1844449 - Support WebAuthn credProtect extension

Status: RESOLVED FIXED

(Core :: DOM: Web Authentication, enhancement, P2)

Description

[John Schanck [:jschanck]]

See: https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#sctn-credProtect-extension

Comment 1

[Auth0]

The credProtect extension is URGENTLY needed to help address the security issues outlined in Yubico's Security Advisory YSA-2024-03. That advisory details a vulnerability in Infineon's cryptographic library used in all Yubico devices prior to firmware 5.7.0 along with other security keys with leverage Infineon's cryptographic library.

The credProtect extension would allow web applications to set a protection policy for credentials stored on Yubico devices, such as requiring user verification before allowing the credential to be used. This would help mitigate the potential risks from the vulnerability described in YSA-2024-03.

Please prioritize implementation of the credProtect extension to give web applications this important security control. It is a critical feature needed to fully protect users in light of the Infineon security advisory.

Comment 2

[John Schanck [:jschanck]]

Attachment: Bug 1844449 - support the WebAuthn credProtect extension. r=keeler

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/bd14f4819fcf
support the WebAuthn credProtect extension. r=keeler,webidl,saschanaz

Comment 4

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/bd14f4819fcf

Comment 5

[Hamish Willee]

FF139 MDN docs work for this done as part of https://github.com/mdn/content/issues/39302