Max: basically this proposal is to secure the playment request web webauthn proposal... extension enhancement with webauthn protocol... I looked at the explainer.. They summarized the issues this proposal has - security considerations, cross-origin auth mechanism... analysis that there may be security risks... Also from a design perspective they have analysis that this security payment confirmation - mechanism is designed ... may not be a good design choice because not a payment method... But easier way to do this... In general looking at their explainer they summarized well. Maybe they need our input on the design choice.

<blockquote> Thank you for this review request and for the comprehensive information you've put together in the explainer. As we've previously positively reviewed Payment Request and Web Authentication we're happy to see these being brought together to make the web payment user flow easier. The use cases and user needs are well documented. It's also great to see the results of the experiment written up here.

Regarding the design choices you've made to implement this as a payment method: we're concerned that this may be confusing to developers. Would the alternative approach (navigator.credentials.get()) be better from a developer ergonomics PoV? If so, it may be worth the effort to coordinate with the webauthn working group.

Regarding the privacy risks enumerated at the end of the explainer, can you include more specific mitigation advice for implementers on how to mitigate against these potential attacks?

</blockquote>