3 ms·
The blog post is misconstruing things; WebAuthn is not totally backwards compatible with U2F. Specifically, WebAuthn doesn't support the U2F trusted facets func
by ferdowsi 5y ago
The blog post is misconstruing things; WebAuthn is not totally backwards compatible with U2F. Specifically, WebAuthn doesn't support the U2F trusted facets functionality, which allowed for a U2F credential to be used on a cross-origin basis. https://fidoalliance.org/specs/fido-u2f-v1.2-ps-20170411/fido-appid-and-facets-v1.2-ps-20170411.html https://fidoalliance.org/specs/fido-u2f-v1.2-ps-20170411/fid...
- tialaramex 5y agoIs anybody actually doing that? To me it looks like something that's astoundingly fragile and unwieldy and I'd expect that most "users" of this feature were either opening themselves up to a vulnerability they hadn't considered or were in fact attackers targeting such a vulnerability. Yuck.