WebAuthn on arvau

ArchWiki / WebAuthn

Web Authentication (WebAuthn), commonly referred to as passkeys, is an authentication method for the Web that does not use passwords, but instead a USB dongle and usually some biometrics.

WebAuthn itself is a standard published by the W3C and developed as part of the FIDO2 Project, whose goal is a standardized way to log into services that resists to attacks like phishing, man-in-the-middle, and malware. (This is achieved by replacing passwords with public-key cryptography.)

FIDO2 vs U2F

FIDO2 is the successor of the FIDO Universal 2nd Factor U2F legacy protocol, which is only designed to act as a second factor to strengthen existing username/password-based login flows.

Similar to legacy U2F, Web Authentication is resilient to verifier impersonation, that is, it is resistant to active man-in-the-middle-attacks, but unlike U2F, WebAuthn does not require a traditional password. Moreover, a roaming hardware authenticator is resistant to malware since the private key material is at no time accessible to software running on the host machine.

Without an external dongle

FIDO2 can be used without an external device by having some software create a fake USB device, backed by something. This will result in some compromises, however.

TPM backend

If you have one, the TPM can be used as a backend: the private keys then cannot be compromised, but the downside is that the passkey becomes bound to the computer (and will be lost if the computer is).

linux-id can provide a TPM-backed FIDO2 pseudo-device (with optional fprint integration for more secure fingerprint-based usage), as well as passkeyd.

Purely software backend

A fully software-based backend can be used, but then the private keys are susceptible to being read from your disk and used to impersonate you like a password.

passkeyd supports systems without a TPM. passkeez is also available.

Authentication for websites

WebAuthn/FIDO2 is supported by major sites like Google, Facebook, Twitter, or GitHub. See https://www.dongleauth.com/ to find other websites and links to setup documentation. Major sites offer different WebAuthn variants but may first offer Passkeys authentication, since that allows to transiently synchronize credentials to a cloud-based account instead of relying on a separate hardware authenticator or password manager.

Modern browsers like Firefox and Chromium support WebAuthn authentication standalone, additional dependencies are not required.

For a demo site to test the WebAuthn authentication process, see https://webauthn.io/.

Local Linux authentication (PAM)

For using U2F authentication see U2F.

Using a FIDO2 authenticator for local login

The FIDO2 specification includes an extension called HMAC Secret Extension (hmac-secret), which allows the secure use of a shared secret stored on the authenticator for local authentication.

One of the easiest ways to setup the local authentication process with FIDO2 is through the use of systemd-homed and the setup options of homectl.

Support

Chromium: supported since v70
Firefox: supported since v60
bitwarden: the web extension firefox-extension-bitwarden-bin, bitwarden-chromium enables saving passkeys directly in the vault without the need for a security key.
KeePassXC
pass with passless