Arnar Birgisson

Let me verify this with Android experts, but my interpretation is that each security property can be either enforced in software or in TEE, and they can combine independently. E.g....

Because for a bytestring we have to specify how it gets decoded/encoded. Since the browser doesn't parse or manipulate it, that is unnecessary. It comes in as a string in...

> If I understand correctly, you mean that a malware on the user device could make calls to the TPM for generating a token with an indefinite expiry time? I...

Side note: tpm2_gettime is interesting, I didn't know about this. However not all key storage facilities we want to use provide this (DBSC is not TPM specific), and it's unclear...

Can you expand on what you consider a corner case? See [this article](https://blog.google/threat-analysis-group/phishing-campaign-targets-youtube-creators-cookie-theft-malware/) for some specific types of malware we want to address. In our experience, these are not the...

Browsers will have to defend against DoS attacks (malicious or accidental), in pretty much all design variants. I don't think that's a spec problem, and I think it is solvable...

> > So in the general case, we have to assume such malware can just make up whatever timestamps they want signed. > > Right, which is why the suggestion...

Yes, the path is meant to be the URL to the endpoint. I agree this is not clear at all.

> What does it mean to have more than Sec-Session-Registration header? It means the browser will process each individually, generating keys for each and call each registration endpoint. The case...

> Again, what scheme is used to send the value back? Tbh I hadn't thought about it further than for regular "Bearer" -- if we do decide the authorization value...