4 ms·

It seems like if you are on Linux (no Windows Hello or apple Face ID/ touch ID), then your only option for WebAuthn is to buy a Yubikey. Some people (including

It seems like if you are on Linux (no Windows Hello or apple Face ID/ touch ID), then your only option for WebAuthn is to buy a Yubikey. Some people (including me) don't want a usb key. I'd much rather use TOTP or to verify using an existing verified device (like how Signal or Matrix does it)

CodesInChaos 4y ago
Is it not possible to just implement webauthn in software (e.g. as a browser extension, or like the SSH agent)? While that's not quite as secure as a hardware token, it's still better than using a password.
3np 4y ago
There is a huge number of other vendors supporting Webauthn apart from Yubikey. (From the top of my head Nitrokey, Solo, Tomu, Mooltipass, Ledger, Trezor, Google Titan, OnlyKey, Token2). You could also use the system TPM (https://github.com/psanford/tpm-fido https://github.com/psanford/tpm-fido). A brief search didn't yield any FIDO2 software-only solutions for Linux, but I see no reason why in principle you couldn't implement it (perhaps interfacing https://github.com/google/OpenSK https://github.com/google/OpenSK through hidg - similar projects do exist for U2F).
- albertgoeswoof 4y ago
  Implementing it in software is theoretically possible, but not recommended as it would be extremely liable to attack
  - 3np 4y ago
    Indeed, which is most likely the biggest reason why a ready-to-use solution doesn't exist : it's not really a common use-case due to the security implications. Still, if compared to a local software TOTP, it's not necessarily a step down.
  - lrvick 4y ago
    If you have malware on your system it will just take your post-login cookies and you are already hosed. A software WebAuthn solution stops the most common threat that TOTP misses: phishing. Even software WebAuthn is better security than TOTP in every way, especially if it takes the QubesOS approach of running it in a dedicated offline VM.
- psanford 4y ago
  I'm the author of tpm-fido and I'm open to adding fido2/ctap2 support to it.
albertgoeswoof 4y ago
This is the point around adoption, and we need to find a way for Linux machines to support this without a usb token. If we always have the option for TOTP, people will fall back to it, instead of finding ways to move forward with Webauthn. If we keep allowing the use of inferior options, Webauthn won’t gain traction.
- GekkePrutser 4y ago
  Even USB token support is not great on Linux. For example Firefox supports full Fido2 passwordless on Windows but not on Mac or Linux :(
lrvick 4y ago
On QubesOS, a Linux distro, a virtual FIDO device is being implemented along with a domain whitelist firewall. Github also made a proof of concept software FIDO token in the form of a browser plugin s few years ago. Chromium also has built in virtual webauthn support in devtools and other examples like this already exist: https://github.com/bodik/soft-webauthn https://github.com/bodik/soft-webauthn The goal of 2FA is not to stop malware, as malware on your machine will just take the post login cookies and do whatever. The point of 2FA is to protect a user from phishing or database leaks, and TOTP fundamentally fails at stopping both. You can also change system time and get a valid token in the future, and anyone with read access to your phones or the servers system memory can get unlimited free codes by dumping the plaintext secret. Any service still offering TOTP is frankly negligent. WebAuthn is the only standard phishing resistant 2FA available and even pure software emulated solutions offer dramatically better protection than TOTP.

CodesInChaos 4y ago

Is it not possible to just implement webauthn in software (e.g. as a browser extension, or like the SSH agent)? While that's not quite as secure as a hardware token, it's still better than using a password.

3np 4y ago

There is a huge number of other vendors supporting Webauthn apart from Yubikey. (From the top of my head Nitrokey, Solo, Tomu, Mooltipass, Ledger, Trezor, Google Titan, OnlyKey, Token2). You could also use the system TPM (https://github.com/psanford/tpm-fido https://github.com/psanford/tpm-fido). A brief search didn't yield any FIDO2 software-only solutions for Linux, but I see no reason why in principle you couldn't implement it (perhaps interfacing https://github.com/google/OpenSK https://github.com/google/OpenSK through hidg - similar projects do exist for U2F).

albertgoeswoof 4y ago
Implementing it in software is theoretically possible, but not recommended as it would be extremely liable to attack
- 3np 4y ago
  Indeed, which is most likely the biggest reason why a ready-to-use solution doesn't exist : it's not really a common use-case due to the security implications. Still, if compared to a local software TOTP, it's not necessarily a step down.
- lrvick 4y ago
  If you have malware on your system it will just take your post-login cookies and you are already hosed. A software WebAuthn solution stops the most common threat that TOTP misses: phishing. Even software WebAuthn is better security than TOTP in every way, especially if it takes the QubesOS approach of running it in a dedicated offline VM.
psanford 4y ago
I'm the author of tpm-fido and I'm open to adding fido2/ctap2 support to it.

albertgoeswoof 4y ago

This is the point around adoption, and we need to find a way for Linux machines to support this without a usb token. If we always have the option for TOTP, people will fall back to it, instead of finding ways to move forward with Webauthn. If we keep allowing the use of inferior options, Webauthn won’t gain traction.

GekkePrutser 4y ago
Even USB token support is not great on Linux. For example Firefox supports full Fido2 passwordless on Windows but not on Mac or Linux :(

lrvick 4y ago

On QubesOS, a Linux distro, a virtual FIDO device is being implemented along with a domain whitelist firewall. Github also made a proof of concept software FIDO token in the form of a browser plugin s few years ago. Chromium also has built in virtual webauthn support in devtools and other examples like this already exist: https://github.com/bodik/soft-webauthn https://github.com/bodik/soft-webauthn The goal of 2FA is not to stop malware, as malware on your machine will just take the post login cookies and do whatever. The point of 2FA is to protect a user from phishing or database leaks, and TOTP fundamentally fails at stopping both. You can also change system time and get a valid token in the future, and anyone with read access to your phones or the servers system memory can get unlimited free codes by dumping the plaintext secret. Any service still offering TOTP is frankly negligent. WebAuthn is the only standard phishing resistant 2FA available and even pure software emulated solutions offer dramatically better protection than TOTP.