4 ms·

> GitHub supported physical security keys using the experimental U2F API for Chrome Yes, and to make it worse, they used user agent sniffing instead of feature

> GitHub supported physical security keys using the experimental U2F API for Chrome Yes, and to make it worse, they used user agent sniffing instead of feature detection even though it work fine in Firefox. Firefox enabled U2F because many sites which do implement U2F, do not implement WebAuthn yet. Luckily, it appears Github is now on the right track.

icelancer 7y ago
>> Yes, and to make it worse, they used user agent sniffing instead of feature detection even though it work fine in Firefox. My bank and my retirement accounts do this too. It's infuriating. I switched to Firefox recently due to failures in Chrome Sync and now I get this as a reward. Wonderful.
- sebazzz 7y ago
  Luckily Firefox features per-domain overriding of the use agent: general.useragent.override.[domain]
  - rehemiau 7y ago
    Currently using this on Firefox for Android through an extension, works great: https://addons.mozilla.org/en-US/firefox/addon/uaswitcher/ https://addons.mozilla.org/en-US/firefox/addon/uaswitcher/
    - icelancer 7y ago
      Just tried this with my Yubikey Nano and Vanguard Investments, after changing my u2f to "true" in about:config. Does not work at all. Vanguard shows the Yubikey login prompt but it doesn't activate the Yubikey, and pushing the key just spits out a OTP and dumps it to the browser search bar. Oh well.
      - richipargo 7y ago
        I used to have this issue but in my case it just meant I was missing some OS dependencies so it might vary on a case by case
outworlder 7y ago
> they used user agent sniffing instead of feature detection even though it work fine in Firefox This is one of my pet peeves – and which is why the User Agent strings are so asinine (Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A5370a Safari/604.1). Whitelisting features based on Browser type, version, device type, OS type or version, or any version for that matter is almost always wrong. Like 99% of the time – if you think your case is special, you are most likely wrong too. Basically it boils down to: "why do I care that this software is running this specific version?" If you are not writing a deployment script and some such and the answer is "because it implements feature X, or displays Y behavior", well, check that. I've also seen iPhone apps trying to figure out which device it was, to display assets. If you care about screen resolution, that's what you need to check. Your device table will become obsolete. Features may be backported(like in this case), bugs may be fixed, new weird hardware combinations may be released. Your application is not guaranteed to be in sync when that happens.
- solarkraft 7y ago
  Why is something like feature checking not used for software dependencies like libraries as well?
  - zaphirplane 7y ago
    Gun configure tried https://en.m.wikipedia.org/wiki/GNU_Build_System https://en.m.wikipedia.org/wiki/GNU_Build_System
- kevin_b_er 7y ago
  They're all from an era where javascript couldn't do everything. Those various crud of "like Gecko" were to get servers to deploy HTML that fit the pattern of another browser. There were websites that gave you error pages if you weren't Internet Explorer. Nowadays it is far less necessary, but there are still browser-specific stuff involved.

icelancer 7y ago

>> Yes, and to make it worse, they used user agent sniffing instead of feature detection even though it work fine in Firefox. My bank and my retirement accounts do this too. It's infuriating. I switched to Firefox recently due to failures in Chrome Sync and now I get this as a reward. Wonderful.

sebazzz 7y ago
Luckily Firefox features per-domain overriding of the use agent: general.useragent.override.[domain]
- rehemiau 7y ago
  Currently using this on Firefox for Android through an extension, works great: https://addons.mozilla.org/en-US/firefox/addon/uaswitcher/ https://addons.mozilla.org/en-US/firefox/addon/uaswitcher/
  - icelancer 7y ago
    Just tried this with my Yubikey Nano and Vanguard Investments, after changing my u2f to "true" in about:config. Does not work at all. Vanguard shows the Yubikey login prompt but it doesn't activate the Yubikey, and pushing the key just spits out a OTP and dumps it to the browser search bar. Oh well.
    - richipargo 7y ago
      I used to have this issue but in my case it just meant I was missing some OS dependencies so it might vary on a case by case

outworlder 7y ago

> they used user agent sniffing instead of feature detection even though it work fine in Firefox This is one of my pet peeves – and which is why the User Agent strings are so asinine (Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A5370a Safari/604.1). Whitelisting features based on Browser type, version, device type, OS type or version, or any version for that matter is almost always wrong. Like 99% of the time – if you think your case is special, you are most likely wrong too. Basically it boils down to: "why do I care that this software is running this specific version?" If you are not writing a deployment script and some such and the answer is "because it implements feature X, or displays Y behavior", well, check that. I've also seen iPhone apps trying to figure out which device it was, to display assets. If you care about screen resolution, that's what you need to check. Your device table will become obsolete. Features may be backported(like in this case), bugs may be fixed, new weird hardware combinations may be released. Your application is not guaranteed to be in sync when that happens.

solarkraft 7y ago
Why is something like feature checking not used for software dependencies like libraries as well?
- zaphirplane 7y ago
  Gun configure tried https://en.m.wikipedia.org/wiki/GNU_Build_System https://en.m.wikipedia.org/wiki/GNU_Build_System
kevin_b_er 7y ago
They're all from an era where javascript couldn't do everything. Those various crud of "like Gecko" were to get servers to deploy HTML that fit the pattern of another browser. There were websites that gave you error pages if you weren't Internet Explorer. Nowadays it is far less necessary, but there are still browser-specific stuff involved.