1848285 - github.com - Setting the perf security.webauth.webauthn_enable_softtoken to true breaks 2FA

Status: RESOLVED WONTFIX

(Core :: DOM: Web Authentication, defect)

Description

[Raul Bucata]

From github: https://github.com/webcompat/web-bugs/issues/125665.

<!-- @browser: Firefox 118.0 -->
<!-- @ua_header: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 -->
<!-- @reported_with: desktop-reporter -->
<!-- @public_url: https://github.com/webcompat/web-bugs/issues/125665 -->

URL: https://github.com/sessions/two-factor/webauthn

Browser / Version: Firefox 118.0
Operating System: Windows 10
Tested Another Browser: Yes Edge

Problem type: Site is not usable
Description: Unable to login
Steps to Reproduce:
Firefox Nightly 118.0a1 (2023-08-10) (64-bit) broke security.webauth.webauthn_enable_softtoken compatibility. If this preference is set (probably from earlier tests), it renders all U2F and WebAuthn USB keys unusable, as all challenge-responses are redirected to a dummy device.
<details>
<summary>View the screenshot</summary>
<img alt="Screenshot" src="https://webcompat.com/uploads/2023/8/289c82ba-d8b4-4eeb-af76-7c7d2517fd32.jpeg">
</details>

<details>
<summary>Browser Configuration</summary>
<ul>
<li>gfx.webrender.all: false</li><li>gfx.webrender.blob-images: true</li><li>buildID: 20230810094725</li><li>channel: nightly</li><li>hasTouchScreen: true</li><li>mixed active content blocked: false</li><li>mixed passive content blocked: false</li><li>tracking content blocked: false</li>
</ul>
</details>

View console log messages

From webcompat.com with ❤️

Change performed by the Move to Bugzilla add-on.

Comment 1

[Raul Bucata]

The issue was reported via the webcompat.com reporter. Since the issue reproduces when changing the said pref to TRUE, and by default, the pref is set to FALSE, we have moved the issue. Please feel free to move the issue to the relevant Product and Component.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::DOM: Web Authentication' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 3

[John Schanck [:jschanck]]

The virtual authenticator that is enabled by setting security.webauth.webauthn_enable_softtoken to true is not meant to be used outside of automated tests.