Email OTP

[wicg]

Email OTP

[samuelgoto]

The other way we could go about this is with a registration API and double signed certificates, which would allow the browser mint new credentials. Something along the lines of:

navigator.registerEmailProvider((publicKey) => {
  // publicKey is a new key that the browser generates that can be used
  // to generate new assertions
 return ...
});

A web-based email client would call that API and relying parties would call the WebOTP API to get new assertions minted:

let jwt = await navigator.credentials.get({transport: "email"});

And the JWT would contain two assertions:

1. one from the email provider delegating minting credentials to publicKey and
2. one from the publicKey, minting credentials tied to a specific origin / audience

WDYT?

[samuelgoto]

Ok, I've written down more about this, so resolving this:

https://github.com/samuelgoto/email-otp

Lets follow up on that repo and have a discussion there.