Support hardware tokens (WebAuthn)

[stephanvierkant]

I'm using hardware tokens from Yubico. It would be great if this library supports WebAuthn.

I've used r/u2f-two-factor-bundle before, but it doesn't support scheb/2fa and it lacks some quality this library has. And I've think it's better to support the newer WebAuthn API instead of FIDO2/U2F.

See https://caniuse.com/webauthn for browser support.

[Spomky]

Hi @stephanvierkant,

Actually I started to develop an extension to that lib to support Webauthn.
It is based on the web-auth/* framework I manage.
Unfortunately my planning has not allowed me to spend much time so far… but this is still in my todo list.

By the way, it will allow hardware tokens (Yubico, Feitian…) as well as internal authenticator (Android, Apple Face/TouchId…).

[stephanvierkant]

Great to hear! Keep us posted and let us know if you need some help.

[scheb]

I have to say I have no experience at all with hardware token (no idea what FIDO2/U2F is), so I'm probably not the best person to implement this.

Why not contribute back to r/u2f-two-factor-bundle to improve the library?

[scheb]

Flagging this with "help wanted", if this should ever become part of the 2fa package and not being provided by a 3rd-party package. Someone with knowledge in that field, who knows how it's best implemented, what libraries to use, etc. would be needed to contribute it. As mentioned above, I'm feeling myself not experienced enough with that authentication method to implement it with confidence.

[PhilETaylor]

Flagging this with "help wanted"

I think its time I contributed back ;-) drop me a quick email at phil@phil-taylor.com and I'll reply back with my thoughts on a plan.

[wouterj]

I have been playing with the web-auth/* packages and webauthn (using the Krypton app, as I don't have a physical key) before.

From my findings, the best solution would be to create a two factor provider implementation using this package (or at least, webauthn is way to complex to implement without third party package). So I would suggest to either create a two factor provider for web-auth/webauthn-framework in this bundle or someone contribute an implementation of TwoFactorProviderInterface to https://github.com/web-auth/webauthn-symfony-bundle

[Spomky]

Hi @wouterj,

web-auth/* packages author here. I have started working on a two factor provider, but haven't found much time so far. I will try to propose a draft PR this week so that we can start working on that.

[wouterj]

Yes, no need to rush. Someone on twitter proposed this idea and I just wanted to quickly share my thoughts on this, in case someone wants to work on it but needs some directions :)

[scheb]

I've also had a email exchange with @PhilETaylor recently, though haven't heard back from him. He mentioned that he has some implementations ready, that he could contribute.

[dkarlovi]

@wouterj what's the use case here? Use webauthn instead of TOTP (as in, no auth codes, use a Yubikey or fingerprint on mobile)?

[scheb]

The use case is to provide another common two-factor authentication method as a ready-to-use package, besides the 3 that the bundle already supports (TOTP, Google Authenticator, Code-via-Email).

[Spomky]

In addition to the @scheb answer, Webauthn can be used as new auth factor, but offers more than that. When your users already registered (at least) one authenticator, they can directly be logged in without password (and without username under certain requirements).
Moreover,contrary to TOTP, email or SMS, with Webauthn you don't store are secret or sensitive data (phone number, e-mail address, shared secret...). No matter if the database is hacked.
No need for an extra application or to quit the current website. Everithing is done through the API with hardware tokens or trusted platform modules (TPM). The latter is already working for Android, Windows Hello and MacOS.

[PhilETaylor]

I spent considerable time on this, but got pulled away (as is life) sorry. Also with scheb not having experience with webauth I thought I would struggle to get something past the line.

We already have scheb/2fa or webauth login at manage.mySites.guru but its not currently implemented as a another common two-factor authentication method as a ready-to-use package

It would be relatively easy to replicate the other providers, however the difference to the existing flow is that there is an initial ajax call needed after the user has provided their username (credential identifier) to get the current stored webauth data for that user, before the third party lib js can provide the challenge prompt in the browser.

Currently you have LOGIN FORM COMPLETE -> SUBMIT -> ENTER 2FA CODE -> SUBMIT -> LOGGED IN

With webauthn this would be: LOGIN FORM USERNAME, ajax call, prompt to "touch/activate" key, ajax call -> AUTO SUBMIT -> LOGGED IN

I think, for the scheb/2fa implementation, the additional/advanced features of webauthn (like login without username) should be ignored (At least initially), and have the scheb/2fa implementation be just true to the name, "two factor auth".

I think we should financially gift a hardware key to @scheb so that he can hold it in his hand, and start to understand it. Send me a amazon gift list or link :)

As has been said before, no one should ever consider doing any of this without @Spomky `web-auth/* libs ;-)