Update documentation to avoid PIN bypass

[tcannonfodder]

This fixes #350, which pointed out a bug in certain browser/device combinations that allow bypassing the user's PIN if the user_verfication: true flag is not set.

https://hwsecurity.dev/2020/08/webauthn-pin-bypass/

[tcannonfodder]

I feel like that in order to help with the migration to passkeys, the docs should setup so that user_verification is required throughout.

[brauliomartinezlm]

Sorry for the delay. Will take a look ASAP

[santiagorodriguez96]

Nice! Thank you @tcannonfodder! And sorry for the late response 😥

I think this is a good idea to add some documentation on how to require user_verification for the cases where developers use this gem in a password-less login!

Although adding user_verification: true to the verify method is correct, we should also add some documentation about how to set the user_verification in the PublicKeyCredential::Options to be required in the initiation phase of both Credential Authentication and Registration ceremonies – see the docs. That is because, as for a password-less login you will be requiring UV, you will want the authenticators that don't support UV to not be eligible to be used instead of letting them be used and then raise a verification error. In order to do that you can do:

• In the initiation phase of the Credential Registration ceremony:

options = WebAuthn::Credential.options_for_create(
  ...,
  authenticator_selection: { user_verification: "required" }
)

• In the initiation phase of the Credential Authentication ceremony:

options = WebAuthn::Credential.options_for_get(
  ...,
  user_verification: "required"
)

We had an old PR opened in webauthn-rails-demo-app – which implements a password-less login using webauthn – for adding user verification which I revisited and merged after seeing this issue/PR. You can check it to see how we did to add this and maybe even try it if you want 🙂

[santiagorodriguez96]

I think we should also add this to creation options in the initiation phase of the Credential Registration ceremony 🙂

[santiagorodriguez96]

We should also add this for PublicKeyCredentialWithAttestation#verify 🙂

Also, we could also add it to the params of this method in line 381.