As I went through Fido specifications: the server (providing web app/services) need to trust user agent for local fido authentication and if needed can enforce certain policies" I am not sure ...
I'm working on a web app, and I may eventually want to bring others onto the project. I have two sets of GitHub credentials: one called Foo that calls back to foo.com/endpoint, and one called Foo -- ...
I remember hearing something like this when I first learned the protocols that removed the need of a trusted third party, but I can't find this theorem or "law" anywhere. Any pointers?