1969205 - WebAuthn credentials requires PIN to authenticate even when user verification is "discouraged"

Status: ASSIGNED

(GeckoView :: General, defect, P1)

Description

[s1m]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:138.0) Gecko/20100101 Firefox/138.0

Steps to reproduce:

Setup: You need to register a non-discoverable credential. It must be done with the Play services installed, or on desktop because of D247877:

1. Visit https://webauthn.io/
2. Enter a username
3. Register a new credential with the following advanced settings:
   • User Verification = Discouraged
   • Discoverable Credential = Discouraged
4. Enter the FIDO2 key pin and complete the registration ceremony

Test: This can be done with the Play services installed, of with a credential manager that supports the hardware key.

1. Visit https://webauthn.io/
2. Enter the same username
3. Authentication with the following advanced settings:
   • User Verification = Discouraged

Actual results:

The authentication requires the PIN, even though the credential is not discoverable and the relying party specified User Verification was Discouraged

Expected results:

The authentication should not request the PIN

Additional info:

• There was the same issue for desktop: https://bugzilla.mozilla.org/show_bug.cgi?id=1822429
• This kind of authentication is usually used with the key as a 2nd factor

Comment 1

[s1m]

Attachment: Bug 1969205 - Fido2: Use requested user verification r=#android-reviewers

Comment 2

[s1m]

EDIT: Because of Bug 1964526 *