Registering new devices

[mguinness]

Thank you for creating a public identity provider using OIDC/WebAuthn. I was looking for a way to register new users with FIDO2 devices to avoid passwords. I see that your site is WIP, but most of the functionality is there. The missing part for me is related to Authorized Devices.

Firstly, it would be nice to allow removing existing registered devices. I have three authorized devices that are all the same Android device (duplicated trying to enroll a hardware key). I don't know if the back-end API has functionality to remove devices and it wasn't implemented in the front-end.

Secondly, when adding new devices with the QR code you limit which devices to enroll. I have a hardware key and a smartwatch where it is not possible to enroll atm. It seems that you are specifying authenticatorattachment when calling navigator.credentials.create(). If specified, ideally it would be set to "cross-platform" and not "platform" (which currently limits me to Windows Hello on my PC).

Personally, I would prefer an "Add Local Device" (while logged in) and an "Add Remote Device" (using QR code).

Anyway, thanks again for your work on this hosted site. I understand that you have limited time to work on this project, but I thought it would be useful to provide some feedback.

[dagnelies]

Hi. Thanks for the constructive feedback. Indeed, while the proof-of-concept is there, a lot of whistles and bells are missing. Most crucially: time.

I also wonder if the user experience as it is now is optimal. While good for technical affine users, I wonder if a more guided step-by-step approach would benefit more average users. I'm thinking of getting rid of usernames altogether.

[mguinness]

Thanks, I understand the time constraint. With regards to usernames, wouldn't you still need to provide that during registration?

WebAuthn Credential ID, User Name, User ID, User Handle

[dagnelies]

I was thinking of just requesting a nickname / displayname, register a passkey for it, and voilà. Under the hood some anonymous UUID would be generated as user id.

[mguinness]

I think it would be good to have a unique username (as you enforce now) for registration, but not need it for login with a resident key - which I assume when you mention passkey.