News for hackers. Stuff that matters.
Re:GitHub Supports Web Authentication (WebAuthn) for Securit... by sebazzz on Wednesday August 21, 2019 @04:48PM (#20761640)
> GitHub supported physical security keys using the experimental U2F API for Chrome

Yes, and to make it worse, they used user agent sniffing instead of feature detection even though it work fine in Firefox. Firefox enabled U2F because many sites which do implement U2F, do not implement WebAuthn yet. Luckily, it appears Github is now on the right track.

Re:GitHub Supports Web Authentication (WebAuthn) for Securit... by outworlder on Wednesday August 21, 2019 @05:12PM (#20761888)
> they used user agent sniffing instead of feature detection even though it work fine in Firefox

This is one of my pet peeves – and which is why the User Agent strings are so asinine (Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A5370a Safari/604.1).

Whitelisting features based on Browser type, version, device type, OS type or version, or any version for that matter is almost always wrong. Like 99% of the time – if you think your case is special, you are most likely wrong too.

Basically it boils down to: "why do I care that this software is running this specific version?" If you are not writing a deployment script and some such and the answer is "because it implements feature X, or displays Y behavior", well, check that.

I've also seen iPhone apps trying to figure out which device it was, to display assets. If you care about screen resolution, that's what you need to check. Your device table will become obsolete.

Features may be backported(like in this case), bugs may be fixed, new weird hardware combinations may be released. Your application is not guaranteed to be in sync when that happens.

Re:GitHub Supports Web Authentication (WebAuthn) for Securit... by kevin_b_er on Wednesday August 21, 2019 @07:29PM (#20763051)
They're all from an era where javascript couldn't do everything. Those various crud of "like Gecko" were to get servers to deploy HTML that fit the pattern of another browser. There were websites that gave you error pages if you weren't Internet Explorer.

Nowadays it is far less necessary, but there are still browser-specific stuff involved.

Re:GitHub Supports Web Authentication (WebAuthn) for Securit... by solarkraft on Wednesday August 21, 2019 @06:23PM (#20762549)
Why is something like feature checking not used for software dependencies like libraries as well?
Re:GitHub Supports Web Authentication (WebAuthn) for Securit... by zaphirplane on Wednesday August 21, 2019 @07:34PM (#20763082)
Re:GitHub Supports Web Authentication (WebAuthn) for Securit... by icelancer on Wednesday August 21, 2019 @09:18PM (#20763741)
>> Yes, and to make it worse, they used user agent sniffing instead of feature detection even though it work fine in Firefox.

My bank and my retirement accounts do this too. It's infuriating. I switched to Firefox recently due to failures in Chrome Sync and now I get this as a reward. Wonderful.

Re:GitHub Supports Web Authentication (WebAuthn) for Securit... by sebazzz on Thursday August 22, 2019 @01:04AM (#20764801)
Luckily Firefox features per-domain overriding of the use agent: general.useragent.override.[domain]
Re:GitHub Supports Web Authentication (WebAuthn) for Securit... by rehemiau on Thursday August 22, 2019 @01:43AM (#20765006)
Currently using this on Firefox for Android through an extension, works great: https://addons.mozilla.org/en-US/firefox/addon/uaswitcher/
Re:GitHub Supports Web Authentication (WebAuthn) for Securit... by icelancer on Thursday August 22, 2019 @02:08AM (#20765120)
Just tried this with my Yubikey Nano and Vanguard Investments, after changing my u2f to "true" in about:config. Does not work at all. Vanguard shows the Yubikey login prompt but it doesn't activate the Yubikey, and pushing the key just spits out a OTP and dumps it to the browser search bar. Oh well.
Re:GitHub Supports Web Authentication (WebAuthn) for Securit... by richipargo on Thursday August 22, 2019 @02:58AM (#20765370)
I used to have this issue but in my case it just meant I was missing some OS dependencies so it might vary on a case by case