4 ms·

They list other advantages in the README such as tying into the web authentication model, which is pretty big for enterprise use as everything moves towards OID

by acdha 3y ago

They list other advantages in the README such as tying into the web authentication model, which is pretty big for enterprise use as everything moves towards OIDC. If they could eventually use passkeys that’d be really nice.

kdklol 3y ago
SSH supports passkeys: https://developers.yubico.com/SSH/#_fido2 https://developers.yubico.com/SSH/#_fido2
- acdha 3y ago
  With hardware tokens, yes, I use that. I was thinking that building it on a web server would be really handy with an integrated client you could use with iCloud, Windows Hello, etc.
  - ikiris 3y ago
    This already exists too
  - kdklol 3y ago
    With /passkeys/, actually! It's more generic than just hardware keys. I don't know of any good implementation yet, but there were a few projects on github mentioned in some passkey-related discussions here. I do not use anything like iCloud or Windows Hello and I don't know what these services actually use, but if they implement these open standards, it's only a matter of adding some glue code. I'd say it's likely that Putty will implement this over on Windows eventually. That is my speculation, as I said, I don't actually use any of this.
    - acdha 3y ago
      I mentioned those because key management is the hard part and most people are going to be using platform authenticators for that reason. In some cases there are APIs (this was one of the features in the last macOS / iOS release) but I was also thinking that moving it closer to a browser is interesting because between platform passkeys and SSO, there are a lot of people who have all of their credentials & MFA ready in a browser and would like to reuse that. Some searching suggests there’s at least one implementation of the SSH agent protocol using Windows Hello, which is great.
ycombinatrix 3y ago
I already already use passkeys for ssh. libfido.
ikiris 3y ago
You can already do all of this with ssh
e12e 3y ago
For oidic there's at least: https://github.com/salesforce/pam_oidc https://github.com/salesforce/pam_oidc https://github.com/EOSC-synergy/ssh-oidc https://github.com/EOSC-synergy/ssh-oidc

by acdha 3y ago

kdklol 3y ago

SSH supports passkeys: https://developers.yubico.com/SSH/#_fido2 https://developers.yubico.com/SSH/#_fido2

acdha 3y ago
With hardware tokens, yes, I use that. I was thinking that building it on a web server would be really handy with an integrated client you could use with iCloud, Windows Hello, etc.
- ikiris 3y ago
  This already exists too
- kdklol 3y ago
  With /passkeys/, actually! It's more generic than just hardware keys. I don't know of any good implementation yet, but there were a few projects on github mentioned in some passkey-related discussions here. I do not use anything like iCloud or Windows Hello and I don't know what these services actually use, but if they implement these open standards, it's only a matter of adding some glue code. I'd say it's likely that Putty will implement this over on Windows eventually. That is my speculation, as I said, I don't actually use any of this.
  - acdha 3y ago
    I mentioned those because key management is the hard part and most people are going to be using platform authenticators for that reason. In some cases there are APIs (this was one of the features in the last macOS / iOS release) but I was also thinking that moving it closer to a browser is interesting because between platform passkeys and SSO, there are a lot of people who have all of their credentials & MFA ready in a browser and would like to reuse that. Some searching suggests there’s at least one implementation of the SSH agent protocol using Windows Hello, which is great.

ycombinatrix 3y ago

I already already use passkeys for ssh. libfido.

ikiris 3y ago

You can already do all of this with ssh

e12e 3y ago

For oidic there's at least: https://github.com/salesforce/pam_oidc https://github.com/salesforce/pam_oidc https://github.com/EOSC-synergy/ssh-oidc https://github.com/EOSC-synergy/ssh-oidc