Hacker News Reader

Hacker News

Comment by vlovich123 | Hacker News Reader

Full thread

vlovich123

since not stated in the article and I started to get worried, this was reported last year.

Safari: fixed in 18.3 (Jan 2025)

Firefox: fixed in 136 (March 2025)

Chrome: fixed in 130.0.6723.58/.59 (Oct 2024)

Wow - only Google seemed to really prioritize fixing this / had the processes and manpower to get a fix out quickly.

Mozilla’s bug report is still locked down but Google’s is open: https://issues.chromium.org/issues/370482421

View on HN

The involved engineers are most likely running around with a blushed-red face to this day, claiming "phishing resistance" in all the marketing materials but then having such a bug. I'd say the cover-your-ass (CYA) reflex was a big incentive for google engineers to fix it quickly.

Phishing resistance isn't a binary property, it's a spectrum, and even with this vulnerability, that of passkeys is orders of magnitude higher than that of most other alternatives (including passwords, SMS OTP, TOTP etc.)

This attack requires physical presence and visiting an attacker-controlled page. It’s absolutely a real threat and great work, but there are multiple orders of magnitude more people getting phished using weak MFA than by an attacker with control of a BLE device in their home or office.

Microsoft Edge had a release based on the relevant Chromium version on Oct 17, 2024. That is release 130.0.2849.46:

https://learn.microsoft.com/en-us/deployedge/microsoft-edge-...

https://msrc.microsoft.com/update-guide/en-US/vulnerability/...

> Wow - only Google seemed to really prioritize fixing this / had the processes and manpower to get a fix out quickly.

I would have guessed they'd be the quickest, but I wouldn't have guessed they'd be months ahead of the others.

Perhaps they had the info before it was disclosed to the others?

https://www.mozilla.org/en-US/security/advisories/mfsa2025-1... links the bug https://bugzilla.mozilla.org/show_bug.cgi?id=1922357

but it's not public, perhaps someone can tell us when it was opened.

The next issue, https://bugzilla.mozilla.org/show_bug.cgi?id=1922358 is from October 2nd 2024

Reading through the Chromium bug report, it looks like the reporter wasn't able to get in contact with Mozilla until February, so after they were aware it only took a month to fix the bug in Firefox. It's unclear when they started trying, and who's fault the delay is.

I can't speak to the prioritization differences between the different browser teams, Chrome was definitely the best which isn't surprising considering their resources. Apple was also quite swift but I imagine it took them some time to decide where to deliver the fix, I myself wasn't sure if this is something that should be blocked at the OS level (the Authentication checking the intent origin) or browser. Mozilla is usually the slowest out of the three but they were still very professional.

Reply on news.ycombinator.com