3 ms·
There is a huge number of other vendors supporting Webauthn apart from Yubikey. (From the top of my head Nitrokey, Solo, Tomu, Mooltipass, Ledger, Trezor, Googl
by 3np 4y ago
There is a huge number of other vendors supporting Webauthn apart from Yubikey. (From the top of my head Nitrokey, Solo, Tomu, Mooltipass, Ledger, Trezor, Google Titan, OnlyKey, Token2).
You could also use the system TPM (https://github.com/psanford/tpm-fido https://github.com/psanford/tpm-fido).
A brief search didn't yield any FIDO2 software-only solutions for Linux, but I see no reason why in principle you couldn't implement it (perhaps interfacing https://github.com/google/OpenSK https://github.com/google/OpenSK through hidg - similar projects do exist for U2F).
- albertgoeswoof 4y agoImplementing it in software is theoretically possible, but not recommended as it would be extremely liable to attack
- 3np 4y agoIndeed, which is most likely the biggest reason why a ready-to-use solution doesn't exist : it's not really a common use-case due to the security implications. Still, if compared to a local software TOTP, it's not necessarily a step down.
- lrvick 4y agoIf you have malware on your system it will just take your post-login cookies and you are already hosed. A software WebAuthn solution stops the most common threat that TOTP misses: phishing. Even software WebAuthn is better security than TOTP in every way, especially if it takes the QubesOS approach of running it in a dedicated offline VM.
- psanford 4y agoI'm the author of tpm-fido and I'm open to adding fido2/ctap2 support to it.