Does Bitwarden need to do User Verification anew for each authentication ceremony?

[grb]

@DenBesten apologies for perhaps causing some confusion in my previous comment, which I have now revised to make more clear.
That comment was a response addressed to @Nail1684 , in which I cited your response to me from the other thread as an example of the debate that I am hoping to settle here (instead of cluttering up the feature request thread). But when I wrote “…I believe that you are of this opinion as well…”, I was addressing @Nail1684, not you. It is clear that you are/were not convinced that the standards do require synchronous UV.

Now to the substance of your comment :

@DenBesten

Remaining truthful in setting the flag is the important bit to me as it plays directly into maintaining corporate reputation. Therefore, I would strongly object to any proposal calling for the IdP to lie.

I fully agree, and I think that the changed UV behavior since version 2024.6.0 is expressly for the purpose of ending the lies.

@DenBesten

If the spec says UV MUST be contemporaneous with the passkey exchange then that is what they must do.

In my reading of the specifications, they do say so. The authentication ceremony is the full process of interactions between the user, authenticator, client, and RP which cause the passkey authentication to happen. The official definition of Authentication Ceremony clearly states that the ceremony “includes…user verification”, and a step-by-step specification of what happens during the authentication ceremony explicitly mentions the UV flag that is returned by the authenticator.

@DenBesten

Please do realize that my comment “cite please” is not intended to be confrontational

Did not take it as such. Have I moved the needle at all for you with the information provided above?