3 ms·

Is this software to emulate fido2 without a hardware key, or is it software to allow non Web clients to access fido2 devices, or something else ? I already use

Is this software to emulate fido2 without a hardware key, or is it software to allow non Web clients to access fido2 devices, or something else ? I already use fido2 on Linux with a hardware key for a while now. So I'm finding this a bit confusing.

lifeisstillgood 4y ago
If I understand it correctly, it's to use fido2 without firefox or other browser. I support any spread of this and am looking forward to (having the time) to read it
- ranguna 4y ago
  But Linux already supports FIDO2 without Firefox, I use fido2 with sudo, LUKS and ssh keys (gpg as well, but it uses a custom agent). But maybe those use their own custom implementation of the fido protocol? Didn't really look this up tbh, it just works right now.
  - Borealid 4y ago
    sudo, LUKS, and OpenSSH each dynamically link and use Yubico's `libfido2`. That supports FIDO2 well on Linux.
    - ranguna 4y ago
      Meaning this is an alternative to yubico libfido2, gotcha. Thanks.
stavros 4y ago
Looks like a DBus API for FIDO2, so it would let any browser or non-browser app to authenticate via FIDO2. It looks pretty neat!
- ranguna 4y ago
  Ah that makes sense! So it's a way to allow stuff to communicate with fido2 capable devices without having any dependency other than this and dbus, nice
gre345t34 4y ago
As far as I can tell, it's a library that implements CTAP2 (which it erroneously refers to as webauthn).
Borealid 4y ago
This appears to be an alternative to Yubico's `libfido2`. It is software which OTHER software on your computer can use to connect to a FIDO2 authenticator over Bluetooth, USB, etc. The primary benefit is that Firefox wants Rust-language code for FIDO2 support, so hopefully this library will (eventually) fill that gap and get Firefox-on-Linux to proper FIDO2 Webauthn support.
- ranguna 4y ago
  Hmmm but Firefox on Linux already supports FIDO2, I can login to github and gitlab just fine with the existing implementation.
  - Borealid 4y ago
    I bet you're using U2F/FIDO1. Or, more precisely, I bet you're not using CTAP2. An easy test is to set a PIN on your authenticator, which is an operation that is supported in CTAP2 and unsupported in CTAP1. Does Firefox prompt you for a PIN when you go to authenticate? If no, you're using CTAP1.
    - ranguna 4y ago
      My token has a global pin which when o unlock, I can authorise any request with a simple click. But for ssh keys I do have a pin for each one. The websites I've tried never requested for a pin when setting up. Also LUKS does use FIDO2 https://www.freedesktop.org/software/systemd/man/systemd-cryptsetup@.service.html https://www.freedesktop.org/software/systemd/man/systemd-cry...
      - Borealid 4y ago
        Firefox (only talking about Firefox here) does not use CTAP2, to the best of my knowledge. What you think is "FIDO2" is likely actually U2F/CTAP1. Backwards compatibility with that protocol is part of the FIDO2 spec, but it doesn't enable no-username-provided authentication. LUKS uses libfido2, which supports CTAP2 (and most of CTAP2.1).

lifeisstillgood 4y ago

If I understand it correctly, it's to use fido2 without firefox or other browser. I support any spread of this and am looking forward to (having the time) to read it

ranguna 4y ago
But Linux already supports FIDO2 without Firefox, I use fido2 with sudo, LUKS and ssh keys (gpg as well, but it uses a custom agent). But maybe those use their own custom implementation of the fido protocol? Didn't really look this up tbh, it just works right now.
- Borealid 4y ago
  sudo, LUKS, and OpenSSH each dynamically link and use Yubico's `libfido2`. That supports FIDO2 well on Linux.
  - ranguna 4y ago
    Meaning this is an alternative to yubico libfido2, gotcha. Thanks.

stavros 4y ago

Looks like a DBus API for FIDO2, so it would let any browser or non-browser app to authenticate via FIDO2. It looks pretty neat!

ranguna 4y ago
Ah that makes sense! So it's a way to allow stuff to communicate with fido2 capable devices without having any dependency other than this and dbus, nice

gre345t34 4y ago

As far as I can tell, it's a library that implements CTAP2 (which it erroneously refers to as webauthn).

Borealid 4y ago

This appears to be an alternative to Yubico's `libfido2`. It is software which OTHER software on your computer can use to connect to a FIDO2 authenticator over Bluetooth, USB, etc. The primary benefit is that Firefox wants Rust-language code for FIDO2 support, so hopefully this library will (eventually) fill that gap and get Firefox-on-Linux to proper FIDO2 Webauthn support.

ranguna 4y ago
Hmmm but Firefox on Linux already supports FIDO2, I can login to github and gitlab just fine with the existing implementation.
- Borealid 4y ago
  I bet you're using U2F/FIDO1. Or, more precisely, I bet you're not using CTAP2. An easy test is to set a PIN on your authenticator, which is an operation that is supported in CTAP2 and unsupported in CTAP1. Does Firefox prompt you for a PIN when you go to authenticate? If no, you're using CTAP1.
  - ranguna 4y ago
    My token has a global pin which when o unlock, I can authorise any request with a simple click. But for ssh keys I do have a pin for each one. The websites I've tried never requested for a pin when setting up. Also LUKS does use FIDO2 https://www.freedesktop.org/software/systemd/man/systemd-cryptsetup@.service.html https://www.freedesktop.org/software/systemd/man/systemd-cry...
    - Borealid 4y ago
      Firefox (only talking about Firefox here) does not use CTAP2, to the best of my knowledge. What you think is "FIDO2" is likely actually U2F/CTAP1. Backwards compatibility with that protocol is part of the FIDO2 spec, but it doesn't enable no-username-provided authentication. LUKS uses libfido2, which supports CTAP2 (and most of CTAP2.1).