3 ms·
I bet you're using U2F/FIDO1. Or, more precisely, I bet you're not using CTAP2. An easy test is to set a PIN on your authenticator, which is an operation that
by Borealid 4y ago
I bet you're using U2F/FIDO1. Or, more precisely, I bet you're not using CTAP2.
An easy test is to set a PIN on your authenticator, which is an operation that is supported in CTAP2 and unsupported in CTAP1. Does Firefox prompt you for a PIN when you go to authenticate? If no, you're using CTAP1.
- ranguna 4y agoMy token has a global pin which when o unlock, I can authorise any request with a simple click. But for ssh keys I do have a pin for each one. The websites I've tried never requested for a pin when setting up. Also LUKS does use FIDO2 https://www.freedesktop.org/software/systemd/man/systemd-cryptsetup@.service.html https://www.freedesktop.org/software/systemd/man/systemd-cry...
- Borealid 4y agoFirefox (only talking about Firefox here) does not use CTAP2, to the best of my knowledge. What you think is "FIDO2" is likely actually U2F/CTAP1. Backwards compatibility with that protocol is part of the FIDO2 spec, but it doesn't enable no-username-provided authentication. LUKS uses libfido2, which supports CTAP2 (and most of CTAP2.1).