage, but encode the entire credential and all its metadata into the credential ID. So for these authenticators, a credential ID is required. However, **the authenticator could ignore any excludeList entries that are not for the same account ID**.\n"}}
{"actor":{"display_login":"equalsJeffH"}}