Web Authentication is specified for the second-factor-only CTAP 1.1 protocol and a passwordless-supporting CTAP 2.0 protocol. This meta-bug tracks support for CTAP 2 and passwordless support.

Given that the live.com site only supports passwordless login via CTAP2, and this metabug is marked as a P1 for the last 7 months, could we get an update? It's unclear what the status is for authenticator-rs to support CTAP2, and that's the only dependency I'm seeing (which is curiously marked as a P3 for this P1 metabug).

I'm busy elsewhere at present; I keep hoping I'll have some free time to work on WebAuthn soonish, but there's nothing definitive planned. Realistically, I have to rework the UX before I can really integrate the CTAP2 branch of authenticator-rs properly (since I need to do things like solicit PINs) and what passes for a WebAuthn UX today is currently broken anyway (Bug 1573190, Bug 1540309, Bug 1579927). So I need to learn how to do UX design as a practical prereq, which makes it harder to just casually work on.

Thanks for the update, here's hoping we can get some assistance for you on the UX end.

Regarding your comment on https://bugzilla.mozilla.org/show_bug.cgi?id=1536482#c4, did you find the time?

Can I help to triage or groom anything?

I got Bug 1616675 handled, but not quite yet, still working on diffs for CRLite, among other things. I also have PRs to write for the WebAuthn spec that have to happen before the fun stuff...

Thanks for the response, and great to see you working in this. If I can help with the WebAuthn spec PRs, give a shout. (feedback, proofreading, writing out use cases, etc.)

Any update on this? We are using FIDO MDS to verify attestations and only get useless fido-u2f type attestation statement (no aaguids included) with Firefox on Linux. This works fine in Chrome. I believe it's related to this issue. The situation forces us to put disclaimer on our service: "Do not use Firefox for FIDO2 token registrations". It makes me sad since Firefox has always been my favourite browser. Hope this will move forward.

Agree, any update? This makes Firefox useless on MacOS and Linux. How come Windows works?
Also, isn't this related/same as https://bugzilla.mozilla.org/show_bug.cgi?id=1530373 ?

(In reply to 0x0ptr from comment #10)

Agree, any update? This makes Firefox useless on MacOS and Linux. How come Windows works?

Sorry for the delay in getting this finished. We don't currently have anyone available to work on this. We will prioritize this as soon as we can. Windows works because of the work in Bug 1508115.

Also, isn't this related/same as https://bugzilla.mozilla.org/show_bug.cgi?id=1530373 ?

This is a meta bug and bug 1530373 is one of the dependencies.

(In reply to paul from comment #12)

(In reply to Neha Kochar [:neha] from comment #11)

Sorry for the delay in getting this finished. We don't currently have anyone available to work on this. We will prioritize this as soon as we can. Windows works because of the work in Bug 1508115.

I appreciate the work that you guys for free and I understand that resources are tight. Is there some way we could provide some financial support to address this specific issue?

How can Firefox claim to be all about Privacy, Security and Speed when it doesn't support the greatest improvement we have ever had to all of those things when it comes to logins? I expected Firefox to be the very first to get this working, not the last.

Again, I do really appreciate what the developers do but I really think that this issue deserves to be a top priority and I'm sure there are plenty of people who would be willing to fund it.

Currently someone from SUSE has been working on authenticator-rs. They really want to see webauthn added to firefox and have been working for weeks on CTAP2 support now. You can check out https://github.com/mozilla/authenticator-rs/pull/150 https://github.com/mozilla/authenticator-rs/pull/154 and their own development branch on https://github.com/msirringhaus/authenticator-rs/tree/ctap2-cont

Of course, work would be much light if it wasn't a single person doing all the work!

Maybe this gives you some idea of the progress of things right now :)

it continue works in https://github.com/mozilla/authenticator-rs/pull/157

I'd also love to see this get added — I'd love to use passwordless auth, but I'm not going to implement it if it's not supported by the main browser I use. Looks like https://github.com/mozilla/authenticator-rs/pull/157 just got approved a few days ago, so hopefully things are moving?

Thanks for working on this!

https://github.com/mozilla/authenticator-rs/pull/157 is merged to https://github.com/mozilla/authenticator-rs/tree/ctap2-2021 branch now.
I hope it can be included in Firefox Nightly test, I'm glad to test it!

mysignins.microsoft.com - FIDO2 passwordless authentication is not supported on Firefox for Linux
https://github.com/webcompat/web-bugs/issues/101753

Putting Webcompat Priority to 1, just because this is microsoft, people have other ways to log in, but for some users that might be a hard stop.

This is also affecting Amazon.

I'd also love to see this get added — I'd love to use passwordless auth, but I'm not going to implement it if it's not supported by the main browser I use. Looks like https://github.com/mozilla/authenticator-rs/pull/157 just got approved a few days ago, so hopefully things are moving?

Can this be tested in a FF Nightly build?

Please don't need info people if you are just asking a question.

(In reply to drew.dani from comment #21)

I'd also love to see this get added — I'd love to use passwordless auth, but I'm not going to implement it if it's not supported by the main browser I use. Looks like https://github.com/mozilla/authenticator-rs/pull/157 just got approved a few days ago, so hopefully things are moving?

Can this be tested in a FF Nightly build?

Not yet. You can get yourself CC'd on this bug if you want to know when this lands in nightly.

I can't give you an estimate but this is my current work item. The priority of this meta bug wasn't reflecting that, my apologies.

Folks, while it's great to see there is a lot of interest in this, please don't post "+1" comments. We know that this is important (it is a P1, after all) and people are actively working on it. It will be done as soon as it's done, and posting more comments isn't accelerating that process.

Is there any plan to also support passkeys?

(In reply to neumaif02 from comment #34)

Is there any plan to also support passkeys?

See bug 1792433.

I'm interested in hearing people's thoughts on adopting FIDO2 platform APIs on Linux, akin to Windows Hello, or Android's Fido2ApiClient -- which Firefox already delegates to on those platforms.

I've written a FIDO2 (WebAuthn) and FIDO U2F platform library in Rust [1], for Linux. It's a WiP, but it already supports the main FIDO2 ceremonies, both FIDO2 PIN protocols, and downgrading WebAuthn for U2F devices (as per specs). I've tested this with as many security keys I could get my hands on so far [2]. It's designed to have pluggable transports, currently supporting HID and BLE (via Bluez), and plans for NFC and caBLE.

As mentioned before, whilst it could be used directly as a library, the main objective is to provide a backend for new D-Bus platform APIs. Secondary goals include supporting TPM platform authenticators, and supporting containerised applications (e.g. Flatpaks[3]), without requiring access to the USB stack, or BLE adapters.

I'm trying to gauge interest in Firefox delegating U2F and FIDO2 to the platform. If this sounds feasible, as the next step I will try and reach out to GNOME shell folks. I reached out earlier to some System76 engineers working on the Cosmic DE, as they may also be interested.

[1] https://github.com/AlfioEmanueleFresta/xdg-credentials-portal
[2] https://github.com/AlfioEmanueleFresta/xdg-credentials-portal/wiki/Verified-hardware
[3] https://github.com/flatpak/flatpak/issues/2764

HI Alfie - bugzilla isn't a discussion forum. You'll probably have more luck here: https://discourse.mozilla.org/

Is there an ETA to restore Firefox 114 working behavior?

All dependent bugs have been fixed.

I just tested nightly build which includes fix of 1846836 and it worked like a charm, restore FF114's behavior. Is there plan backport to 115ESR?