Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: cedarcode/webauthn-ruby Loading
base: v1.3.0
Choose a base ref
...
head repository: cedarcode/webauthn-ruby Loading
compare: v1.4.0
Choose a head ref
  • 5 commits
  • 7 files changed
  • 4 contributors

Commits on Oct 10, 2018

  1. feat: limit installing on ruby version known to not be compatible

    @grzuy
    grzuy committed Oct 10, 2018
    Configuration menu
    Copy the full SHA
    aafc267 View commit details
    Browse the repository at this point in the history

Commits on Oct 11, 2018

  1. Merge pull request #89 from cedarcode/ruby_version_requirement 

    feat: limit installing on ruby version known to not be compatible
    @brauliomartinezlm
    brauliomartinezlm committed Oct 11, 2018
    Configuration menu
    Copy the full SHA
    9bfb3a1 View commit details
    Browse the repository at this point in the history

  2. feat: support 'android-safetynet' attestation format 

    Verify Android SafetyNet attestation as described at:
- https://www.w3.org/TR/2018/CR-webauthn-20180807/#android-safetynet-attestation
- https://developer.android.com/training/safetynet/attestation#compat-check-response

This is the attestation returned by Chrome 70 on Android when using the fingerprint scanner to register.

The W3C documentation does a poor job of explaining how and why the certificates must be verified. If this step were to be skipped, anybody could forge a response with a self-signed certificate issued to attest.android.com. From what I could find only Google's checklist (https://developer.android.com/training/safetynet/attestation-checklist) as well as some third-party resources mention it.

Also it is not really clear what a "valid SafetyNet response of version ver" is supposed to look like.
    @bdewater
    bdewater committed Oct 11, 2018
    Configuration menu
    Copy the full SHA
    fe0755b View commit details
    Browse the repository at this point in the history

  3. Merge pull request #86 from bdewater/android-safetynet-attstmt 

    feat: support 'android-safetynet' attestation format
    @brauliomartinezlm
    brauliomartinezlm committed Oct 11, 2018
    Configuration menu
    Copy the full SHA
    45a9c47 View commit details
    Browse the repository at this point in the history

  4. bump to v1.4.0

    @brauliomartinezlm
    brauliomartinezlm committed Oct 11, 2018
    Configuration menu
    Copy the full SHA
    076c250 View commit details
    Browse the repository at this point in the history
Loading