duosecurity.com - Correct UA required to log in with security keys

[freaktechnik]

URL: https://*.duosecurity.com/frame/prompt?<snip>

Browser/Version: Thunderbird

Operating System: Linux

What seems to be the trouble?(Required)

• Desktop site instead of mobile site
• Mobile site is not usable
• Video doesn't play
• Layout is messed up
• Text is not visible
• Something else (Add details below)

Steps to Reproduce

1. Make sure your user agent isn't Chrome, Firefox, Safari or Edge (like Mozilla/5.0 (X11; Linux x86_64; rv:101.0) Gecko/20100101 Thunderbird/101.0, I used the responsive device mode in the Firefox devtools to set it)
2. Navigate to: A duo 2FA login prompt with a security key device set up

Expected Behavior:
Can log in using security keys if the browser supports it (has the relevant JS APIs required)

Actual Behavior:
Does not allow usage of a security key, even if the browser would support it.

Screenshot

[softvision-oana-arbuzov]

Thanks for the report, unfortunately, I don't have an account that uses duo 2FA with a security key device set up.
I've checked with my account that uses duo 2FA paired with my mobile device and it works.

@ksy36, @denschub do you happen to have something like this?
Can we do anything about it from our Webcompat perspective, as far as I can see the message show "Requires Firefox", so it should be working on Firefox.

@freaktechnik does the login work on Firefox?

[qa_20/2022]

[denschub]

As per the initial issue text, this is about Thunderbird. I'm using a U2F key with Auth0 regularly in Firefox, and that works fine. But I have not added the Mozilla account to Thunderbird, so I didn't run into this issue.

Unfortunately, I'm not entirely sure what to do here. We (as in WebCompat) can't spoof the UA string inside Thunderbird. Thunderbird could add a "Firefox" segment into the UA for embedded Websites like a 2fa prompt, but we could also try to reach out to Duo to ask them to consider supporting Thunderbird. I'll poke around to see if we have contacts.

[webcompat-bot]

Generate outreach template

[softvision-oana-arbuzov]

@freaktechnik can you still reproduce the issue?

[inv_38/2022]

[freaktechnik]

Yes.

[freaktechnik]

This is resolved in the new Duo login flow.

[denschub]

Thanks for confirming!