Nice! I'm the author of tpm-fido[1] which is similar to this but with some different goals. It looks like you've implemented ctap2, which has been on my todo li

Nice! I'm the author of tpm-fido[1] which is similar to this but with some different goals. It looks like you've implemented ctap2, which has been on my todo list for tpm-fido (we currently use the ctap1 which works fine but doesn't support newer features used for passkeys/passwordless logins). Great to see other independent implementations! The question is often asked: isn't this less secure than a physical key or touch-id? The answer is yes, but only marginally. If you have no other access to a FIDO authenticator, using a soft authenticator will still be much better than using SMS,TOTP, or Push. Phishing is the most likely way 2fa will fail you, and this is still phishing resistant. But passkeys are real and you can essentially use them today! The Android/Chrome integration is already quite good. The Chrome/iOS interaction works but is less smooth right now. That's going to get worked out quite quickly so if you have the option to use passkeys you should! [1]: https://github.com/psanford/tpm-fido https://github.com/psanford/tpm-fido