3 ms·

Does anybody know if there is a U2F software solution that works with mobile phones? Ideally with the following features: * Stores keys securely in the Hardwa

Does anybody know if there is a U2F software solution that works with mobile phones? Ideally with the following features: * Stores keys securely in the Hardware-backed Keystore * Authentication via fingerprint + periodically via password * Allows to backup the secret key during setup * Supports multiple devices * Open source * Works over Wifi * Works with Linux desktops and Android phones

francislavoie 6y ago
There's https://krypt.co/ https://krypt.co/
- shaicoleman 6y ago
  That's almost what I was looking for. I wonder how long before Akamai kills it. Main downside is that it doesn't support multiple devices
  - 1cvmask 6y ago
    I thought it was already discontinued a while ago
jrockway 6y ago
U2F is the predecessor to the current standard, WebAuthn. If a web app supports WebAuthn, then that integrates with native keystores (Windows Hello, Face ID, whatever Android has), as well as hardware keys. The site operator has some flexibility to prefer certain methods (platform vs. external) and devices (attestation). I wrote an authenticating proxy that uses Webauthn: https://github.com/jrockway/jsso2 https://github.com/jrockway/jsso2. I don't think you should use it, but you can fire it up locally and try enrolling the various devices. Actually, you can just use Duo's demo: https://webauthn.io/ https://webauthn.io/
- shaicoleman 6y ago
  Unfortuately WebAuthn with the native keystores requires Bluetooth, which is a constant source of pain. That's a deal-breaker for me.
  - jrockway 6y ago
    I don't think that's true. I just logged into my own WebAuthn implementation via my iPhone with an NFC security key. (Bonus points: the key was enrolled on my PC.) The server operator can choose to reject NFC, but the implementation/standard doesn't require that behavior. Edit: Actually, I don't understand your question. Are you trying to authenticate on a PC using your phone as the security key? If so, I don't know how to do that. I just enroll Windows Hello and Face ID.
    - tialaramex 6y ago
      Google built a not as yet standard way for Chrome on a PC to reach out to a Phone and get WebAuthn credentials that way. It has to talk to the nearby phone somehow and so Bluetooth comes into the picture. I've never used this, and I don't know anybody who has, my Security Key plugs into USB, my cheaper FIDO dongle likewise, no Bluetooth here.
  - Rafert 6y ago
    I think you're confusing the cloud-assisted Bluetooth (caBLE) transport with actual built-in device keystores. Google is testing this on their properties while it's being standardized in CTAP and WebAuthn, see https://github.com/w3c/webauthn/issues/1381 https://github.com/w3c/webauthn/issues/1381

francislavoie 6y ago

There's https://krypt.co/ https://krypt.co/

shaicoleman 6y ago
That's almost what I was looking for. I wonder how long before Akamai kills it. Main downside is that it doesn't support multiple devices
- 1cvmask 6y ago
  I thought it was already discontinued a while ago

jrockway 6y ago

U2F is the predecessor to the current standard, WebAuthn. If a web app supports WebAuthn, then that integrates with native keystores (Windows Hello, Face ID, whatever Android has), as well as hardware keys. The site operator has some flexibility to prefer certain methods (platform vs. external) and devices (attestation). I wrote an authenticating proxy that uses Webauthn: https://github.com/jrockway/jsso2 https://github.com/jrockway/jsso2. I don't think you should use it, but you can fire it up locally and try enrolling the various devices. Actually, you can just use Duo's demo: https://webauthn.io/ https://webauthn.io/

shaicoleman 6y ago
Unfortuately WebAuthn with the native keystores requires Bluetooth, which is a constant source of pain. That's a deal-breaker for me.
- jrockway 6y ago
  I don't think that's true. I just logged into my own WebAuthn implementation via my iPhone with an NFC security key. (Bonus points: the key was enrolled on my PC.) The server operator can choose to reject NFC, but the implementation/standard doesn't require that behavior. Edit: Actually, I don't understand your question. Are you trying to authenticate on a PC using your phone as the security key? If so, I don't know how to do that. I just enroll Windows Hello and Face ID.
  - tialaramex 6y ago
    Google built a not as yet standard way for Chrome on a PC to reach out to a Phone and get WebAuthn credentials that way. It has to talk to the nearby phone somehow and so Bluetooth comes into the picture. I've never used this, and I don't know anybody who has, my Security Key plugs into USB, my cheaper FIDO dongle likewise, no Bluetooth here.
- Rafert 6y ago
  I think you're confusing the cloud-assisted Bluetooth (caBLE) transport with actual built-in device keystores. Google is testing this on their properties while it's being standardized in CTAP and WebAuthn, see https://github.com/w3c/webauthn/issues/1381 https://github.com/w3c/webauthn/issues/1381