1571771 - WebAuthn: support for Android Safetynet credential

Status: RESOLVED INCOMPLETE

(Firefox for Android Graveyard :: General, enhancement, P3)

Description

[Nicolas Mora]

Attachment: bug firefox webauthn.txt

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0

Steps to reproduce:

Create a new credential with the Webauthn API using the Mozilla Demo at https://webauthn.bin.coffee/ using the Attestation type "Direct"

Actual results:

The attestation return is of fmt type 'none', so the attestation can't be verified using Android SafetyNet Attestation Statement Format at https://w3c.github.io/webauthn/#sctn-android-safetynet-attestation

Expected results:

The attestation returned should be of fmt type 'android-safetynet' with the attestation signed by the android platform, like in Chrome for android.

Comment 1

[Stefan Arentz | :st3fan | ⏰ EST | he/him]

JC, can you find out what needs to be done with this bug? How important is this bug? Is this something your team could submit a patch for if this is important enough?

Comment 2

[J.C. Jones [:jcj] (he/they)]

No, I can't do this. If it's required, it'll need UX. See Bug 1550164 and Bug 1551229.

Comment 3

[Stefan Arentz | :st3fan | ⏰ EST | he/him]

Moved this to a P3 - depending on the outcome of bug 1550164 (on which this is blocked) this may become a priority at a later time.

Comment 4

[BMO Automation]

We have completed our launch of our new Firefox on Android. The development of the new versions use GitHub for issue tracking. If the bug report still reproduces in a current version of [Firefox on Android nightly](https://play.google.com/store/apps/details?id=org.mozilla.fenix) an issue can be reported at the [Fenix GitHub project](https://github.com/mozilla-mobile/fenix/). If you want to discuss your report please use [Mozilla's chat](https://wiki.mozilla.org/Matrix#Connect_to_Matrix) server https://chat.mozilla.org and join the [#fenix](https://chat.mozilla.org/#/room/#fenix:mozilla.org) channel.