Uh, what?

The Advanced Protection program requires a U2F security key. Safari doesn't support it.

Thanks. Hopefully this will be solved when they adopt Web Authentication?

If Apple doesn't come up with an alternative iAuth NIH "standard".

Google didn't support U2F for Gmail in Firefox for a long time because Chrome was incorrectly implementing the spec [1] and relied on interoperability with their previous proprietary implementation [2] of U2F, and Gmail relied on that. Apple has been a better actor in this regard than Google has, since they are planning to implement the spec as written [3].

[1]: https://bugzilla.mozilla.org/show_bug.cgi?id=1409573

[2]: https://bugzilla.mozilla.org/show_bug.cgi?id=1436078

[3]: https://webkit.org/status/#feature-web-authentication

Didn't Google implement before the browser integration APIs spec was final?

If so, I totally understand a migration period, and it's nothing to hold against them.

Google UA sniffed on Gmail to exclude Firefox (and every browser that wasn't specifically Chrome).

And there shouldn't be a "migration period" that holds the entire feature hostage until browsers implement Chrome-specific stuff.

My memory was that Firefox had implemented a newer draft (or final version?) of the spec. Sniffing the UA to avoid providing broken stuff to people isn't exactly evil.