1

As you may have noticed from previous questions, I'm building a web site that will support authentication via Webauthn using Yubikeys (maybe other tokens later). As part of that process I'd like to be able to (1) detect whether or not an authentication token is already present, so I can prompt the user to insert one if not, and (2) determine what type of token is inserted, so I can include an image of the token with helpful animation/instructions about how to use it when it comes time for them to verify their presence by (with Yubikeys) pressing a touchpad or other contact.

Offhand I don't see anything in the navigator.credential API that seems to suggest that this is possible, and maybe it would violate all sorts of Javascript security limitations if client code is allowed to probe devices, but I just wondered if anyone has any hints about how such a thing could be done?

Thanks!

user4294565
  • 131
  • 5

1 Answers1

4

Indeed, this cannot be done to prevent tracking users against their will based on their available authenticators.

The most that can be determined is if the browser is running on a platform with a built-in authenticator via [isUserVerifyingPlatformAuthenticatorAvailable][2]

See also some recent related discussion in the spec repository https://github.com/w3c/webauthn/issues/1563

dontcallmedom
  • 2,420
  • 14
  • 12