Hide serial number feature

[jans23]

To be confirmed if this behaviour is expected by FIDO2 devices.

[szszszsz]

I believe it should be hidden by default.

[szszszsz]

Looking at the FIDO U2F spec, I see only that device should not be possible to fingerprint:

• https://fidoalliance.org/specs/fido-u2f-v1.2-ps-20170411/fido-security-ref-v1.2-ps-20170411.html

T-1.2.6	Fingerprinting Authenticators	Violates
	A remote adversary is able to uniquely identify a FIDO user device using the fingerprint of discoverable configuration of its FIDO Authenticators. Consequences: The exposed information violates [SG-8] Limited PII, allowing an adversary to violate [SG-7] User Consent by strongly authenticating the user without their knowledge and [SG-4] Unlinkablity by sharing that fingerprint. Mitigations: [SM-3] Authenticator Class Attestation ensures that the fingerprint of an Authenticator will not be unique. For web browsing situations where this threat is most prominent, user agents may provide additional user controls around the discoverability of FIDO Authenticators.	SG-4, SG7, SG-8

[jans23]

I believe this ticket is about the serial number via USB descriptor. Exposing the device serial number via USB descriptor wouldn't expose the serial number to web browsing situations. Therefore I'm not sure the quotation is applicable.

[szszszsz]

Scheduled to be added in the next release.