Re:Show HN: A virtual Yubikey device for 2FA/WebAuthN
by tialaramex on Sunday September 18, 2022 @11:26AM
(#32888324)
> I wonder if there is a way to use an iPhone or Android as a Yubikey. Oops, I mean Fido device.
Yes / sort of. Both systems provide WebAuthn in their native browser, if they have a suitable place to store the private keys, and a way to authenticate the user. On my Pixel 2 it was the fingerprint sensor, on some iPhones I believe it uses FaceID.
In WebAuthn terms this is a platform authenticator, it also provides both factors so you can (but as far as I know no popular sites do) have usernameless one click login, you say I want to log in, your phone sees you have exactly one identity on this site, it provides credentials for that identity, you are now logged in.
The phones also have the same behaviour for apps via their API. This is masked so that rather than being bound to a DNS name like WebAuthn, it's bound to some app identifier, which you "own" on that platform, so a dubious "Better Flashlight" app can't authenticate as the "My Neat App" on the same phone. On the backend you'd adjust your code so that it can handle e.g. SHA256("myneatapp.example") for the web site but also SOME_APPLE_ID for the iPhone app and SOME_GOOGLE_ID for Android.
I've seen this behaviour (not advertised as such) in several apps in the last 2-3 years. The NHS app I use to order routine medication refills is an example. Tap the app, it asks me to log in, presenting a fingerprint symbol, I touch the symbol (this Pixel 6 has the sensor under the glass, I don't love that but I guess the UI is more obvious). Then I follow the exact same UI as if I'd done all the auth steps with fiddly email addresses and passwords.
[Edited to add]
Ooh, bonus feature. If you have Google everything you can literally use an Android phone as a Security Key on your desktop/laptop PC. Chrome sees a web site asked for WebAuthn, sees there's no Security Key plugged into any USB ports, it calls Google, Google sees you have an Android Phone on this account which can do WebAuthn, tells the desktop Chrome about that phone, the desktop does a Bluetooth beacon, "Hey, anybody around here called "tialaramex's Phone" ? Hit me back." If it can see your phone, it proves to Google that it saw your phone, and then the phone lights up with the details of the login you are attempting on the PC and you can authenticate to your phone in the usual way to approve it. Very complicated technically, but the UX is pretty reasonable.
The Bluetooth step is there to help prevent attackers spamming you with login attempts, they would need to be within Bluetooth range of the phone to make that work, so, if that happened you could have them escorted off the property/ arrested/ shot as seems appropriate.
Yes / sort of. Both systems provide WebAuthn in their native browser, if they have a suitable place to store the private keys, and a way to authenticate the user. On my Pixel 2 it was the fingerprint sensor, on some iPhones I believe it uses FaceID.
In WebAuthn terms this is a platform authenticator, it also provides both factors so you can (but as far as I know no popular sites do) have usernameless one click login, you say I want to log in, your phone sees you have exactly one identity on this site, it provides credentials for that identity, you are now logged in.
The phones also have the same behaviour for apps via their API. This is masked so that rather than being bound to a DNS name like WebAuthn, it's bound to some app identifier, which you "own" on that platform, so a dubious "Better Flashlight" app can't authenticate as the "My Neat App" on the same phone. On the backend you'd adjust your code so that it can handle e.g. SHA256("myneatapp.example") for the web site but also SOME_APPLE_ID for the iPhone app and SOME_GOOGLE_ID for Android.
I've seen this behaviour (not advertised as such) in several apps in the last 2-3 years. The NHS app I use to order routine medication refills is an example. Tap the app, it asks me to log in, presenting a fingerprint symbol, I touch the symbol (this Pixel 6 has the sensor under the glass, I don't love that but I guess the UI is more obvious). Then I follow the exact same UI as if I'd done all the auth steps with fiddly email addresses and passwords.
[Edited to add]
Ooh, bonus feature. If you have Google everything you can literally use an Android phone as a Security Key on your desktop/laptop PC. Chrome sees a web site asked for WebAuthn, sees there's no Security Key plugged into any USB ports, it calls Google, Google sees you have an Android Phone on this account which can do WebAuthn, tells the desktop Chrome about that phone, the desktop does a Bluetooth beacon, "Hey, anybody around here called "tialaramex's Phone" ? Hit me back." If it can see your phone, it proves to Google that it saw your phone, and then the phone lights up with the details of the login you are attempting on the PC and you can authenticate to your phone in the usual way to approve it. Very complicated technically, but the UX is pretty reasonable.
The Bluetooth step is there to help prevent attackers spamming you with login attempts, they would need to be within Bluetooth range of the phone to make that work, so, if that happened you could have them escorted off the property/ arrested/ shot as seems appropriate.