FIDO2/U2F/WebAuthn

[Beanow]

So the landscape and story surrounding Webauthn and friends is complicated and in flux.
Recently FIDO2 and some passkey announcements look to be shaking up this space this year and beyond.
https://fidoalliance.org/passkeys/

Unfortunately however Webview based applications seem to be in the worst shape of all options right now. Meaning you will have to either use a supported Browser, or use native OS libraries (when they exist). And we're not alone in this as you'd expect: electron/electron#24573

Android SDK: Fido2ApiClient
Windows Hello: FIDO2 Win32 APIs
macOS, iOS: WebAuthn via ASWebAuthenticationSession
Linux: 🤷 😅

(I haven't gotten the current listing of all Webview opinions on this matter.)

Right now, for Tauri users this means they don't have reliable cross-platform access to these features in the Webview, using Webauthn. And the alternative is to use the native calls, which also aren't on every platform.

Now I don't want to get too anti here, but there's something more to keep in mind about the "native" libraries listed there. Notice that standards are available at every level:

• W3C Webauthn
• CTAP 2
• USB HID / BLE / NFC
• FIDO 2 / FIDO U2F

Yet where do these native libraries live?

• Google Play Services.
• Windows Hello.
• iCloud keychains (ok tbh I'm not a mac expert so correct me here.)

Unfortunately, the big platforms seems to have rolled their own implementation and laced it with an agenda to use their accounts and services. 😢 There are positives to it as well though. Such as syncing passkeys within that ecosystem. But given how many standards are available. There seems to be a distinct lack of a vendor neutral implementation here.

Enter cool initiatives like https://github.com/AlfioEmanueleFresta/xdg-credentials-portal
An attempt to create the missing Linux portal for it, along with a rust implementation while they're at it 😮
Previously based off https://github.com/mozilla/authenticator-rs which is a WIP crate to add FIDO2 support to Firefox.

And another vendor shows here https://hwsecurity.dev/guide/fido-webview/ it is feasible to independently implement this and bridge it into a webview. (Java implemenation for Android / Xamarin there)

Something I've not extensively looked at yet, is any official stance / status on every webview.

Mentions:
#2261
#6471
https://discord.com/channels/616186924390023171/1090685771754766481

[Beanow]

Note we also have:
https://github.com/tauri-apps/plugins-workspace/tree/dev/plugins/authenticator

[DeepBhat]

That link is broken can you please provide the correct one?

[FabianLars]

For tauri v1: https://github.com/tauri-apps/plugins-workspace/tree/v1/plugins/authenticator

For tauri v2: https://github.com/tauri-apps/plugins-workspace/tree/v2/plugins/authenticator

Note that we currently consider this plugin basically broken. It can serve as inspiration, but probably shouldn't be used as-is.

[dev-itzarun]

is there anyother available ?