Questions tagged [fido]

FIDO (Fast IDentity Online) is an organization which aims to substitute old password authentication with modern password-less solutions. It tries to achieve that by introducing three main protocols : UAF, U2F, FIDO2. Use this tag for questions referring to the FIDO protocols (UAF, U2F, FIDO2).

Filter by
Sorted by
Tagged with
0 votes
1 answer
21 views

Fido2 on Android, how to get the user handle (user id) back

I'm trying to use Fido2 on Android. I've managed to create a credential with the following code: val options = PublicKeyCredentialCreationOptions .Builder() .setRp(PublicKeyCredentialRpEntity(...
Oscar Franco's user avatar
  • 5,711
0 votes
1 answer
59 views

android-safetynet attestation replacement in webauthn after deprecation

android-safetynet attestation format is provided in webauthn in both browser API or FIDO2 Api for Android. Since safetynet API will be deprecated soon, what will be the replacement of safetynet ...
Anas EL HAJJAJI's user avatar
-4 votes
1 answer
74 views

How can FIDO caBLE v2/hybrid transport be implemented in a iOS app? [closed]

Is it possible to implement CTAP 2.2's hybrid transport in an iOS app? Currently, it seems the iPhone's Camera app has already implemented it whereby it scans a QR code prompted by the client platform ...
letsbondiway's user avatar
0 votes
1 answer
66 views

Why is Linux OS having an issue with registration and authentication on webauthn.io using yubikey 5 over NFC whereas it supports usb based only?

Webauthn.io in Linux OS asks for usb based registration and authentication.It does not support yubikey over NFC due to some issue. I tried using my yubikey over omnikey reader for testing on Webauthn....
AGh's user avatar
  • 1
0 votes
0 answers
33 views

How to Store the Yubikey Credentials in a JSON File and Retrieve Them to Use for Authentication in future

I have a Python flask app which is using a Yubikey as a 2FA next to username and password. While registering a new user I am registering the yubikey linked to that user and storing the credentials in ...
Krithick's user avatar
0 votes
1 answer
332 views

Unable to register for authentication using Passkey on Android

I'm trying to follow the official documentation to implement Passkey registration. There is also a codelab demonstrating the topic (note that it works as intended on my Android device.) I created this ...
Ariel Malka's user avatar
  • 15.7k
0 votes
1 answer
50 views

Using a passkey for unattended execution

I'm pretty sure this isn't possible, but I'm going to ask the hive mind. Looking to implement a standards based secure virtual machine credential to use from web based applications that can be ...
mrmoosehead's user avatar
0 votes
1 answer
145 views

android fido - SECURITY_ERR The incoming request cannot be validated

I'm building a demo android app (technically flutter but this code is in the native java code). The purpose of app is to demonstrate logging into an app using fido. My problem is during the fido ...
Brett Sutton's user avatar
  • 3,947
0 votes
1 answer
218 views

Is there a method to use FIDO2/webauthn with ssh

As the title says. We use ssh to connect to many sites and would like to move to use FIDO2/webauthn for authentication. Is this possible? What tools do we need? We are using ubuntu as the client and ...
Brett Sutton's user avatar
  • 3,947
1 vote
1 answer
126 views

Can the OpenSSH FIDO2 ssh key attestation data be used verify the key resides only a FIDO2 token (e.g. Yubikey)?

OpenSSH >=8.2 allows the use of FIDO2 authentication and the ssh-keygen command allows the creation of resident keys on FIDO2 tokens (such as a Yubikey). There is also the option of outputting ...
cloud_hack's user avatar
0 votes
2 answers
73 views

Why does GitHub issue GetAssertion requests when trying to register a new security key

I'm working on a fido2 authenticator library and found some odd behavior regarding the security key registration process on Github: I've previously registered two keys and now I want to add another ...
r4gus's user avatar
  • 115
0 votes
0 answers
47 views

Authenticate to apple.com from Android using Security key

Android FIDO2 SDK requires uploading "assetlinks.json" to relying party server to authenticate using the external security keys. To authenticate to apple.com from an Android app using a ...
Forhad Naim's user avatar
0 votes
1 answer
48 views

Shared device with WebAuthN and platform authenticator

We have a scenario where some of our B2B customers use shared ipads at their sites/locations i.e. a single ipad is shared between multiple users. Can we still authenticate using WebAuthN with platform ...
Ryan.Bartsch's user avatar
  • 3,728
1 vote
1 answer
1k views

Passkeys don't always work on Android phone, despite working on PC and iOS

I'm using Pixel 7 Pro and turned on the new Passkeys feature in my Google Account two days ago. I can login to Google Account using Passkey on my Windows PC (via Windows Hello/physical security key) ...
BlackMiracle's user avatar
0 votes
0 answers
47 views

fido_dev_make_cred returns success but attstmt and authdata are null

Trying to perform registration using my YubiKey 5C Nano device. I have a YubiKey 5C Nano device with PIN set. Product details - YubiKey OTP+FIDO+CCID. I tried to use fido_dev_make_cred(device, cred, ...
hyoyin_Kyuoma's user avatar
0 votes
1 answer
120 views

Webauthn using Passkeys in osx

I am trying to use passkeys to perform webauthn registration and authentication. I have an extension to the website that access the native message host program. The native message host is written in ...
hyoyin_Kyuoma's user avatar
0 votes
0 answers
213 views

How can i manage response of navigator.credentials.get error?

