Firefox Extension Authenticator

[Pavan Outlaw]

OkayI give up. So, Facebook is or has implemented this Turn on two-factor authentication or whatever it is. What this means for me at the moment is that I am unable to access my Facebook account as it is now forcing me to use this Two-factor authentication thingie, despite that I do not have a mobile phone. (yes, I know it's unusual in this day of age not to have one. I did have one at one time, but for the moment I have no interest in getting another one). I would rather use my laptop anyway.

Now, from what I can see, Facebook is offering 3 ways of doing this. #1) Authentication app, like Google Authenticator or Duo Mobile. #2) Text message (SMS). #3) Security Key. So, because I do not use or have a mobile phone, I was guessing that my option would only be #1 Authentication app, like Google Authenticator ... which I have never used before, and while reading up on it, I keep reading that I can only use it with the Google Chrome browser?!? If that wasn't bad enough, I typically use Microsoft Outlook, not Gmail. So, I am at a loss at this point.

Firefox does not have a built-in feature to generate multi-factor authentication codes. There is a stand-alone application called Authy you can use (it runs outside of Firefox). It is one of the options mentioned in this support article for Firefox, and it works with many sites, including Facebook:

There are authenticator extensions for Firefox and password managers that can generate a 2FA TOTP code like can be used with the Firefox Account.I do not know whether they are compatible with FB, so you can check this yourself.

. . . if I could bother you with this quick question also. Though I think I already know the answer but I'll ask just the same, should I enable the two-step authentication to keep my Firefox account secure, and does that mean my browser as a whole would be more secure or just the Firefox account?

It would increase the security of your account, making it harder for someone else to connect to your account and Sync your data to their device. However, it wouldn't have any effect on the security of data on your device (which someone with physical access might see).

Also, upon adding my Microsoft Outlook account to it, I discovered something interesting (which I didn't realize was happening for some reason). In just the last five weeks there has been multiple attempts to sign into my account from Russia, Korea, Luxembourg, Spain, Latvia, China, Germany, Palestinian Authority, Indonesia and Vietnam. Thankfully my password isn't 1234. LOL!!

When invoking navigator.credentials.create() or navigator.credentials.get(), the publicKey object parameter required to initiate a WebAuthn flow can include an extensions property. The value of extensions is itself an object, the properties of which are the input values for any extensions the relying party wishes to request the use of in the method you call.

The extensions below do not represent an exhaustive list of all the extensions available. We have elected to document extensions that we know to be standardized and supported by at least one rendering engine.

Allows a relying party to request an assertion for a credential previously registered using the legacy FIDO U2F JavaScript API, avoiding the hassle of re-registering the credential. The appid is that API's equivalent to the rpId in WebAuthn (although bear in mind that appids are in the form of URLs, whereas rpIds are in the form of domains).

Allows a relying party to exclude authenticators containing specified credentials previously registered using the legacy FIDO U2F JavaScript API during registration. This is required because by default the contents of the excludeCredentials field are assumed to be WebAuthn credentials. When using this extension, you can include legacy FIDO U2F credentials inside excludeCredentials, and they will be recognized as such.

The publicKey's extensions property must contain an appidExclude property, the value of which is the identifier of the relying party requesting to exclude authenticators by legacy FIDO U2F credentials. For example:

Allows a relying party to request additional information/properties about the credential that was created. This is currently only useful when calling create() with publicKey.authenticatorSelection.residentKey = "preferred"; it requests information on whether the created credential is discoverable.

If rk is set to false in the output, the credential is a server-side credential. If rk is not present in the output, then it is not known whether the credential is client-side discoverable or server-side.

The publicKey's extensions property must contain a credentialProtectionPolicy property specifying the protection level of the credential to be created, and a boolean enforceCredentialProtectionPolicy property specifying whether the create() call should fail rather than creating a credential that does not conform to the specified policy:

Suppose the enforceCredentialProtectionPolicy value is true. In that case, the create() call will fail if the policy cannot be adhered to (for example, it requires user verification, but the authenticator does not support user verification). If it is false, the system will make the best attempt to create a credential that conforms to the policy, but it will still create one that conforms as closely as it can if this is not possible.

Note: For a write authentication operation to be successful, publicKey.allowCredentials must contain only a single element representing the credential you want the blob stored alongside.

A get() write call indicates whether the write operation was successful with a written boolean value in the extension output. A true value means it was written successfully to the associated authenticator, and false means it was unsuccessful.

If the relying party is authorized to receive the minPinLength value (if its rpId is present on the authenticator's authorized relying party list), the authenticator data will contain a representation of it in the following form:

Allows a relying party to request additional information/properties about the credential that was created. This is currently only useful when calling create() with publicKey.authenticatorSelection.residentKey = \"preferred\"; it requests information on whether the created credential is discoverable.

You can install an Extension in Edge, Chrome, or Firefox and use it as an authenticator. Click the image below to view the steps for setting up the Authenticator extension in Chrome, Firefox, or Edge.

3a8082e126