4 ms·

Sites should be migrating to WebAuthn (and please people do not implement U2F instead of WebAuthn in 2020, for the same reason you wouldn't build a new Flash vi

by papaf 6y ago

Sites should be migrating to WebAuthn (and please people do not implement U2F instead of WebAuthn in 2020, for the same reason you wouldn't build a new Flash video site, nothing new supports that technology any more, stop it) I think this is terrible advice because WebAuthn isn't supported by Linux browsers and I still want to be able to login to services on the internet.

tialaramex 6y ago
Which "Linux browsers" are you thinking of? Firefox only implements WebAuthn, including on Linux, the U2F support in Firefox is essentially a "reverse polyfill" in which the browser pretends it can do U2F but actually is just wiring some commonly used parts of U2F to the WebAuthn implementation to tide you over until your site gets WebAuthn. Chrome on Linux certainly supports WebAuthn although it does have U2F support. I'm sure Lynx can't do WebAuthn, but I'm also 100% sure I don't care.
- papaf 6y ago
  This site does not work for me with Firefox 79.0 on Linux with a Yubikey 5: https://demo.yubico.com/webauthn https://demo.yubico.com/webauthn Is this a problem with the backend rather the browser? Edit: This site works https://webauthn.io/ https://webauthn.io/ My mistake!
  - tialaramex 6y ago
    The anti-fingerprinting in Firefox will flag that first site you linked. The site is asking your FIDO Authenticator to provide "attestation". In theory this could be useful to require users to pick a high quality authenticator. It might make sense, for example for Big Bank to require customers use an authenticator Big Bank bought in bulk with Big Bank branding, because they trust it. But, although countermeasures against tracking were incorporated in the FIDO design for attestation, it is unavoidably a potential privacy risk and so Firefox decided to flag it. Sites which try to ask for attestation during registration get a "Fingerprint" icon in newer Firefox versions. Click the fingerprint and opt either to press on anyway or to Anonymise the authentication (essentially pretend your device hasn't got any attestation) on this site. For a site owner: Do not do attestation just because it seems cool and worked in Edge or whatever. If you don't need this sensitive information do not request it. You need to work out a policy, which authenticators are OK and which aren't - if that seems like too much then don't do attestation. If the answer is "actually any authenticator seems good" then don't do attestation. If you allow users to just not have an authenticator (100% of general purpose web sites today) then don't do attestation for those who want one. If you are throwing the data away because you have no idea how to process it don't do attestation.

by papaf 6y ago

tialaramex 6y ago

Which "Linux browsers" are you thinking of? Firefox only implements WebAuthn, including on Linux, the U2F support in Firefox is essentially a "reverse polyfill" in which the browser pretends it can do U2F but actually is just wiring some commonly used parts of U2F to the WebAuthn implementation to tide you over until your site gets WebAuthn. Chrome on Linux certainly supports WebAuthn although it does have U2F support. I'm sure Lynx can't do WebAuthn, but I'm also 100% sure I don't care.

papaf 6y ago
This site does not work for me with Firefox 79.0 on Linux with a Yubikey 5: https://demo.yubico.com/webauthn https://demo.yubico.com/webauthn Is this a problem with the backend rather the browser? Edit: This site works https://webauthn.io/ https://webauthn.io/ My mistake!
- tialaramex 6y ago
  The anti-fingerprinting in Firefox will flag that first site you linked. The site is asking your FIDO Authenticator to provide "attestation". In theory this could be useful to require users to pick a high quality authenticator. It might make sense, for example for Big Bank to require customers use an authenticator Big Bank bought in bulk with Big Bank branding, because they trust it. But, although countermeasures against tracking were incorporated in the FIDO design for attestation, it is unavoidably a potential privacy risk and so Firefox decided to flag it. Sites which try to ask for attestation during registration get a "Fingerprint" icon in newer Firefox versions. Click the fingerprint and opt either to press on anyway or to Anonymise the authentication (essentially pretend your device hasn't got any attestation) on this site. For a site owner: Do not do attestation just because it seems cool and worked in Edge or whatever. If you don't need this sensitive information do not request it. You need to work out a policy, which authenticators are OK and which aren't - if that seems like too much then don't do attestation. If the answer is "actually any authenticator seems good" then don't do attestation. If you allow users to just not have an authenticator (100% of general purpose web sites today) then don't do attestation for those who want one. If you are throwing the data away because you have no idea how to process it don't do attestation.