starred/anonaddy

Fork 0

mirror of https://github.com/anonaddy/anonaddy.git synced 2026-04-25 22:25:55 +03:00

[GH-ISSUE #298] Migrate/support new WebAuthn protocol instead of U2F #817

New issue

Closed

opened 2026-03-14 10:43:44 +03:00 by kerem · 2 comments

kerem commented

2026-03-14 10:43:44 +03:00

Owner

Originally created by @rugk on GitHub (Jun 9, 2022).
Original GitHub issue: https://github.com/anonaddy/anonaddy/issues/298

AFAIK U2F is kind of deprecated nowadays and WebAuthn should be used instead. It has some more features like passwordless authentication and some other integrations for other attestation stuff not only from hardware keys, but AFAIk it's a different API and thus you may need to adjust something.

These resources here may provide more information:

https://webauthn.guide/ (more user oriented)
https://webauthn.io/ (more technical)
https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API
There are not many sites explaining the differences I could find and here is one of them, but it may not be the best, actually.

See/Compare it with Nextcloud, who deprecated their whole implementation of U2F in https://github.com/nextcloud/twofactor_u2f and switched to https://github.com/nextcloud/twofactor_webauthn. Interestingly how they implemented it is that you can optionally also use your hardware key for passwordless authentication, but you explicitly need to register it for that.
For such a thing, IMHO; I would also be fine with Anonaddy.

What may be done

Change the code so it uses WebAuthn (and U2F only as a fallback, for hardware keys, which don't support it yet? Or maybe that is somehow automatically done?)
Change all references in the UI to include less-technical terms (hardware key) or only as an addition include WebAuthn/U2F. Prefer "WebAuthn" if possible, as that is the latest stuff and also sounds better… 🙃

Originally created by @rugk on GitHub (Jun 9, 2022). Original GitHub issue: https://github.com/anonaddy/anonaddy/issues/298 AFAIK U2F is kind of deprecated nowadays and _WebAuthn_ should be used instead. It has some more features like passwordless authentication and [some other integrations for other attestation stuff not only from hardware keys](https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API/Attestation_and_Assertion), but AFAIk it's a different API and thus you may need to adjust something. These resources here may provide more information: * https://webauthn.guide/ (more user oriented) * https://webauthn.io/ (more technical) * https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API * There are not many sites explaining the differences I could find [and here is one of them](https://blog.strongkey.com/blog/guide-to-fido-protocols-u2f-uaf-webauthn-fido2), but it may not be the best, actually. See/Compare it with Nextcloud, who deprecated their whole implementation of U2F in https://github.com/nextcloud/twofactor_u2f and switched to https://github.com/nextcloud/twofactor_webauthn. Interestingly how they implemented it is that you can optionally also use your hardware key for passwordless authentication, but you explicitly need to register it for that. For such a thing, IMHO; I would also be fine with Anonaddy. ## What may be done * Change the code so it uses WebAuthn (and U2F only as a fallback, for hardware keys, which don't support it yet? Or maybe that is somehow automatically done?) * Change all references in the UI to include less-technical terms (hardware key) or only as an addition include WebAuthn/U2F. Prefer "WebAuthn" if possible, as that is the latest stuff and also sounds better… :upside_down_face:

kerem closed this issue

2026-03-14 10:43:49 +03:00

kerem commented

2026-03-14 10:45:03 +03:00

Author

Owner

@willbrowningme commented on GitHub (Jun 16, 2022):

Currently in the process of upgrading to v3 of https://github.com/asbiin/laravel-webauthn so I will close this once that is complete.

I'll update the references to U2F too, thanks.

@willbrowningme commented on GitHub (Jun 16, 2022): Currently in the process of upgrading to v3 of https://github.com/asbiin/laravel-webauthn so I will close this once that is complete. I'll update the references to U2F too, thanks.

kerem commented

2026-03-14 10:45:08 +03:00

Author

Owner

@willbrowningme commented on GitHub (Jul 14, 2022):

Latest release now pushed to the server with Laravel WebAuthn v3 so this can be closed.

@willbrowningme commented on GitHub (Jul 14, 2022): Latest release now pushed to the server with Laravel WebAuthn v3 so this can be closed.

No labels

bug

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/anonaddy#817

No description provided.

Rows
Columns