3 ms·
Tell HN: Sites updating their U2F implementation, breaking login
I've noticed recently some sites (AWS, Sentry) refusing U2F login on touch - Sentry: 'your device reported an error', AWS: [nothing] - this having worked fine for years.
What it seems to be is that they are newly refusing 'anonymised' (by Firefox, I'm not sure exactly what this does) registrations on logins for existing linked devices. If I log in with an alternative second factor, which I fortunately have (perhaps I should give the benefit of the doubt and assume they only do this if you have another 2F? But then why not a better error message?) (actually, for AWS I had to use my access keys to disable 2FA on my own user account, since I didn't) and re-enroll the device, choosing not to anonymise in the Firefox pop-over, then it works fine.
I'm not sure what the (well-intentioned) utility of the non-anonymised data is anyway, but it seems very bad to be enforcing that for already registered users logging in. At least allow the login and force a re-enroll-with-no-anonymising flow, surely?