Firefox 109.0.1 (64-bit) does not respect PIN set on Yubikey 5 NFC. Safari and Chrome do.
Categories
(Core :: DOM: Credential Management, defect)
Tracking
()
People
(Reporter: bill.barrick, Unassigned)
Details
Steps to reproduce:
I browsed to a brokerage web site where i have two-factor auth set with Yubikey 5 NFC. I entered username/pw and tapped the Yubikey as prompted by the site.
Actual results:
When tapping the Yubikey FF does not challenge for the set PIN. Safari and Chrome do. This is a security vulnerability.
Expected results:
FF should have challenged me for the PIN i set on the device.
|
Reporter | |
Comment 1•2 years ago
|
||
This is most likely a FIDO implementation issue.
|
||
Updated•2 years ago
|
|
||
Comment 2•2 years ago
|
||
Firefox does not support FIDO2 tokens yet, only the FIDO U2F protocol which predates PINs. If your token supports both protocols then you can use the key under the old protocol. If you use the Yubikey Authenticator software you can disable the U2F protocol, but then FIrefox will not be able to use your key.
You PIN will be enforced on Firefox Nightly currently, but it's not ready to ship.
Description
•