New demo website for V1 to better explain capabilites and scenarios

[abergs]

Work in progress: https://fido2test.azurewebsites.net/overview

I wanted to be able to explain better how/why FIDO2 and what is enables.

Todo:

• Allow adjusting options (As current page does: require userverification etc..)
• Show Dashboard of registered clients
• Write more/correctly about the scenarios.
• Add AD??

The story (with the scenarios) is heavily inspired by @herrjemand excellent blogpost https://medium.com/@herrjemand/introduction-to-webauthn-api-5fd1fb46c285. Will ask him if we could link to blog post and maybe cross-post some content (the images are golden!) to help explain for users.

[aseigler]

Love the look and feel of the new demo site! Expanding the options out to all options available including documented extensions I feel would be supremely beneficial to everyone.

Demonstrating how this would work with an on-premises LDAP directory like AD could be done, but we would have to figure out how to translate that to a web page in a way that makes sense. Maybe allow folks to register authenticators that create user objects and authenticators as child objects, and somehow display this in a read only tree of some sort? The beauty of the underlying tech is that you only need expose a credentialID, credentialPublicKey, and counter for each authenticator, and exposure of any or all of that data does not result in compromise of the authenticator.

I have been trying to noodle out the best sort of storage mechanism for information you need to have integrity via hash value verification and availability via distribution but not confidentiality because the data being stored is designed to be public. I keep coming back to some blockchain sort of solution.

[yackermann]

@abergs I am for it!

[abergs]

I've updated the wip site. I added illustrations and some explanations to the flow.

If you have any thoughts on the content i'd welcome your feedback: http:https://fido2test.azurewebsites.net/overview

Draft PR: #86

[abergs]

Also I wrote all the JS scripts quite fast. Might have missed something important: https://github.com/abergs/fido2-net-lib/tree/design/Fido2Demo/wwwroot/js

What's the story with Base64 and WebAuthn? Is it safe to always use Base64Url encoding or is that only for some fields?

[yackermann]

base64url on everything

On Mon, 4 Mar 2019 at 21:31, Anders Åberg ***@***.***> wrote: Also I wrote all the JS scripts quite fast. Might have missed something important: https://github.com/abergs/fido2-net-lib/tree/design/Fido2Demo/wwwroot/js What's the story with Base64 and WebAuthn? Is it safe to always use Base64Url encoding or is that only for some fields? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#82 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABj3FKJjRBV2o7JV3d9HvOEvI-fuWOOCks5vTZCTgaJpZM4a-rq3> .

-- Yuriy Ackermann FIDO, Identity, Standards skype: ackermann.yuriy github: @herrjemand <https://github.com/herrjemand> twitter: @herrjemand <https://twitter.com/herrjemand> medium: @herrjemand <https://medium.com/@herrjemand>

[abergs]

Dashboard and Custom scenario has now been added.
Any feedback before I merge this?
https://fido2test.azurewebsites.net/overview

PR: #86

[aseigler]

Did you test all the combinations in the custom area to make sure they all work? Platform vs cross platform has been an ongoing problem and seems to be currently broken again.

[aseigler]

The user handle/userid/public key are all displayed as ##-##-##, is that intentional? Some sort of string would probably be neater. We also seem to have lost attestation type?

[aseigler]

Maybe sneak in some logos like from https://github.com/apowers313/webauthn-logos and https://fidoalliance.org/overview/legal/logo-usage?

[aseigler]

Perhaps "contact us" link to Twitter handles?