Bug 213642 – [WebAuthn] Client PIN flow does not indicate that a final authenticator touch is needed

• Status: RESOLVED
• Resolution: CONFIGURATION CHANGED
• Component: WebCore Misc.

Congratulations with the new Client PIN support in Safari!

When testing this with Safari Technology Preview 109, I noticed that the client PIN flow ends without any indication to the user that a final authenticator touch is needed to complete the operation.

Observation:

1: The user initiates authentication
2: The "Do you want to sign in .. using a security key" dialog appears, telling the user to insert a key and to activate it
3: The user touches the security key to select it
4: The "Enter a PIN to unlock this authenticator" dialog appears
5: The user enters a valid PIN, clicks "Submit"
6: The PIN entry dialog disappears and the security key starts blinking, but the client UX has no indication that the user must touch the authenticator again to complete the operation

This could be improved by adding some form of dialog after step 5 to indicate that the operation is not done before the user touches/activates the authenticator.

[Radar WebKit Bug Importer]

<rdar://problem/64808752>

[Jiewen Tan]

(In reply to eirbjo from comment #0)
> Congratulations with the new Client PIN support in Safari!
> 
> When testing this with Safari Technology Preview 109, I noticed that the
> client PIN flow ends without any indication to the user that a final
> authenticator touch is needed to complete the operation.
> 
> Observation:
> 
> 1: The user initiates authentication
> 2: The "Do you want to sign in .. using a security key" dialog appears,
> telling the user to insert a key and to activate it
> 3: The user touches the security key to select it
> 4: The "Enter a PIN to unlock this authenticator" dialog appears
> 5: The user enters a valid PIN, clicks "Submit"
> 6: The PIN entry dialog disappears and the security key starts blinking, but
> the client UX has no indication that the user must touch the authenticator
> again to complete the operation
> 
> This could be improved by adding some form of dialog after step 5 to
> indicate that the operation is not done before the user touches/activates
> the authenticator.

This problem has been resolved already. Please try out our next STP for verification.