Edit: Usually HN is so angry about Google not following web standards but everyone in this thread seems to be in favor of Google trampling the WebAuthn standard. Weird.
What sites currently let me authenticate with WebAuthn? (Github still uses U2F, it seems.)
Microsoft sites like Outlook and OneDrive.
Android is open source, and Linux-based. The licenses allow phone manufacturers to fork Android and integrate it with devices that only have closed-source binary blob drivers, without involving Google. The end result is a bunch of phones whose kernels (and thus OSes) are impossible to update. (I am told that Microsoft found this sufficiently frustrating and that it decided it would write its own drivers for the vast majority of hardware.)
Linux has a Very Good Reason to discourage binary driver compatibility -- it would rather see those drivers be open-sourced under GPL and moved in-tree. But the end result has seriously hurt the security of more than two-thirds of Android users -- users who otherwise should be inclined to choose open-source because they are paranoid about security.
I think the right answer is to require folks to have Android Q+ to continue to use security keys with an Android account, but I imagine that's not a viable choice because the optics would be that Google is doing a "money grab" in exchange for security.
That's just ridiculous.
Linux has had perfectly fine U2F 1 support for ages. All you need on a normal desktop box is u2f-hidraw-policy [0] and, optionally, the u2f CLI tools.
"Be conservative in what you do, be liberal in what you accept from others" is good practice in software, espacially in open source. You can't be picky when you are the underdog anyway.
Maybe it's because according to the article "Google trampling WebAuthn standard" miss characterises what is actually going on:
> We’ve recently learned that Google Accounts has slipped their schedule for using Web Authentication to register new credentials.
Do you think they planned legacy Android devices not being able to support the new standard?
* FastMail has implemented WebAuth, the newer standard, which Firefox supports
* Google hasn't implemented WebAuth because they have to(?) wait for the end-of-life of old Android devices.
* Firefox is going to put an override so that you can use the old standard on Google accounts, which Google does support.
It sounds like Google's slowness to enable WebAuth is a somewhat legitimate issue of backwards compatibility for old devices, though I haven't personally evaluated it.
They've changed the message in Firefox to make it a little clearer this is how to do it.
Directly, https://support.yubico.com/support/solutions/articles/150000...
I'm also curious if anyone in this topic has advice for how to make U2F a habit. I posted https://news.ycombinator.com/item?id=19316509, but didn't get anything. :(
I should get it into upstream systemd.
