Android-components: Support the W3C Web Authentication specification (WebAuthn)

[cpeterso]

Support the W3C Web Authentication specification in Android. Web Authentication is our best tool against phishing on the web, and now is a W3C Recommendation. Firefox supports Web Authentication on Desktop since Firefox 60.

@snorp says A-C will need some code to support Gecko WebAuthn. I don't know exactly what A-C needs to do, but @jcjones says we’ll need to move the GV's mobile/android/geckoview/src/main/java/org/mozilla/gecko/WebAuthn* files into A-C and figure out the Google Play Services dependency it provides via the FIDO2 API.

PI is prepared to do Fennec Beta 68 testing, so they will already have a test plan they can reuse for testing Fenix.

Fenix's WebAuthn issue: mozilla-mobile/fenix#1340
GV bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1549418

[pocmo]

From #3515:

We'll need to define a GeckoView API to pass the request to AC and the result back to Gecko(View) [somewhere above the JNI calls].

• https://searchfox.org/mozilla-central/source/mobile/android/base/java/org/mozilla/gecko/util/WebAuthnUtils.java
• https://searchfox.org/mozilla-central/source/mobile/android/geckoview/src/main/java/org/mozilla/gecko/WebAuthnTokenManager.java

[pocmo]

https://bugzilla.mozilla.org/show_bug.cgi?id=1549418

[pocmo]

Demo: https://webauthn.io/

[jcjones]

What's blocking this? I think everything is ready just awaiting resources?

[pocmo]

The work this specific issue is tracking is "blocked" on the GeckoView API part:
https://bugzilla.mozilla.org/show_bug.cgi?id=1549418

I think we need someone to own and work on that part first. Ideally that is someone from the GeckoView team. The API surface is quite small, so in theory someone from the AC team could propose a GV API with a patch too.

At the moment almost all our resources are bound to get WebExtensions and the Fenix migration in place.

[maresmar]

It seems to me that blocking bug is fixed. I've even found part of Android implementation.