Show HN: A virtual Yubikey device for 2FA/WebAuthN

> I wonder if there is a way to use an iPhone or Android as a Yubikey. Oops, I mean Fido device.

Yes / sort of. Both systems provide WebAuthn in their native browser, if they have a suitable place to store the private keys, and a way to authenticate the user. On my Pixel 2 it was the fingerprint sensor, on some iPhones I believe it uses FaceID.

In WebAuthn terms this is a platform authenticator, it also provides both factors so you can (but as far as I know no popular sites do) have usernameless one click login, you say I want to log in, your phone sees you have exactly one identity on this site, it provides credentials for that identity, you are now logged in.

The phones also have the same behaviour for apps via their API. This is masked so that rather than being bound to a DNS name like WebAuthn, it's bound to some app identifier, which you "own" on that platform, so a dubious "Better Flashlight" app can't authenticate as the "My Neat App" on the same phone. On the backend you'd adjust your code so that it can handle e.g. SHA256("myneatapp.example") for the web site but also SOME_APPLE_ID for the iPhone app and SOME_GOOGLE_ID for Android.

I've seen this behaviour (not advertised as such) in several apps in the last 2-3 years. The NHS app I use to order routine medication refills is an example. Tap the app, it asks me to log in, presenting a fingerprint symbol, I touch the symbol (this Pixel 6 has the sensor under the glass, I don't love that but I guess the UI is more obvious). Then I follow the exact same UI as if I'd done all the auth steps with fiddly email addresses and passwords.

[Edited to add]

Ooh, bonus feature. If you have Google everything you can literally use an Android phone as a Security Key on your desktop/laptop PC. Chrome sees a web site asked for WebAuthn, sees there's no Security Key plugged into any USB ports, it calls Google, Google sees you have an Android Phone on this account which can do WebAuthn, tells the desktop Chrome about that phone, the desktop does a Bluetooth beacon, "Hey, anybody around here called "tialaramex's Phone" ? Hit me back." If it can see your phone, it proves to Google that it saw your phone, and then the phone lights up with the details of the login you are attempting on the PC and you can authenticate to your phone in the usual way to approve it. Very complicated technically, but the UX is pretty reasonable.

The Bluetooth step is there to help prevent attackers spamming you with login attempts, they would need to be within Bluetooth range of the phone to make that work, so, if that happened you could have them escorted off the property/ arrested/ shot as seems appropriate.

> I store both passwords and 2FA in an automated software.

This effectively reduces the 2nd factor to the first, and indeed produces the diminishing return. It's sufficient to hack one system using one method and you compromise both defenses.

The point behind 2nd factor is to provide a second, *independent* layer of protection that would need to be compromised using an entirely different attack.

In the case of the FIDO2 dongles including the Yubikeys the secret isn't even stored on your system, but on the device itself that doesn't even disclose it to your connected system.

I agree, I wish 1password had more native yubikey support.

It's definitely not strong against the same breadth of attacks as a physical key, but I'd argue there's a place for something like this.

This would still protect against phishing, which is probably the bigger risk for the average consumer.

> I wonder if there is a way to use an iPhone or Android as a Yubikey. Oops, I mean Fido device. Anyone have an idea of how to do that? It seems like getting this to run on an Android would be significantly more functional (no extra device) and cheaper.

Krypt.co. It's been bought and turned into a commercial service but their free platform continues to work without issue. Obviously you shouldn't use this as your own way to authenticate and newer standards aren't supported, but I use it every day for my self hosted services (put everything behind Apache OIDC + Keycloak so I don't even need to set a separate password on my self hosted stuff anymore!)