Svoboda | Graniru | BBC Russia | Golosameriki | Facebook
BBC RussianHomePhabricator
Log In
Maniphest T343575

Discourage users from choosing FIDO on WMF websites
Closed, ResolvedPublic

Description

Can we please override via WikimediaMessage the webauthn-module-description message to heavily discourage users from choosing WebAuthn/FIDO ?

It just doesn't work right now for WMF properties and people get stuck. This option really should just NOT be available at all until it is multi domain compatible, but I'm guessing it is too late for that now.

Problem:
1: You have to read AND remember that you can only log in via the wiki where you registered
2: You have to use a non-modern or non-standard configured browser that allows cross domain cookies if you want to login on 11 out of the 12 top level domains that wikimedia has because of T226797 and T202028

I've now had to guide 2 users (latest) out of this blackhole and as webauthn/fido increases in popularity this is likely just going to increase.

Event Timeline

Change 953705 had a related patch set uploaded (by TheDJ; author: TheDJ):

[mediawiki/extensions/WikimediaMessages@master] Add more warnings to WebAuthn 2FA

https://gerrit.wikimedia.org/r/953705

I kind of wonder if it should be outright disabled. WebAuthn is cool and all, but in its current state it sounds not usable.

Change 953705 merged by jenkins-bot:

[mediawiki/extensions/WikimediaMessages@master] Add more warnings to WebAuthn 2FA

https://gerrit.wikimedia.org/r/953705

MarcoAurelio claimed this task.
MarcoAurelio subscribed.

Boldly closing as resolved since the above patch got merged.