Presenting with CTAP

[marcoscaceres]

Was discussing with @mohamedamir... we should say something in the spec that cross-platform cross-device credential exchanges SHOULD (or RECOMMENDED) happen over CTAP.

We can't mandate it (i.e., MUST) because:

• It's OS or framework specific, so outside of the scope of the spec... or, at least, what a browser can often do without implementation of the entire exchange stack.
• Platforms are free to use more efficient or propriety protocols, particularly for cross-device exchanges.
• Future proofs the spec, while giving best compatibility right now.

[marcoscaceres]

Related issue that should also be addressed as part of this:
#400

[mohamedamir]

It's OS or framework specific, so outside of the scope of the spec... or, at least, what a browser can often do without implementation of the entire exchange stack.

I don't agree, If the underlying platform doesn't support CTAP, it is the browsers responsibility to implement it and offer it.

[marcoscaceres]

Ah, got you!

No, that should definitely not be a requirement IMO - and one WebKit would formally object to: the spec can't expect (or force) implementations to also implement CTAP. Some browser engines (like WebKit) rely on the OS frameworks to (hopefully, not guaranteed 🤞) provide CTAP when doing the exchange. Thankfully Apple’s Identity Documents Services Frameworks does provide CTAP! 😅, but WebKit can't do much if the OS doesn't provide it.

This is why I argued above that it should be a SHOULD. It's a best case scenario thing.

It's great if Chrome was able to implement it, but it's definitely not something WebKit could do (not in the timeframe we want this spec to go to CR/REC): it would be too much work (for me) to implement CTAP from scratch, "just-in case" it's not provided by the OS.