1809333 - Disable the U2F DOM API by default

Status: RESOLVED FIXED

(Core :: DOM: Web Authentication, enhancement)

Description

[John Schanck [:jschanck]]

We deprecated the U2F DOM API in 109 (Bug 1804579). Use telemetry (e.g. USE_COUNTER2_DEPRECATED_U2FRegister_DOCUMENT) shows little activity, and Chrome has fully deleted their support of the API. So we can set the default value of security.webauth.u2f to false in 111.

Comment 1

[John Schanck [:jschanck]]

Attachment: Bug 1809333 - Disable the U2F DOM API by default. r=dveditz

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/d24c37cd2f63
Disable the U2F DOM API by default. r=dveditz

Comment 3

[John Schanck [:jschanck]]

Release Note Request (optional, but appreciated)
[Why is this notable]: It is possible that this change breaks some second factor authentication flows.
[Affects Firefox for Android]: no
[Suggested wording]: The deprecated U2F Javascript API is now disabled by default. The U2F protocol remains usable through the WebAuthn API. The U2F API can be re-enabled using the security.webauth.u2f preference.
[Links (documentation, blog post, etc)]:

Comment 4

[Marian-Vasile Laza]

Backed out changeset d24c37cd2f63 (Bug 1809333) for causing mochitest failures on test_interfaces_secureContext.html.
Backout link
Push with failures <--> 2
Failure Log

Comment 5

[John Schanck [:jschanck]]

I updated the failing test so that it expects the interface to be disabled.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/8e01a52267b3
Disable the U2F DOM API by default. r=dveditz,webidl,saschanaz

Comment 7

[Cristian Tuns]

https://hg.mozilla.org/mozilla-central/rev/8e01a52267b3

Comment 8

[Donal Meehan [:dmeehan]]

Added to Nightly release notes.
Keeping the relnote? flag open to keep it on the radar for inclusion in our final release notes.

Comment 9

[Atila Butkovits]

Backed out for causing Bug 1814983.

Backout link: https://hg.mozilla.org/integration/autoland/rev/0d34245412816a5db90f8d6d25337673cd6fd33a

Comment 10

[Donal Meehan [:dmeehan]]

Removed the release note from 111, since this was backed out.

Comment 11

[John Schanck [:jschanck]]

We're waiting for a change to Google Accounts. We expect to be able to land this again in 2 weeks.

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/c2c5479b5bf0
Disable the U2F DOM API by default. r=dveditz,webidl,saschanaz

Comment 13

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/c2c5479b5bf0

Comment 14

[Pascal Chevrel (relman team) -> :pascalc]

Note added back to Nightly 112