User Story:
As a user, when logging in, if a WebAuthn-based option (security key or other type of passkey) is registered, it will be presented as the default 2fa authenticator to login with.
Description
Description
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Open | None | T399644 FY2025-26 WE4.6.2 Multiple Authenticators | |||
| Resolved | Mstyles | T399648 Default to WebAuthn when available during login 2FA check |
Event Timeline
Comment Actions
Do we want to remember what the user used the last time, or always prioritize WebAuthn?
Since the selection of the default happens in OATHAuth but passkeys are handled in WebAuthn, we'll need a hook for this. At which point, we could implement this either generally or for Wikimedia only, with the same effort - which should it be?
Comment Actions
Replaced "FIDO" with WebAuthn - I think the intent was the same but FIDO is less well-specified. Let me know if I misunderstood.
Comment Actions
I believe we should always prioritize WebAuthn. If a user has a phishing-resistant option registered, we should be encouraging them to use it -- and also making it more noticeable if they actually do end up at a phishing site (which will not be able to offer a working WebAuthn UI). This will be especially important for users with extended rights and WMF staff that may be targeted for phishing. We can make it pretty easy for the user to select to use an alternative method to log in. I'm open to user feedback, and/or seeing it show up in analytics that users are switching to alternative methods more than we might expect and which seems high-friction, but I think we should start from a posture of WebAuthn-first.