WebAuthN and Fido for Linux

#1

Post by edent » Mon, Oct 24, 2022, 12:48 AM UTC

Re: WebAuthN and Fido for Linux

#2

Post by ranguna » Mon, Oct 24, 2022, 7:45 AM UTC

Is this software to emulate fido2 without a hardware key, or is it software to allow non Web clients to access fido2 devices, or something else ?

I already use fido2 on Linux with a hardware key for a while now. So I'm finding this a bit confusing.

Re: WebAuthN and Fido for Linux

#3

Post by lifeisstillgood » Mon, Oct 24, 2022, 8:49 AM UTC

ranguna wrote: post #2

Is this software to emulate fido2 without a hardware key, or is it software to allow non Web clients to access fido2 devices, or something else ? I already use fido2 on Linux with a hardware key for a while now. So I'm finding this a bit confusing.

If I understand it correctly, it's to use fido2 without firefox or other browser. I support any spread of this and am looking forward to (having the time) to read it

Re: WebAuthN and Fido for Linux

#4

Post by stavros » Mon, Oct 24, 2022, 9:09 AM UTC

ranguna wrote: post #2

Is this software to emulate fido2 without a hardware key, or is it software to allow non Web clients to access fido2 devices, or something else ? I already use fido2 on Linux with a hardware key for a while now. So I'm finding this a bit confusing.

Looks like a DBus API for FIDO2, so it would let any browser or non-browser app to authenticate via FIDO2. It looks pretty neat!

Re: WebAuthN and Fido for Linux

#5

Post by michaelt » Mon, Oct 24, 2022, 10:28 AM UTC

> Windows Hello, Android's FIDO2 support, Apple's TouchID and FaceID, are all examples of platform authenticators. There is no reason why the Linux desktop community could not enjoy similar benefits

Don't those platforms all rely on strict sandboxing and code signing, so that funny-dancing-monkey.exe can't rename itself to google-chrome.exe then perform a passwordless sign-on to google.com ?

I always thought this stuff was slow to arrive on Linux because it demands things that are incompatible with the free-software ethos.

Re: WebAuthN and Fido for Linux

#6

Post by notpushkin » Mon, Oct 24, 2022, 11:32 AM UTC

michaelt wrote: post #5

> Windows Hello, Android's FIDO2 support, Apple's TouchID and FaceID, are all examples of platform authenticators. There is no reason why the Linux desktop community could not enjoy similar benefits Don't those platforms all rely on strict sandboxing and code signing, so that funny-dancing-monkey.exe can't rename itself to google-chrome.exe then perform a passwordless sign-on to google.com ? I always thought this stu…

You can do strict sandboxing on Linux, too (e. g. with Flatpak).

Re: WebAuthN and Fido for Linux

#7

Post by georgyo » Mon, Oct 24, 2022, 11:47 AM UTC

michaelt wrote: post #5

> Windows Hello, Android's FIDO2 support, Apple's TouchID and FaceID, are all examples of platform authenticators. There is no reason why the Linux desktop community could not enjoy similar benefits Don't those platforms all rely on strict sandboxing and code signing, so that funny-dancing-monkey.exe can't rename itself to google-chrome.exe then perform a passwordless sign-on to google.com ? I always thought this stu…

Android is Linux, and most of those sandboxing changes have been upstreamed.

Re: WebAuthN and Fido for Linux

#8

Post by gre345t34 » Mon, Oct 24, 2022, 12:20 PM UTC

ranguna wrote: post #2

Is this software to emulate fido2 without a hardware key, or is it software to allow non Web clients to access fido2 devices, or something else ? I already use fido2 on Linux with a hardware key for a while now. So I'm finding this a bit confusing.

As far as I can tell, it's a library that implements CTAP2 (which it erroneously refers to as webauthn).

Re: WebAuthN and Fido for Linux

#9

Post by Borealid » Mon, Oct 24, 2022, 12:39 PM UTC

ranguna wrote: post #2

Is this software to emulate fido2 without a hardware key, or is it software to allow non Web clients to access fido2 devices, or something else ? I already use fido2 on Linux with a hardware key for a while now. So I'm finding this a bit confusing.

This appears to be an alternative to Yubico's `libfido2`. It is software which OTHER software on your computer can use to connect to a FIDO2 authenticator over Bluetooth, USB, etc.

The primary benefit is that Firefox wants Rust-language code for FIDO2 support, so hopefully this library will (eventually) fill that gap and get Firefox-on-Linux to proper FIDO2 Webauthn support.

Re: WebAuthN and Fido for Linux

#10

Post by michaelt » Mon, Oct 24, 2022, 1:40 PM UTC

notpushkin wrote: post #6

michaelt wrote: post #5

> Windows Hello, Android's FIDO2 support, Apple's TouchID and FaceID, are all examples of platform authenticators. There is no reason why the Linux desktop community could not enjoy similar benefits Don't those platforms all rely on strict sandboxing and code signing, so that funny-dancing-monkey.exe can't rename itself to google-chrome.exe then perform a passwordless sign-on to google.com ? I always thought this stu…

You can do strict sandboxing on Linux, too (e. g. with Flatpak).

Yeah, but that only sandboxes the applications that opt in.

If you want to stop malicious applications from doing malicious things, even when the system owner unwisely grants them permission, you need mandatory sandboxing that the system owner can't bypass.

And that isn't compatible with the free software ethos.