1825280 - FIDO2 does not work for microsoft accounts on Android (both 2fa and passwordless)

Status: UNCONFIRMED

(Fenix :: WebAuthn, enhancement, P3)

Description

[Celeste]

+++ This bug was initially created as a clone of Bug #1726824 +++

User Agent: Mozilla/5.0 (Android 12; Mobile; rv:109.0) Gecko/113.0 Firefox/113.0

Steps to reproduce:

This may be an issue with the website itself, see https://bugzilla.mozilla.org/show_bug.cgi?id=1820016#c1 .

1. Set up FIDO in a microsoft account on https://accounts.microsoft.com (Advanced security, Add a new way to sign in or verify).
2. You cannot register FIDO hardware key here as the option is missing.
3. If you register a hardware key in other platform, when you try to login on Firefox Android (login.live.com), the hardware key 2fa option is missing.
4. If you have also enabled passwordless, the hardware key passwordless login option is missing.

Actual results:

Both login and 2fa option is missing in Firefox Android.

The YubiKey demo site and webauthn.io works fine.
Firefox Nightly on Linux works fine.

Expected results:

FIDO should be available as a login and 2fa option.

Addition Information:

Passwordless maybe because FxA didn't implement the feature, but at least 2FA should work just like any other site.

Comment 1

[Tim Cappalli]

Android does not currently support CTAP2.

Microsoft only supports discoverable credentials which require CTAP2.