Web Authentication tokens have an x509 certificate which could be unique enough to be considered a cross-account tracking fingerprint. Luckily, the tokens won't emit one unless the user interacts with the token (pushing a button, tapping, etc) during second-factor registration. The WebAuthn standard says that browsers can anonymize that x509 certificate by default, which we will do in Bug 1428916. However, websites can specify that they need a "direct" attestation certificate, in which case we're asked to pass along the not-anonymized certificate directly from the token. When we see one of these "direct" attestation requests, this bug is to prompt the user as to how to proceed. A draft question might be: --- "The website at <origin> is asking for your second factor's digital certificate, which could be used to associate this account with other accounts you might have here. Firefox can anonymize this for you, but the website might decline this second factor. If declined, you can try again." 1) Cancel 2) Proceed but anonymize anyway 3) Proceed --- Obviously I'm not the best tech writer for a broad audience, but that's the gist. This sort of a prompt should not happen often (only when registering a credential of "direct" type), so I don't know if it's worth it to have "Never show this again" semantics. I leave that up to those more wise in the ways of UX. Note: Until this bug lands, we'll implicitly always choose #2, as it's the safe option.

Per :jkt, Bug 1381628 has a JS/C++ combination permission prompt. It uses the permission prompt to gate the whole function from Navigator, whereas we won't know we need to provide the prompt until we've started decoding the MakeCredentialOptions -- but it looks like one could probably use MozPromise and pause waiting on its resolution.

Here's a screenshot of the WIP patch. Quite a lot of text... The patch doesn't yet honor the checkbox, but it does proceed or cancel.

I created a mock for the web authentication prompt https://mozilla.invisionapp.com/share/NKG898LJHVS#/screens/283734920_Artboard. After trying literal metaphors like yubikeys pictograms we opted for a more abstract identity-related metaphor that can potentially support other formats beside yubikeys. For styles and spec please refer to the permissions panels.

Comment on attachment 8953397 [details] Bug 1430150 - Implement WebAuthentication permission prompts Johann Hofmann [:johannh] has approved the revision. J.C. Jones [:jcj] has approved the revision. https://phabricator.services.mozilla.com/D638

(In reply to Amin Al Hazwani [:amin] (Firefox UX) from comment #9) > I created a mock for the web authentication prompt > https://mozilla.invisionapp.com/share/NKG898LJHVS#/screens/ > 283734920_Artboard. After trying literal metaphors like yubikeys pictograms > we opted for a more abstract identity-related metaphor that can potentially > support other formats beside yubikeys. This is great, thank you Amin! I'll take this to a follow-up. We probably have to uplift it, but that shouldn't be too hard hopefully.

Pushed by ttaubert@mozilla.com: https://hg.mozilla.org/integration/mozilla-inbound/rev/8d91193cd766 Implement WebAuthentication permission prompts r=jcj,johannh

Pushed by ttaubert@mozilla.com: https://hg.mozilla.org/integration/mozilla-inbound/rev/497aead7d738 Disable browser_webauthn_telemetry.js on TV runs for now r=bustage

Sorry for abusing a closed bug for questions, but I assume other people will land here from the strings. This patch introduces a lot of concepts (terminology) that I've never met in Firefox (security tokens, authenticator). It seems also quite technical, on the edge of jargony. Who's the target audience for this feature? I see an Invision board, so I assume the copy was reviewed? For example: - "%S wants to register an account with one of your security tokens". Do I have security tokens in Firefox? What are they? Where do I manage them? I went through the tracking bug, and couldn't spot open dependencies with UI (or I missed them) - "You can authorize now or cancel", then the buttons are "Cancel" and "Proceed". Why not "Authorize"? P.S. Localization comments are used to help localizers get context on strings. The whole comment on webauthn.registerDirectPrompt seems to have a different target though (users of the feature). It doesn't hurt, but it's also surprising.

Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0 Hi, I have just tested this fix on Firefox Beta 60.0b5 and the icon is in place and the notification looks good. Marking this issue as verified fixed.