5 ms·
A few things to note because this can be confusing. Old u2f tokens are still supported by webauthn. The change here is specifically about what javascript APIs a
by psanford 5y ago
A few things to note because this can be confusing. Old u2f tokens are still supported by webauthn. The change here is specifically about what javascript APIs are available to websites.
If you are wondering if a site is using the webauthn or u2f api: the webauthn flow involves the browser showing a modal dialog. The u2f flow allowed for javascript to interact with your token without the browser itself showing a dialog.
You can see what the webauthn flow is with one of the many test sites, like https://webauthn.io/ https://webauthn.io/
- psanford 5y agoIf you're curious why it has taken Google accounts so long to switch over to webauthn, there was a fairly interesting discussion about this on the mozilla-dev mailing list back in 2019[0]. The tldr is: some Android OEMs baked U2F into their OS images that were then never updated. Switching to webauthn could have effectively locked users out of these devices. [0]: https://groups.google.com/g/mozilla.dev.platform/c/q5cj38hGTEA/m/lC834665BQAJ https://groups.google.com/g/mozilla.dev.platform/c/q5cj38hGT...
- j16sdiz 5y agoIt is kind of unrealistic to read every maillist your work depends on.. Many people don't know about this until the deprecation note appears on his desktop.
- psanford 5y agoThis mailing list post has nothing to do with the u2f api being deprecated in chrome. Edit: correct which api is deprecated.
- riedel 5y agoI always thought that standards are there to be stable and well documented. This whole fido mess shows how IMHO it should not be done. Anyone who e.g. build stuff on top of CTAP on windows saw their stuff break because windows proxies the whole webauthn stuff through their windows hello APIs and made sure that USB access to FIDO devices is blocked on OS level. What is left is a totally underdocumented webauthn.h header file from Microsoft on GitHub. I am confident that they will break things over and over again, so that it best fits them.
- baybal2 5y agoVery fortunately, USB smartcards still work, work accross platforms, work without change since V1 of Chrome, and are really out of Chrome devs reach since they operate on the OS platform lib level in Windows.
- vbezhenar 5y agoEvery device work by that definition. The question is about browser support without installing additional software. Here's my anecdote. In my country we use certificates to access government services. There are USB smartcards for secure storing and using those certificates. As there's no browser API to interact with smartcards, I'm forced to install their software. That software works only with installed root certificates (it uses https websocket on 127.0.0.1 to interact with browser). Few weeks ago they released new version and for some reason they decided to host it on a completely unrelated site owned by some private person. This is complete security madness, not even theater. So no, smartcards don't work. They're terrible from security perspective compared to native browser support, as they force user to install untrusted software with full access to the system and terrible security practices.
- fomine3 5y agoSmartcard access API should be made in a decade ago, rather than Web * (Bluetooth, MIDI, whatever) API. It's fundamental.