awesome-webauthn

I'm not sure you can. If it is possible, it probably requires some open-source tools and a pretty painful process to get the credentials off a hardware token (if that's even possible) and go through the various API calls. Maybe there's something here? https://github.com/herrjemand/awesome-webauthn https://github.com/Yubico/yubikey-manager

WebAuthn does not mandate any kind of form factor[1], external tokens use CTAP for USB/Bluetooth/NFC, Apple FaceID/TouchID and Windows Hello using proprietary interfaces with the built-in hardware. Blink-based browsers ships with a virtual authenticator for debugging[2] and there are a few more[3]. Apple and Google already announced cloud syncing earlier this year, using "passkey" as a friendlier term for end-users. QR codes already allow for cross-ecosystem non-synced use cases, like using my personal Android phone to log in an account with my work Macbook. https://securitycryptographywhatever.buzzsprout.com/1822302/... is a good listen to catch up on the latest developments. [1]: https://www.w3.org/TR/webauthn-2/#authenticator-model [2]: https://developer.chrome.com/docs/devtools/webauthn/ [3]: https://github.com/herrjemand/awesome-weba

Several WebAuthn Software authenticators: https://github.com/herrjemand/awesome-webauthn#software-auth... https://news.ycombinator.com/item?id=31272867#31274677 > FIDO security keys that explicitly support backing up and restoring their master secrets?

You don't need those either, perhaps https://github.com/herrjemand/awesome-webauthn is more to your liking than the website of a standards organization.

There are some software tokens (Wear OS watch, Android phone), but they are purposely not exportable from the Android Keystore. https://github.com/herrjemand/awesome-webauthn#software-auth... There was mention of a secure backup proposal, but it doesn't appear to have been touched after being a draft for a year: https://github.com/Yubico/webauthn-recovery-extension

> People love wireguard for its simplicity because it doesn’t use certs and PAKEs and whatnot. I don't know of a VPN that uses PAKE, so I don't get this comparison, but whatever. My point about certs was that OP was effectively proposing self-signed X509 client certs. It's unclear to me in what way those are harder to use than the proposal here, except that they actually are a widely accepted standard with user agent support. > WebAuthn’s crowd and browser implementers on the other hand seem fixated on making sure users never have the option to deploy the protocol in such a way. That’s the problem. https://github.com/herrjemand/awesome-webauthn#software-auth...?

The section https://github.com/herrjemand/awesome-webauthn#software-auth... talks about using Android phones or Wear OS to webauthn with Bluetooth. The section title is misleading. It's not about software tokens, but about turning one's phone or a smart watch into a hardware token.

>Firefox already ships with that functionality >and you can enable it. I can't find anything like that, can you point us to the docs/examples? OTOH, I see that someone right now posted a reply to https://github.com/w3c/webauthn/issues/1175#issuecomment-570... trying to downplay the issue of purely software tokens Funnily, https://github.com/herrjemand/awesome-webauthn#software-auth... is not about software tokens but about webauthning with an Android phone or a Wear OS.

> An Android phone itself can be used as a bluetooth hardware token, with Chrome on your laptop. If you're referring to the caBLE (cloud-assisted Bluetooth LE) transport: this is still being worked on (https://github.com/w3c/webauthn/pull/909 but the actual discussion in the FIDO Alliance is non-public) and at the time of writing only works on Google properties. To add: https://github.com/herrjemand/awesome-webauthn also mentions implementations completely in software. Whether those are a good idea depends on your taste, but for playing around you don't need any kind of hardware.

> They are stored on hardware tokens. Not necessarily: the WebAuthn spec mentions two other types of authenticators in the introduction section (https://www.w3.org/TR/webauthn-1/#intro): "Broadly, compliant authenticators protect public key credentials, and interact with user agents to implement the Web Authentication API. Implementing compliant authenticators is possible in software executing (a) on a general-purpose computing device, (b) on an on-device Secure Execution Environment, Trusted Platform Module (TPM), or a Secure Element (SE), or (c) off device." > There does not seem to be a way to have privately generated software keys A specification is something different than an implementation. On https://github.com/herrjemand/awesome-webauthn you'll find (at the time of writing) two software implementations. https://krypt.co/ can be a