I've waited 10 years for this.
Should've asked around, there were devices, standards and software for this kind of thing for a while e.g. https://github.com/philipWendland/IsoApplet
How to use FIDO2 USB keys with SSH
61–70 of 99 posts
Re: How to use FIDO2 USB keys with SSH
#62@StavrosK do you have a writeup on how you put together your blog infrastructure?
Re: How to use FIDO2 USB keys with SSH
#63Earlier quoted context omitted.
Here's a browser compatibility matrix (I know, OP is about SSH). FIDO2/U2F Just Works in: Chrome on Windows Firefox on Windows Chrome on Mac Firefox on Mac Chrome in Ubuntu 20 Firefox in Ubuntu 20 Wall of shame (FIDO2/U2F does not Just Work in): Safari EDIT: it does work out-of-the-box in Ubuntu 20, my bad.
In a browser what you want is WebAuthn, U2F is an older never technically standardized hack and should not be used for new implementations. New web sites should do WebAuthn to enable this functionality, here's a guide someone else wrote that I found helpful in talking about the moving parts to actually implement this: https://webauthn.guide/ Firefox's WebAuthn implementation isn't as complete as it would ideally be,…
Care to elaborate how attestation is privacy infringing?
As far as I understand, private attestation is a specific design goal of WebAuthN, achieved by either sharing an attestation credential with at least 100 000 instances of a given authenticator or via cryptographic means.
There have been instances of authenticator vendors getting this wrong, but I remember reading that browsers will detect it and strip any attestation response in this case.
Re: How to use FIDO2 USB keys with SSH
#64Earlier quoted context omitted.
In a browser what you want is WebAuthn, U2F is an older never technically standardized hack and should not be used for new implementations. New web sites should do WebAuthn to enable this functionality, here's a guide someone else wrote that I found helpful in talking about the moving parts to actually implement this: https://webauthn.guide/ Firefox's WebAuthn implementation isn't as complete as it would ideally be,…
Oh is that what the "anonymize this key" is? If the website requires attestation, authentication might fail, but no website should require attestation, maybe unless you explicitly got the key from them (like a bank).
Websites should absolutely be requiring attestation.
The attack scenario here is malware on your computer pretending to be a hardware authenticator (during sign-up or 2FA enrolment) but really just emulating one in software.
Re: How to use FIDO2 USB keys with SSH
#65Earlier quoted context omitted.
Here's a browser compatibility matrix (I know, OP is about SSH). FIDO2/U2F Just Works in: Chrome on Windows Firefox on Windows Chrome on Mac Firefox on Mac Chrome in Ubuntu 20 Firefox in Ubuntu 20 Wall of shame (FIDO2/U2F does not Just Work in): Safari EDIT: it does work out-of-the-box in Ubuntu 20, my bad.
Safari 14 should change that though. https://developer.apple.com/documentation/safari-release-not...
It already works with external FIDO2 compliant authenticators on Safari 13 (iOS 13.5 and macOS 10.15.4).
Re: How to use FIDO2 USB keys with SSH
#66Re: How to use FIDO2 USB keys with SSH
#67Earlier quoted context omitted.
Not with resident key mode.
Sort of. The keys have limited space on them (20 for some Yubikey models) for resident keys. You wouldn't want to be always using them for everything.
That's why I'm excited about SoloKeys v2, they (will) come with space for thousands of resident keys.
Re: How to use FIDO2 USB keys with SSH
#68I've waited 10 years for this.
Waited 10 years? Why didn't you just use a yubikey in PIV mode, or the yubikey with gpg, or a smartcard, or…
I've been using a yubikey PIV for, hmm… at least 5 years.
Sure, a FIDO key is cheaper.
Re: How to use FIDO2 USB keys with SSH
#69Be aware literally nothing supports this unless it's your own kernel. Gitlab? No. Github? No. My gateway with a hand built gentoo kernel? Yes. It seems functional, but you've also got to be aware that `ed25519-sk` and `ecdsa-sk` have sort of spotty support in the devices too. `ed25519-sk` does not work on a Yubikey <5, for example.
Not only that, but there's billions of devices out there that don't support it.
I can SSH to my AP, my home router, all routers at basically any ISP. None of those support this. Most of them probably never will, until they're thrown away and new ones bought in 5-10 years.
Bottom line: This can't be your only key. So why bother? Why not use PIV mode/smartcard/other, which does work with every single one of these billions of devices, because they have no server-side requirements like these.
Re: How to use FIDO2 USB keys with SSH
#70@StavrosK do you have a writeup on how you put together your blog infrastructure?
Not really but it's just Lektor and Netlify, hosted on Gitlab. I also have Gitlab CI deploying the site on Neocities (https://neo.stavros.io/) as a backup/just to see if I could.