Security keys are generally stateless save for a global signature counter. While it’s technically possible to implement a stateful security key, physical tokens generally encrypt their state in a credential ID that is stored on the server of the relying party. Resident keys allow the security key to keep state and thus allow a username-less login experience by just proving a local PIN to the device. Developers can exercise this via the existing Webauthn standard.
Motivation
Specification
Status in Chromium
Enabled by default (tracking bug) in:
- Chrome for desktop release 76
Consensus & Standardization
After a feature ships in Chrome, the values listed here are not guaranteed to be up to date.
- No signal
- Shipped/Shipping
- No signal
- No signals
Owners
Intent to Prototype url
Intent to Prototype threadLast updated on 2020-11-09
Comments
Shipped in Chrome 76.