1508115 - Web Authentication - Support Windows Hello (mandatory in 2019)

Status: RESOLVED FIXED

(Core :: DOM: Device Interfaces, enhancement, P3)

Description

[J.C. Jones [:jcj] (he/they)]

WebAuthn no longer works on Windows Insider builds, as compatible security keys are no longer available via the USB HID interface. (Basically, u2f-hid-rs [1] will stop supporting Windows 10+).

Sometime this spring, Firefox 66 or 67 (and ESR 60) will need to use the Windows Hello API on when available to interact with Web Authentication. Otherwise, no devices will be detected and we'll have a Windows feature regression.

The relevant API headers are provided by Microsoft as MIT-licensed files [2] as they will need to be checked into mozilla-central.


[1] https://github.com/jcjones/u2f-hid-rs/
[2] https://github.com/Microsoft/webauthn

Comment 1

[Akshay Kumar]

Attachment: Bug 1508115 - Web Authentication - Support Windows Hello

This change adopts Windows Win32 WebAuthN APIs from https://github.com/Microsoft/webauthn

Comment 2

[J.C. Jones [:jcj] (he/they)]

Thank you, Akshay!

Comment 3

[J.C. Jones [:jcj] (he/they)]

Oops, wrong user account. But seriously, thank you Akshay. Review will happen ASAP!

Comment 4

[Akshay Kumar]

Attachment: Bug 1508115 - Web Authentication - Support Windows Hello

- Incorporated review feedback - Version 1

Depends on D15752

Comment 5

[Akshay Kumar]

https://bugzilla.mozilla.org/show_bug.cgi?id=1518876 tracks Window Handle issue.

Comment 6

[Akshay Kumar]

Attachment: Bug 1508115 - Web Authentication - Support Windows Hello

This change adopts Windows Win32 WebAuthN APIs from https://github.com/Microsoft/webauthn

Comment 7

[J.C. Jones [:jcj] (he/they)]

It's possible at this point that this patch won't make it into 66 before the freeze, but because of the upcoming Windows change, we still need it in 66, potentially via uplift. Marking for release tracking against 66.

Comment 8

[Dana Keeler (she/her) (use needinfo) [:keeler]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=a0558a5c476890f6f74095435fac47f121f345df

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/828fe91e878b
Web Authentication - Support Windows Hello r=keeler,jcj,baku

Comment 10

[Raul Gurzau (:RaulG)]

https://hg.mozilla.org/mozilla-central/rev/828fe91e878b

Comment 11

[Julien Cristau [:jcristau]]

From comment 0 it sounds like we'll want this on esr60 as well.

Comment 12

[Mike de Boer [:mikedeboer]]

https://hg.mozilla.org/projects/cedar/rev/828fe91e878b700d0135adb3f45a9554694e4498
Bug 1508115 - Web Authentication - Support Windows Hello r=keeler,jcj,baku

Comment 13

[Akshay Kumar]

Attachment: Bug 1508115 - Web Authentication - Support Windows Hello

Support Main Algorithms

Comment 14

[Ryan VanderMeulen [:RyanVM]]

Is this something we need to backport to ESR60? If so, it'll need a rebased patch and an uplift approval request :)

Comment 15

[J.C. Jones [:jcj] (he/they)]

It's not a bad idea to uplift, but not until we have resolution on bug 1528097 (which I haven't investigated yet). We'd also have to uplift bug 1522077.

Comment 17

[Ryan VanderMeulen [:RyanVM]]

This isn't going to make the 60.6esr release. Let's circle back during the next cycle.

Comment 18

[J.C. Jones [:jcj] (he/they)]

Sounds good. I think the percentage of people using ESR that will move rapidly to the bleeding edge patchlevel of Windows 10 this month is going to be low.

Comment 19

[Liz Henry (:lizzard) (relman/hg->git project)]

Added a release note for 66: Easier, passwordless security: Added support for Windows Hello on Windows 10, allowing you to use your face, fingerprint, or external security keys for website authentication.

Comment 20

[Liz Henry (:lizzard) (relman/hg->git project)]

Dana, Kyle, since the fix in bug 1528097 is getting uplifted to ESR 60.7, maybe we could bring this in as well along with bug 1522077. What do you think? (asking you all since jcj is out)

Comment 21

[Kyle Machulis [:qdot] [:kmachulis] (INACTIVE)]

I wasn't on the reviews for this, so I can't really speak for the complexity of uplift here.

Comment 22

[Dana Keeler (she/her) (use needinfo) [:keeler]]

I'm looking in to this, but it's unclear exactly what all needs to be uploaded and how safe it would be.

Comment 23

[Dana Keeler (she/her) (use needinfo) [:keeler]]

My analysis is that it would be difficult and risky to uplift this. These changes depend on a number of other changes (and I'm not even sure I've identified all of them), some of which landed before the great reformatting. If we're going to do this, it would need to be done by someone much more familiar with the implementation.

Comment 24

[Liz Henry (:lizzard) (relman/hg->git project)]

OK, thanks. Let's leave it for 68 ESR then.