Currently they trust everything in fact.
Why should I trust Digicert for example? When did I make that decission?
What does 'trust' mean if the decission is made by others?
Why should I trust Digicert for example? When did I make that decission?
What does 'trust' mean if the decission is made by others?
Shouldn't there be an easy way to configure it to trust that?
If there is something running on 127.0.0.1:8716 which I have not given permission to run then my machine is compromised already. No?
The credentials in WebAuthn are bound to an FQDN (typically the name of the web server but e.g. news.ycombinator.com would be entitled to ask for WebAuthn credentials for ycombinator.com) so it's not as though this is irrelevant.
I can imagine a few dozen extra lines defining a special allowance for localhost in the WebAuthn spec., but then you're also building a bunch of special backend code to handle that too and for what?
I built a toy WebAuthn implementation to understand it better, but I did it on my vanity site, and I don't feel like it would really have been easier without.