5 ms·

Does someone know for any equivalent for Ubuntu Desktop? (or any distro for that matter)

rzzzt 7y ago
I found this bit of documentation for a similar component: https://chromium.googlesource.com/chromiumos/platform2/+/HEAD/u2fd/README.md https://chromium.googlesource.com/chromiumos/platform2/+/HEA...
danstiner 7y ago
Shameless self-plug, I've written such an equivalent for Linux distros: https://github.com/danstiner/rust-u2f#rust-u2f https://github.com/danstiner/rust-u2f#rust-u2f Though it suffers from the caveat that secrets are just stored as a file in $HOME. I'd love to support more secure methods but haven't seen enough interest in the project to justify the dev time that would be required.
- kelnos 7y ago
  Neat! Is there a reason why it says at the top it only supports Google Chrome? I haven't looked into it too deeply, but a cursory glance seems to suggest there's no Chrome-specific extension, so I assume you're just hooking into the normal pkcs-related frameworks on Linux?
  - danstiner 7y ago
    It definitely also supports Firefox, updated the README. I'm just emulating a USB device and using OpenSSL to do the signing, is there a better approach I should be looking at? (perhaps PKCS #11)
- abrodersen 7y ago
  I would love to have a hardware-backed soft U2F daemon for Linux. It would be great if this could use a TPM to encrypt the data. What would it take to add such capability to your software? I would be happy to lend my (limited) Rust experience to help make it happen.
  - danstiner 7y ago
    I would too. Go ahead and open an issue and we can chat more, but in short I think the biggest hurdle is understanding TPM2 and what API to use to interact with the device. (TPM2 is necessary so the key material never leaves the TPM, signing happens in the device itself)
- deleted 7y ago
  [deleted]
- pabs3 7y ago
  Have you considered punting the storage decision to the Linux desktop's Secret Service (the equivalent of the macOS keychain)? https://specifications.freedesktop.org/secret-service/ https://specifications.freedesktop.org/secret-service/
  - danstiner 7y ago
    Thanks for the suggestion. It hasn't been a focus yet because it doesn't bring much security for me personally, but it is something I would like to do eventually. Issue: https://github.com/danstiner/rust-u2f/issues/19 https://github.com/danstiner/rust-u2f/issues/19
eikenberry 7y ago
The oathtool command line app supports TOTP. It is pretty straightforward to script something if you need it. The package has the same name (oathtool).
- w8rbt 7y ago
  Does oathtool take stdin? Last time I looked it did not. I keep my TOTP secrets PGP encrypted and pipe them to goathgen. $ gpg -d encrypted-secret.txt | goathgen https://github.com/w8rbt/goathgen https://github.com/w8rbt/goathgen
  - beefhash 7y ago
    Funny you'd wrote a wrapper like that, too. I ended up making something in C that uses readpassphrase(3) [with -lbsd on Linux, but I haven't built it on a Linux machine in years] and zeroes the memory with explicit_bzero(3) as it goes out. The keys come from a dedicated password manager that only stores TOTP secrets and the password manager wipes the clipboard. All this happens on a physically separate machine.

I found this bit of documentation for a similar component: https://chromium.googlesource.com/chromiumos/platform2/+/HEAD/u2fd/README.md https://chromium.googlesource.com/chromiumos/platform2/+/HEA...

danstiner 7y ago

Shameless self-plug, I've written such an equivalent for Linux distros: https://github.com/danstiner/rust-u2f#rust-u2f https://github.com/danstiner/rust-u2f#rust-u2f Though it suffers from the caveat that secrets are just stored as a file in $HOME. I'd love to support more secure methods but haven't seen enough interest in the project to justify the dev time that would be required.

kelnos 7y ago
Neat! Is there a reason why it says at the top it only supports Google Chrome? I haven't looked into it too deeply, but a cursory glance seems to suggest there's no Chrome-specific extension, so I assume you're just hooking into the normal pkcs-related frameworks on Linux?
- danstiner 7y ago
  It definitely also supports Firefox, updated the README. I'm just emulating a USB device and using OpenSSL to do the signing, is there a better approach I should be looking at? (perhaps PKCS #11)
abrodersen 7y ago
I would love to have a hardware-backed soft U2F daemon for Linux. It would be great if this could use a TPM to encrypt the data. What would it take to add such capability to your software? I would be happy to lend my (limited) Rust experience to help make it happen.
- danstiner 7y ago
  I would too. Go ahead and open an issue and we can chat more, but in short I think the biggest hurdle is understanding TPM2 and what API to use to interact with the device. (TPM2 is necessary so the key material never leaves the TPM, signing happens in the device itself)
deleted 7y ago
[deleted]
pabs3 7y ago
Have you considered punting the storage decision to the Linux desktop's Secret Service (the equivalent of the macOS keychain)? https://specifications.freedesktop.org/secret-service/ https://specifications.freedesktop.org/secret-service/
- danstiner 7y ago
  Thanks for the suggestion. It hasn't been a focus yet because it doesn't bring much security for me personally, but it is something I would like to do eventually. Issue: https://github.com/danstiner/rust-u2f/issues/19 https://github.com/danstiner/rust-u2f/issues/19

eikenberry 7y ago

The oathtool command line app supports TOTP. It is pretty straightforward to script something if you need it. The package has the same name (oathtool).

w8rbt 7y ago
Does oathtool take stdin? Last time I looked it did not. I keep my TOTP secrets PGP encrypted and pipe them to goathgen. $ gpg -d encrypted-secret.txt | goathgen https://github.com/w8rbt/goathgen https://github.com/w8rbt/goathgen
- beefhash 7y ago
  Funny you'd wrote a wrapper like that, too. I ended up making something in C that uses readpassphrase(3) [with -lbsd on Linux, but I haven't built it on a Linux machine in years] and zeroes the memory with explicit_bzero(3) as it goes out. The keys come from a dedicated password manager that only stores TOTP secrets and the password manager wipes the clipboard. All this happens on a physically separate machine.