Re:Ask HN: Mozilla Persona Post-Mortem
by cpeterso on Wednesday January 17, 2018 @09:30PM
(#16174162)
Firefox 60 will ship the WebAuthn API. Here's a Mozilla blog post with examples of how to use WebAuthn and FIDO U2F devices:
https://hacks.mozilla.org/2018/01/using-hardware-token-based...
Re:Ask HN: Mozilla Persona Post-Mortem
by JoshTriplett on Wednesday January 17, 2018 @10:11PM
(#16174364)
Will it work with a key stored in the "software security device", rather than a hardware token?
For that matter, the description shown on that page suggests that it supports using the key on the hardware token as the only authentication factor. That seems dangerous. Unlike a key stored on an encrypted disk, a U2F key typically works for anyone who steals it. Firefox needs to use that key together with another key stored in the browser, or otherwise ensure that someone who steals the U2F key does not gain access to every account secured with WebAuthn.
Disclaimer: I have not reviewed this spec in detail yet, and my confidence in the W3C is not high.