Yubico/libu2f-host

Does not retrieve and interpret appId if it is json list

Closed this issue · 3 comments

shuffle2 commented

AFAIK this functionality is part of the U2F spec, and this client does not implement it. So it is not providing the same guarantees as the spec...

klali commented

I'm not sure it should be in the library to fetch the list and validate it. We should probably have a function to validate appid with the list though, where you'd pass in the json fetched (or NULL) and either match origin with appid or walk through the json list and validate.

shuffle2 commented

I guess I agree (mainly because I can foresee people wanting to customize the fetch with e.g. cert pinning), but it would be nice if the extra steps a user of the library needs to take are noted somewhere.

nevun commented

We are archiving this project and closing issues. Please open a new one in the replacement library's repo: https://github.com/Yubico/libfido2 if it is still applicable.