OpenSK

https://github.com/google/OpenSK works, it runs on something like this $15 board. Could do with a case though. https://www.nordicsemi.com/About-us/BuyOnline?search_token=n...

There are many others. The list of FIDO certified products alone is 39 pages long here: https://fidoalliance.org/certification/fido-certified-produc... In addition to that, there are open source implementations for Java Card [1], open hardware efforts [2] and much more. [1] https://github.com/darconeous/u2f-javacard [2] https://github.com/google/OpenSK

There is a huge number of other vendors supporting Webauthn apart from Yubikey. (From the top of my head Nitrokey, Solo, Tomu, Mooltipass, Ledger, Trezor, Google Titan, OnlyKey, Token2). You could also use the system TPM (https://github.com/psanford/tpm-fido). A brief search didn't yield any FIDO2 software-only solutions for Linux, but I see no reason why in principle you couldn't implement it (perhaps interfacing https://github.com/google/OpenSK through hidg - similar projects do exist for U2F).

Cloudflare is one example, using a security key not found in the FIDO Metadata Service, will not work on their site. This precludes the use of any hacker-friendly solution (making your own). > Supported: All security keys found in the FIDO Metadata Service 3.0, unless they have been revoked for security reasons. https://support.cloudflare.com/hc/en-us/articles/44068890480... Attestation keys, aren't very "privacy friendly" either and it's much worse for those who wish to create their own key. > Usually, the attestation private key is shared between a batch of at least 100,000 security keys of the same model. If you build your own OpenSK, your private key is unique to you. This makes you identifiable across registrations: Two websites could collaborate to track if registrations were attested with the same key material. If you use OpenSK be

There are a number of FOSS solutions. - https://github.com/google/OpenSK <- DIY solution - https://solokeys.com/ - https://www.nitrokey.com/ The issue with any FOSS solution is that FIDO requires an attestation private key, which must be shared between a batch of at least 100,000 security keys. Using a DIY or cli app solution (application running on the host) will likely mean you'll be generating that private key yourself, this makes you identifiable across registrations. Some sites (Cloudflare) may reject the use of attestation keys which are not found on the Fido Alliance Metadata Service. This precludes the use of any DIY solution. https://fidoalliance.org/metadata/ https://support.cloudflare.com/hc/en-us/articles/44068890480...

https://github.com/danstiner/rust-u2f https://github.com/google/OpenSK

I'm not sure what you're replying to--this scheme is much closer to self-signed X509 client certs, not FIDO. But regarding FIDO, it does not prevent user-controlled hardware; it's up to RPs to choose if they require specific device manufacturers or not. In my experience, the vast majority of (consumer) RPs do not require specific batch attestation, which is why you can make your own FIDO key: https://github.com/google/OpenSK. I am under the impression support for attestation was controversial in FIDO--it's clearly useful for enterprise scenarios (e.g. where an enterprise requires some silly certification like FIPS: https://support.yubico.com/hc/en-us/articles/360016614760-Ac...), but there's always the risk that consumer-facing RPs require it for no good reason. My employer requires FIPS certification due to FedRAMP; I'd be interested in

My OpenSK chip begs to differ. https://github.com/google/OpenSK

Google open sourced FIDO2 firmware to make a 2fa device. May not be related to Titan keys. https://github.com/google/OpenSK

Because it solves real problems (it's very easy to use, and I use a lot). It works similar with HD wallet in bitcoin or ethereum. In HD wallet, you can derive accounts for many crypto currencies from one seed password which is what master password in lesspass does. The counters in lesspass, can be used to derive another password for the same website, if one want to change the password for the website. HD wallet also has the similar functionality. If you want to change the bitcoin address, just derive another account from the seed password. And the solution to keep the seed password of HD wallet safe can also work with lesspass. such as [OpenSK][1]. [1]:https://github.com/google/OpenSK

Seems like they're not using the CryptoCell to drive crypto ops and have instead written the cypto algos in software in Rust... from the README (https://github.com/google/OpenSK): We're currently still in the process on making the ARM® CryptoCell-310 embedded in the Nordic nRF52840 chip work to get hardware-accelerated cryptography. In the meantime we implemented the required cryptography algorithms (ECDSA, ECC secp256r1, HMAC-SHA256 and AES256) in Rust as a placeholder. Those implementations are research-quality code and haven't been reviewed. They don't provide constant-time guarantees and are not designed to be resistant against side-channel attacks.