Browser PRF feasibility spike

Supplemental evidence only. This page tests Chrome WebAuthn with an owner-selected Google Password Manager passkey. It does not validate the native macOS AuthenticationServices provider path, verify assertions on a server, connect to a Unisynx account, or upload evidence.

Safety boundary

PRF output exists only briefly in browser memory: after hashing, both the working copy and the buffer the browser returned are zeroed. Copies the browser or authenticator may retain internally are outside this page's control.
Evidence contains SHA-256 hashes and boolean checks, never raw PRF output.
The assertion upload shape is audited as exactly five PRF-free fields.
The page security policy blocks network connections and framing.

Run

Preparing a clean test identity…

I will explicitly select Google Password Manager in Chrome. The relying party cannot detect which password manager I selected, so this is owner-confirmed evidence.

Loading…

Redacted evidence preview

No evidence recorded.