Open Bug 1529973 Opened 6 years ago Updated 1 year ago

Make the WebAuthn Soft Token a Real Thing (sync, FIDO2, platform DAR, UI)

Categories

(Core :: DOM: Web Authentication, enhancement, P5)

66 Branch
enhancement

Tracking

()

People

(Reporter: jcj, Unassigned)

References

Details

Firefox has a U2F soft token implemented, mostly for testing, that also happens to work just fine for WebAuthn flows. The functional problem with turning it on is, without an UI, it always acts immediately, preempting any other WebAuthn/U2F authenticators available or attached. This bug would be a meta-bug to make the soft token a Real Thing by fixing the functional issue, and also improving the security and properties of it:

  1. The user should have to confirm use of the soft token
  2. The user should be able to, without changing a pref, use a different security key
  3. The soft token might sync its key material and its counter state via Sync
  4. The soft token might store its key material using the platform data-at-rest support (https://searchfox.org/mozilla-central/source/security/manager/ssl/OSKeyStore.h)
  5. The soft token might support FIDO2 attestation modes for WebAuthn, even if it cannot be accredited

@jcj: You removed the blocking of bug #1315460 by closing bug #1481890 !

Blocks: 1536482
Priority: P4 → P5
Depends on: 1587563
Severity: normal → S3
No longer blocks: 1536482
You need to log in before you can comment on or make changes to this bug.