1977284 - Versions starting with 140.0.0 break YubiKey 2FA authentication on sites with a certificate exception

Status: RESOLVED FIXED

(Core :: DOM: Web Authentication, defect, P3)

Description

[mhanck]

Attachment: Security 003.jpg

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0

Steps to reproduce:

Example:

1. Access my internal NAS Administration URL
2. Enter my User ID (on the website Login page)
3. Enter my password (on the website Login page)
4. Enter my security key (YubiKey) PIN (on the Windows Security "Making sure it's you" dialogue)

Actual results:

Error "Something went wrong" is displayed (on the Windows Security "Making sure it's you" dialogue). This occurs in all releases starting with 140.0.0. Reverting to 139.0.4 (and reloading the Profile) restores expected function.

Expected results:

Prompt to "Touch your security key." (on the Windows Security "Making sure it's you" dialogue) - Security 003.jpg attachment shows expected dialogues - screenshot from Firefox 139.0.4.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::DOM: Web Authentication' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:jschanck, could you have a look please?

For more information, please visit BugBot documentation.

Comment 3

[John Schanck [:jschanck]]

I'm guessing that your NAS' login page serves a self-signed certificate, and that you add an override using the "Accept the risk and continue" UI?

In Bug 1954033 we blocked the use of WebAuthn when a certificate error override is in place. As a temporary workaround, you may be able to add the NAS' certificate as an authority (https://support.mozilla.org/en-US/kb/setting-certificate-authorities-firefox).

Comment 4

[mhanck]

RE: "I'm guessing that your NAS' login page serves a self-signed certificate, and that you add an override using the "Accept the risk and continue" UI?"

Yep, it was and I had done so. Rather than executing a temporary work-around I chose to install a trusted certificate.
Thanks for the help.

Comment 5

[Daniel Veditz [:dveditz]]

John: this turned out to be intentionally broken as you guessed. Unless there's already a bug on file to improve the experience should we morph this bug into that? For example

• If we're not going to allow it, it would be nice to abort earlier, before we talk to the authenticator and bring up the associated UI (ours or the OS's).
• If we did that it might just fail silently. Would it be appropriate to show a more visible error? I'm not sure what, though, since anything could be abused to annoy people. Hopefully we at least have an error message on the web console

Comment 6

[mhanck]

Please (please, please) DO NOT fail silently and DO display (or log) an error. Since this is a security thing, the User should know that this is intentional. Just my two cents.

Comment 9

[John Schanck [:jschanck]]

Attachment: Bug 1977284 - allow webauthn with certificate overrides on localhost. r=keeler

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/3fc322f731ab
https://hg.mozilla.org/integration/autoland/rev/66eacaccfc44
allow webauthn with certificate overrides on localhost. r=keeler

Comment 11

[Cristian Tuns]

https://hg.mozilla.org/mozilla-central/rev/66eacaccfc44

Comment 12

[Ryan VanderMeulen [:RyanVM]]

Do we need this on ESR140? Please nominate if yes.

Comment 13

[John Schanck [:jschanck]]

The patch doesn't graft cleanly onto esr140, and there is a workaround (Comment 3). So I'm not going to nominate this for 140 unless we hear about a significant need for it.