41 ms·

What was inconsistent between browsers/OSes? I've implemented webauthn support and didn't have to do anything special to make it work in all browsers I've teste

What was inconsistent between browsers/OSes? I've implemented webauthn support and didn't have to do anything special to make it work in all browsers I've tested with.

Hamuko 4y ago
Registration UX/flow, JavaScript APIs, and removing Resident Keys at least. Windows computers with Windows Hello activated basically completely ignore hardware-based WebAuthn devices unless you specify that you want to register a cross-platform device. So the same piece of registration code will act differently if you're using Chrome on macOS, where you will be asked if you want to register a platform authenticator (Touch ID) or if you want to register a cross-platform authenticator (Yubikey), and Chrome on Windows, where you will basically be automatically defaulted to platform authenticator (Windows Hello) unless you abort the Windows Hello registration, in which case it will switch over to a cross-platform registration. You basically need to set authenticator attachment to either "platform" or "cross-platform" to get consistent experience across macOS and Windows. And Safari for example requires user gestures for navigator.credentials.get(), so if you were thinking of redirecting users to a /login/verify/ page where it will automatically prompt for a WebAuthn verification, you actually need Safari users to click on a button on that page. On other browsers, you can basically just pop up the WebAuthn prompt automatically on page load. And removing Resident Keys is another pain point. On Windows you basically need to do it via the command-line, whereas on macOS you need to go to "Clear browsing data" and then select "Passwords and other sign-in data" in order to get rid of them. So on Windows, they make it basically impossible for the regular user, and on macOS, they make it so easy that users might accidentally do it if they don't realise that the internal password manager and the stored Resident Keys are wiped the same way. Can't remember how it worked for Firefox, but I'm sure it will be at least slightly different (or didn't work at all, Firefox was painful). I also can't remember off the top of my head if Firefox even supported fingerprint-backed authenticator devices on macOS. On Windows it might, since I think everything there goes through Windows Hello.
- ArchOversight 4y ago
  > And Safari for example requires user gestures for navigator.credentials.get(), so if you were thinking of redirecting users to a /login/verify/ page where it will automatically prompt for a WebAuthn verification, you actually need Safari users to click on a button on that page. On other browsers, you can basically just pop up the WebAuthn prompt automatically on page load. This is something that is being changed in the standard that user action will be required. Safari just implemented it first. The problem is that without prompting things like FaceID on the iPhone are so fast that you may get logged in without knowing if there is no user action required.

What was inconsistent between browsers/OSes? I've implemented webauthn support and didn't have to do anything special to make it work in all browsers I've tested with.

Hamuko 4y ago

Registration UX/flow, JavaScript APIs, and removing Resident Keys at least. Windows computers with Windows Hello activated basically completely ignore hardware-based WebAuthn devices unless you specify that you want to register a cross-platform device. So the same piece of registration code will act differently if you're using Chrome on macOS, where you will be asked if you want to register a platform authenticator (Touch ID) or if you want to register a cross-platform authenticator (Yubikey), and Chrome on Windows, where you will basically be automatically defaulted to platform authenticator (Windows Hello) unless you abort the Windows Hello registration, in which case it will switch over to a cross-platform registration. You basically need to set authenticator attachment to either "platform" or "cross-platform" to get consistent experience across macOS and Windows. And Safari for example requires user gestures for navigator.credentials.get(), so if you were thinking of redirecting users to a /login/verify/ page where it will automatically prompt for a WebAuthn verification, you actually need Safari users to click on a button on that page. On other browsers, you can basically just pop up the WebAuthn prompt automatically on page load. And removing Resident Keys is another pain point. On Windows you basically need to do it via the command-line, whereas on macOS you need to go to "Clear browsing data" and then select "Passwords and other sign-in data" in order to get rid of them. So on Windows, they make it basically impossible for the regular user, and on macOS, they make it so easy that users might accidentally do it if they don't realise that the internal password manager and the stored Resident Keys are wiped the same way. Can't remember how it worked for Firefox, but I'm sure it will be at least slightly different (or didn't work at all, Firefox was painful). I also can't remember off the top of my head if Firefox even supported fingerprint-backed authenticator devices on macOS. On Windows it might, since I think everything there goes through Windows Hello.

ArchOversight 4y ago
> And Safari for example requires user gestures for navigator.credentials.get(), so if you were thinking of redirecting users to a /login/verify/ page where it will automatically prompt for a WebAuthn verification, you actually need Safari users to click on a button on that page. On other browsers, you can basically just pop up the WebAuthn prompt automatically on page load. This is something that is being changed in the standard that user action will be required. Safari just implemented it first. The problem is that without prompting things like FaceID on the iPhone are so fast that you may get logged in without knowing if there is no user action required.