virtual-fido

For those of us wanting non-big-tech implementations of WebAuthn/passkeys, there are options for storing passkeys in software, and for storing passkeys in TPMs. https://github.com/bulwarkid/virtual-fido/ https://github.com/keepassxreboot/keepassxc/pull/8825 https://github.com/psanford/tpm-fido https://git.kernel.org/pub/scm/linux/kernel/git/jejb/fido2-c...

> who the heck would carry a USB key with them?? Why not? I do this. It's no different from any other physical key like a door key, and I keep it on the same keychain too... > The passkey is usable anywhere (signed up on my desktop, hopped over to my laptop and signed in there with the same passkey). I don't see how this conflicts with physical tokens like Yubikeys? The tokens help you "remember" the key like how a physical door key helps you "remember" the bitting (which is the real authentication info).* Just like passkeys, U2F can also be done using a virtual U2F device if you so choose (https://github.com/bulwarkid/virtual-fido). And presumably you could create an off-device portable token to store passkeys... The real problem at the end of the day is just consistent adoption. There's still a ton of 2FA services that don't accept U2F

Regarding the statements that you need a Yubikey (for the FIDO part of passkey, given application support?) on GNU/Linux, at least Solo 2, Nitrokey 3, and Onlykey hardware keys have free firmware. I can't vouch for them, but maybe also see https://github.com/psanford/tpm-fido and https://github.com/bulwarkid/virtual-fido

> this is kind of expensive and also non-obvious as Yubikey primarily sells single keys Unless you need the GnuPG or SSH applets, I just use the $14 FIDO keys from Identiv. They are also NFC capable for my mobile devices also. I keep one at my office, one at home and carry one in my pack. I too wish there were a way to keep them in sync or back them up. Maybe a virtual FIDO key? https://github.com/bulwarkid/virtual-fido

It's been a few years, but the main references I remember using: 1. Windows: https://github.com/frankmorgner/vsmartcard/tree/master/virtu..., which is a fix-up of the older https://www.codeproject.com/Articles/134010/An-UMDF-Driver-f..., and https://github.com/Watfaq/SoftU2F-Win/tree/master/SoftU2FDri.... Note that neither of these actually implement CTAP2. 2. Linux: There's plenty to refer to on HID gadgets, but https://blog.hansenpartnership.com/webauthn-in-linux-with-a-... and the code at https://git.kernel.org/pub/scm/linux/kernel/git/jejb/fido2-c... were my entrypoint and cover the whole idea of WebAuthn in software. 3. Mac: I ended up not implementing a Mac version, but GitHub themselves used to support a CTAP1/U2F software authenticator, now archived at https://github.com/github/SoftU2F. I was going to work from that. For the servi

Which tool are you using for the virtual USB driver? The only one I know about is virtual-fido: https://github.com/bulwarkid/virtual-fido

If you want to do WebAuthn "terribly" on Linux or elsewhere, the virtual-fido tool presents a fake WebAuthn hardware device over USB over IP. https://github.com/bulwarkid/virtual-fido/

The actual 'brains' repo is [1], which is MIT licensed. [1] https://github.com/bulwarkid/virtual-fido

For those of you who want something like this with Firefox on Linux, the virtual-fido project might provide a decent alternative, it uses Linux's USB-over-IP support to provide a fake FIDO device, and Firefox supports FIDO devices for WebAuthn: https://github.com/bulwarkid/virtual-fido/ https://news.ycombinator.com/item?id=32881956

You can use an open source virtual FIDO device instead of Apple's implementation: https://github.com/bulwarkid/virtual-fido/