I'm trying to understand what the different configuration elements mean in Mozilla Firefox. There was an announcement recently from Dropbox that they had enabled support for WebAuthn. I tried logging in-to DropBox using my U2F key that I'd registered through Chrome and it worked.

When I tried logging into Gitlab, however, it did not work. I had to explicitly enable security.webauth.u2f. So what's the difference in Firefox between these config elements?

security.webauth.u2f,security.webauth.webauthn_enable_usbtoken, and security.webauth.webauthn_enable_softtoken

My current assumption is that security.webauth.* is an implementation of Firefox's own authentication technology and security.webauth.webauthn.* is the implementation of W3C's Web Authentication Standard which also supports U2F. Is this assumption right?

Also, what's the difference between a usbtoken and a softtoken?


As far as I understand it (with help from agl's blog post):

  • security.webauth.u2f controls the original FIDO U2F API introduced by Chrome.
  • security.webauth.webauthn controls the now-standard W3C WebAuthentication API.

They both let you talk to existing U2F (CTAP1) devices, but using different JavaScript functions. Webpages written for Chrome's "extension" API won't automagically know how to use WebAuthn, and vice versa.

That's the whole idea behind Dropbox's blog post: they had U2F key support for a long time already, but at first it only supported Chrome's API. Now it knows both APIs and detects which is available.

And for the devices themselves:

  • security.webauth.webauthn_enable_usbtoken controls access to real U2F keys via USB HID.
  • security.webauth.webauthn_enable_softtoken makes the browser emulate a U2F device, for development purposes (and probably without any security guarantees).
| improve this answer | |
  • This answer clarified a lot of my doubts. Thanks @grawity! I'll have to google CTAP though. Just another clarification: > Now it knows both APIs and detects which is available. does this mean that when Google (and others) start supporting webauthn, the old U2F javascript-based auth capabilities will be redundant? – eternaltyro May 20 '18 at 2:33
  • 1
    CTAP is the low-level protocol used by browsers (native desktop apps) to talk with FIDO keys. Original U2F-only devices use CTAP1, new "FIDO2" keys add CTAP2 with more capabilities. And yes, WebAuthn will make the original U2F API redundant. – user1686 May 20 '18 at 10:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.