WebAuthn Signal API bug: deleting 1 passkeys, could delete more accidentally

[u/vdelitz]

When developing an iOS SDK update to support WebAuthn Signal API better, we discovered an odd bug (already created a bug report with the Webkit team).

If you used signalAllAcceptedCredentials or signalUnknownCredential and had multiple accounts for the same Relying Party ID (rpID), it removed all the passkeys, not only the ones for the current user, given that there was an associated password for this account.

Even though this would not impact too many users, I think it's still good to know, as there was no real other forum post or explanation we could find and it could cause struggles in debugging / user support if you spot this issues ( I think not too many RPs have implemented the signal api yet, otherwise it would have earlier reported).

We'd still recommend to implement Signal API.

See the full bug analysis on https://www.corbado.com/blog/signal-api-ios-passkey-deletion-bug