1539541 - Enable FIDO U2F API, and permit registrations for Google Accounts

Status: RESOLVED FIXED

(Core :: DOM: Web Authentication, enhancement, P1)

Description

[J.C. Jones [:jcj] (he/him)]

Per the thread Intent-to-Ship: Backward-Compatibility FIDO U2F support for Google Accounts on dev-platform [0], this bug is to:

1. Enable the security.webauth.u2f by default, to ride the trains
2. Remove the aOp == U2FOperation::Sign check from EvaluateAppID in WebAuthnUtil.cpp, permitting the Google override to work for Register as well as Sign.

This would enable Firefox users to use FIDO U2F API on most all sites, subject to the algorithm limitations discussed in the section ## Thorny issues in enabling our FIDO U2F API implementation ## of that post.

[0] https://groups.google.com/d/msg/mozilla.dev.platform/q5cj38hGTEA/lC834665BQAJ

Comment 1

[J.C. Jones [:jcj] (he/him)]

Attachment: Bug 1539541 - Enable FIDO U2F API, and permit registrations for Google Accounts

Per the thread "Intent-to-Ship: Backward-Compatibility FIDO U2F support for
Google Accounts" on dev-platform [0], this bug is to:

1. Enable the security.webauth.u2f by default, to ride the trains

2. Remove the aOp == U2FOperation::Sign check from EvaluateAppID in
   WebAuthnUtil.cpp, permitting the Google override to work for Register as
   well as Sign.

This would enable Firefox users to use FIDO U2F API on most all sites, subject
to the algorithm limitations discussed in the section "Thorny issues in
enabling our FIDO U2F API implementation" of that post.

[0] https://groups.google.com/d/msg/mozilla.dev.platform/q5cj38hGTEA/lC834665BQAJ

Comment 2

[J.C. Jones [:jcj] (he/him)]

[Tracking Requested - why for this release]:
I'd like this to be considered for Beta 67 uplift:

• This is enabling an already-well-used behind-pref feature.
• The sooner we enable the feature, the faster Google Accounts can turn this functionality on for Firefox users.

My intention is to land this in Nightly as soon as review is complete, and with luck, request uplift on Monday.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/e27fc0c01a97
Enable FIDO U2F API, and permit registrations for Google Accounts r=keeler,qdot

Comment 4

[Oana Pop-Rus]

https://hg.mozilla.org/mozilla-central/rev/e27fc0c01a97

Comment 5

[J.C. Jones [:jcj] (he/him)]

Comment on attachment 9054217 [details]
Bug 1539541 - Enable FIDO U2F API, and permit registrations for Google Accounts

Beta/Release Uplift Approval Request

• Feature/Bug causing the regression: n/a
• User impact if declined: Delay in providing security key registration support for Google Accounts (to 68)
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: No
• If yes, steps to reproduce: (It's just a pref flip, and Google has checked it)
• List of other uplifts needed: n/a
• Risk to taking this patch: Medium
• Why is the change risky/not risky? (and alternatives if risky): FIDO U2F API has been used by a power user audience via pref-flip since 57 without issues. The Google Accounts piece is a simple if-condition change. Since it's shipping a feature, it's probably at least a "medium" risk rather than low, but otherwise I'd be tempted to call it "low".
• String changes made/needed: None

Comment 6

[Pascal Chevrel:pascalc (PTO until April 26)]

Comment on attachment 9054217 [details]
Bug 1539541 - Enable FIDO U2F API, and permit registrations for Google Accounts

Uplift approved for 67 beta 9, thanks.

Comment 7

[Daniel Varga [:dvarga]]

https://hg.mozilla.org/releases/mozilla-beta/rev/21acdae6bafe

Comment 8

[Pascal Chevrel:pascalc (PTO until April 26)]

Added to 67 beta release notes with this wording:
Enable FIDO U2F API, and permit registrations for Google Accounts

(We may want a more consumer-friendly wording for the final release)

Comment 9

[Liz Henry (:lizzard) (relman/hg->git project)]

Is this something you're aiming to get into ESR 60.7? I notice it is mentioned on the ESR trello board.

Comment 10

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

I think J.C.'s back today, so I'll ask him.

Comment 11

[J.C. Jones [:jcj] (he/him)]

I don't think it's important enough to uplift into 60.7, I think it's okay to wait for ESR 68.0.

Comment 12

[y.firefox]

This does not fix registration for Google Accounts in 67 Stable as google says "this browser is not supported please try in Chrome."
this needs to be fixed on their end.

Comment 13

[J.C. Jones [:jcj] (he/him)]

Thanks. I'll remind Google. :)

Comment 14

[Riccardo Brasca]

Using the latest firefox mobile I am not able to sign-in in google using a yubikey. It seems google doesn't like firefox mobile.

Comment 15

[J.C. Jones [:jcj] (he/him)]

Riccardo, I'm seeing the same behavior. I've reached out to the Google Accounts team over email to see what the deal is. Thanks!