3 ms·
If you're curious why it has taken Google accounts so long to switch over to webauthn, there was a fairly interesting discussion about this on the mozilla-dev m
by psanford 5y ago
If you're curious why it has taken Google accounts so long to switch over to webauthn, there was a fairly interesting discussion about this on the mozilla-dev mailing list back in 2019[0]. The tldr is: some Android OEMs baked U2F into their OS images that were then never updated. Switching to webauthn could have effectively locked users out of these devices.
[0]: https://groups.google.com/g/mozilla.dev.platform/c/q5cj38hGTEA/m/lC834665BQAJ https://groups.google.com/g/mozilla.dev.platform/c/q5cj38hGT...
- j16sdiz 5y agoIt is kind of unrealistic to read every maillist your work depends on.. Many people don't know about this until the deprecation note appears on his desktop.
- psanford 5y agoThis mailing list post has nothing to do with the u2f api being deprecated in chrome. Edit: correct which api is deprecated.
- riedel 5y agoI always thought that standards are there to be stable and well documented. This whole fido mess shows how IMHO it should not be done. Anyone who e.g. build stuff on top of CTAP on windows saw their stuff break because windows proxies the whole webauthn stuff through their windows hello APIs and made sure that USB access to FIDO devices is blocked on OS level. What is left is a totally underdocumented webauthn.h header file from Microsoft on GitHub. I am confident that they will break things over and over again, so that it best fits them.