bluetoothusbfido-u2fwebauthnfido

Why Fido blocked in web bluetooth but not USB


FIDO is blocked in web-bluetooth due to system-wide pairing poses security risks [source], which I can understand but not entirely sure why the extend to block it. A good ble token design can possible overcome the issue (button on token...etc).

But when it comes to usb token why is it not consider as a same level of risk too [source] and block the access, isn't usb system-wide pairing too?


Solution

  • Both Specifications block FIDO devices:

    Related Chromium implementation details: