1768622 - Support Google's "built-in security key" on phones

Status: NEW

(Core :: DOM: Web Authentication, enhancement, P3)

Description

[Dennis Schubert [:denschub]]

Googles 2fa flow supports using a phone's "built-in security key", as explained in https://support.google.com/accounts/answer/9289445

I don't know details about how this even works or if this is standardized or not, but even if we spoof as Chrome, Google still claims Firefox on Android is "unsupported". Maybe there is something we can do about that.

(I'm not sure if this is even related to WebAuthn, but this is a good starting point.)

Comment 1

[R. Martinho Fernandes [:rmf]]

From what I've gathered this is a FIDO authenticator that uses the phone's TEE as the backend, and is exposed to other devices via Bluetooth. So this is at least WebAuthn-adjacent. It should be possible to make it work at least on Android. Do any other websites support this, or is this only usable on google.com?

As far as I can tell Windows Hello does not support Bluetooth security keys (when I try to add a security key it asks to insert it in the USB port; maybe there is a way that I am not aware of). If we were to want to support this on a Windows desktop we wouldn't be able to do so using our current approach, which is to simply call down to Windows Hello and let it take it from there.

Comment 2

[Dennis Schubert [:denschub]]

(In reply to R. Martinho Fernandes [:rmf] from comment #1)

Do any other websites support this, or is this only usable on google.com?

As far as we know right now, it's only Google. We'll add see-also's if we see more reports.

Comment 3

[Thomas Wisniewski [:twisniewski]]

This isn't breaking anything per se, just changing the UX on their page a bit (and it's unclear whether we want to support FIDO anytime soon), so we're setting webcompat P3 for now.

Comment 4

[R. Martinho Fernandes [:rmf]]

Ah, this uses caBLE ("cloud assisted Bluetooth Low Energy"), which is a protocol that Google designed to side-step the need for the user to do Bluetooth pairing and has been submitted to FIDO for review. This will probably be part of the protocol suite for so-called Webauthn "passkeys" (aka multi-device credentials).