feat: User verification spoofing
invalid
In #2283 I propose that User Verification should be similar to KeepassXC. I understand that this behavior violate the specs, but it should be entirely up to the end user to choose what to report to 3rd parties.
This PR adds an option in the settings "Spoof user verification". When checked on, it will always report that user verification is enabled. This do not override the actual check itself - if the user enable user verification, they still get user verification; if the user disable user verification in the database, they should not get user verification but they should not be impeded by any checks in this applications or remotely.
From the wiki https://github.com/Kunzisoft/KeePassDX/wiki/User-Verification, the expected changes should be
When the database is open at the start of the ceremony and UV mode is enabled:
- If the RP request is `preferred`, KeePassDX will perform an UV if one or both of `Form filling - Passkeys settings - Preferred User Verification` , `Form filling - Passkeys settings - Spoof User Verification` is on.
- If either settings is on, then UV is performed and reported to the server.
- If all of them are off, then UV will not be performed. The server may request additional verification such as 2FA and slow down the user's authentication.
If a database is already open, User Verification mode is disabled, and spoof User Verification is enabled, User Verification will not be performed. All authentication request will succeed. The server will be informed that User Verification has already been performed.
合并状态:未合并 6 条评论