1416056 - Web Authentication - Default to "None Attestation"

Status: RESOLVED FIXED

(Core :: DOM: Device Interfaces, enhancement, P1)

Description

[J.C. Jones [:jcj] (he/they)]

WebAuthn has an attestation type that permits the UA to replace the attestation certificate produced by an authenticator with a self-signed one. Basically, strip out the cert and signature in the Create operation, and perform the just-in-time cert-generation-and-sign functions from our soft token.

We should use this attestation type in Private Browsing mode. We should also expose a pref to enable this by default, for users that prefer cloaking the certificates. (Tor Browser, maybe?)

Comment 1

[J.C. Jones [:jcj] (he/they)]

Update: We don't want this to be something that is Private Browsing vs. not, as it could be used to ascertain whether or not PB is in use. Let's just add the feature, and we'll use it in Bug 1428916.

I'm assigning this to you, Tim, as I think designing the code move out of U2FSoftTokenManager (and into ... somewhere) is something you're closer to.

Comment 2

[J.C. Jones [:jcj] (he/they)]

Oh: I don't think this needs a pref. I think it needs only the Conveyance in Bug 1428916 and some UX to come in a follow-on bug.

Comment 3

[J.C. Jones [:jcj] (he/they)]

Note for the implementor -- you should review https://github.com/w3c/webauthn/pull/741 and see if that's something we want to plan for / to do also, instead of just adjusting the u2f attestation type. (I think we can't, actually, for u2f devices, but I'm not certain of that!)

Comment 4

[J.C. Jones [:jcj] (he/they)]

Further thoughts: I think the code from the Soft Token should remain, to help testing. That way the "Firefox U2F Soft Token" attestation cert can be tested as being replaced by the "Firefox Web Authentication Anonymized Authenticator" (or whatever) certificate. See the test in https://reviewboard.mozilla.org/r/215002/diff/2#index_header

Comment 5

[Phabricator Automation]

Attachment: Bug 1416056 - Web Authentication - Support replacing device certificates with "Self Attestation" certificates r=jcj

Comment 6

[Phabricator Automation]

Attachment: Bug 1416056 - Web Authentication - Default to "None Attestation" r=jcj

Comment 7

[Phabricator Automation]

Comment on attachment 8949694 [details]
Bug 1416056 -  Web Authentication - Default to "None Attestation" r=jcj

J.C. Jones [:jcj] has approved the revision.

https://phabricator.services.mozilla.com/D567

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/a40174c2bf2c
Web Authentication - Default to "None Attestation" r=jcj

Comment 9

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/a40174c2bf2c