1820725 - Create an about-page to manage security tokens

Status: NEW

(Core :: DOM: Web Authentication, enhancement)

Description

[msirringhaus]

Having a dedicated about-page for managing security tokens has multiple advantages:

• Most management-software is vendor-specific (e.g.: yubikey-manager will only manage yubikeys, and no other token, even though the protocoll is vendor-independent).
• Gives, IMHO, a better UX for situations like this: The server mandates that the token should have a PIN set, but none is set yet. Chromium is solving this by prompting the user to set a PIN during the registration-process. Instead of doing per-token actions during a per-login dialog, we could point the user to the about-page instead. Hence, making it clear that this will affect the whole token, and not just this one webpage-account.
• Gives us the ability to debug problems with specific tokens easier, by showing the token config in easily accessible plain text for users to copy.
• For future CTAP2.1-work: Gives us a place to expose even more management-functions like looking up and deleting credentials (resident keys), managing biometric data, etc.

Comment 1

[msirringhaus]

Attachment: WIP: Bug 1820725 - Implement about:webauthn

Comment 2

[msirringhaus]

Attachment: WIP: Bug 1820725 - Implement about:webauthn

Comment 4

[Auth0]

Hello, are there any updates on the following?

https://bugzilla.mozilla.org/show_bug.cgi?id=1820725
https://phabricator.services.mozilla.com/D173038

I like the current webauthn functionality which is available. Here's some feedback:

• Device Info - a little too much for non technical users
• PIN management - current PIN should be the first form option IMO
• Manage credentials - works great.

I'm curious why there is no FIDO2/reset your security key in about:webauthn as Chrome as it as the last option. That is a highly requested feature and it would be great if it was available soon.

Comment 5

[msirringhaus]

Thanks for the feedback!

Hello, are there any updates on the following?

https://bugzilla.mozilla.org/show_bug.cgi?id=1820725
https://phabricator.services.mozilla.com/D173038

I actually should abandon that submission. It was split up into multiple submissions, with the exception of one, all of have landed.

I like the current webauthn functionality which is available. Here's some feedback:

• Device Info - a little too much for non technical users

I'm aware. The reason we show everything anyways is that it is a good debugging-tool, if something goes wrong. We can ask users for the output of "Device Info" and have a better overview.

• PIN management - current PIN should be the first form option IMO

We probably have to involve the UI-team again for this one.

• Manage credentials - works great.

I'm curious why there is no FIDO2/reset your security key in about:webauthn as Chrome as it as the last option. That is a highly requested feature and it would be great if it was available soon.

This is planned, but currently blocked by https://github.com/mozilla/authenticator-rs/issues/312