To smooth out this migration, after discussion on the mailing list, we have decided to enable our support for the FIDO U2F API by default for all Firefox users. For the entities affected, this could lead to poor user experiences and inhibit overall adoption of this critical technology. However, WebAuthn-produced credentials cannot be used with the FIDO U2F API. However, some large web properties are encountering difficulty migrating: WebAuthn works with security credentials produced by the FIDO U2F API. We encourage the adoption of Web Authentication rather than the FIDO U2F API. Both technologies can help secure the logins of millions of users already in possession of FIDO U2F USB tokens. Firefox has had experimental support for the Javascript FIDO U2F API since version 57, as it was used to validate our Web Authentication implementation that then shipped in Firefox 60. The FIDO U2F API is the spiritual ancestor of WebAuthn to-date, it’s still much more commonly used. That’s why we’ve championed it as a technology.

Web Authentication (WebAuthn), a recent web standard blending public-key cryptography into website logins, is our best technical response to credential phishing.

Fido u2f