I'm using credentials.get for get the cred stored on my browser. I have the list but i can't manage 2 case: 1- credentials are presented to the user in a modal dialog . If the user makes a gesture ...
mimia's user avatar
  • 21
0 votes
0 answers
33 views

How to get user details from stored biometric creds

I offer the user to authenticate via un IODC/AES service, then i get a persistent access token (think of it as the bank card number) that identifies the user and it's device on my service, the i offer ...
mimia's user avatar
  • 21
2 votes
1 answer
318 views

Determine passkey supported devices/browsers visiting my website

I am trying to log the support for Webauthn and Passkeys of the devices/browsers visiting my webapp. I am checking webauthn support this way: window.PublicKeyCredential?....
Manoj Amalraj's user avatar
0 votes
1 answer
172 views

FIDO2 for SSH login on Linux Server

To establish an SSH connection between my PC (Linux) and server (Linux) I have to enter the password of the user. ssh USER@<IP-Address> Now I want to replace the password with FIDO2. For this I ...
mepi0011's user avatar
1 vote
0 answers
381 views

Does iOS and MacOS support FIDO2 for native apps (Flutter)?

Apple's Safari browser supports WebAuthn now. However, I couldn't find information on if Apple MacOS and iOS support FIDO2 API calls natively. This is for a Flutter cross-platform app. References: ...
Thomas's user avatar
  • 359
0 votes
1 answer
73 views

Yubico SDK and FIDO Device

I'm writing a client application using yubico.Yubikey SDK in .Net. I'm trying to write a code which can fetch "FEITIAN" USB FIDO device connected to my laptop. Though Yubico and FEITIAN are ...
Parshuram's user avatar
-2 votes
1 answer
296 views

No USB Security Key option in Chrome on Android [closed]

with the latest Chrome release which supports passkey, I am not able to see the "USB Security key" option in Chrome on Android. I am not able to use a hardware authenticator such as Yubikey ...
sunday18's user avatar
0 votes
0 answers
136 views

Public key credential verification using android biometric for StrongKeyFido2 API

I am creating an app that works like an authenticator for the website logins, I have setup a server of https://www.strongkey.com/ and here is the samples I am following https://github.com/StrongKey/...
Codingnation's user avatar
0 votes
1 answer
95 views

Do browsers validate authenticatorGetAssertion responses in some way before they get sent back to the server?

I'm currently writing my own FIDO2 authenticator firmware. Up to this point I've been testing my application with the libfido2 suit. I'm able to create new credentials and assertions using libfido2-...
r4gus's user avatar
  • 115
1 vote
1 answer
619 views

How to remove Webauthn credentials from Platform Authenticator?

When you register a Webauthn credential, the private key gets stored in the device(Platform Authenticator/Roaming authenticator). This credential is mapped to the domain(say, www.mydomain.com) of the ...
Manoj Amalraj's user avatar
0 votes
0 answers
115 views

Is there a unified way to support both physical FIDO2 keys and passkeys on iOS?

Apple's Authentication Services provide: ASAuthorizationPlatformPublicKeyCredentialProvider, a credential provider that apps can use to support platform FIDO2 keys (on-board security keys like Face ...
whaatt's user avatar
  • 31
2 votes
2 answers
242 views

How to make a browsers recognize my FIDO2 authenticator?

Hi I'm writing my own FIDO2 authenticator implementation. The firmware runs on a SAM E51 Curiosity Nano. I use tinyusb for the communication with the client (raw usb) and can successfully create new ...
r4gus's user avatar
  • 115
0 votes
1 answer
200 views

Obtain Windows Logon Token using WebAuthN API

I am on an Azure domain where users are able to logon using their FIDO2 security keys. I would like to be able to obtain a user's Windows Logon token using their security key. There are some very ...
Edz1o's user avatar
  • 21
0 votes
1 answer
140 views

FIDO vs SSO : what architecture ? what benefit?

Recently I have been looking for details about FIDO (uaf, u2f, fido2) and I don't get one point : Does FIDO will replace SSO ? Or Both would work together ? What to suggest to clients in terms of ...
Nexinslan's user avatar
1 vote
3 answers
531 views

Delete Fido2 keys on Windows Hello for different account

I’ve recently been working on a project involving FIDO2. While working on this project, I generated several FIDO2 keys on Windows Hello in my laptop (OS: Windows 10 Enterprise 22H2) using a non-admin ...
erionpc's user avatar
  • 378
0 votes
0 answers
108 views

Fido2 for Windows Hello

I want to leverage my windows hello by fido2 security key. but all I saw on internet is somehow dealing with azure active directory. Whereas I wanna extend schema in windows server active directory ...
behnam saki's user avatar
0 votes
1 answer
153 views

FIDO - disable password usage option

is there a way to disallow the option of password usage when using navigator.get(options) or navigator.create(options) it's possible to disable the password / pin code when you write a native ...
Nadav's user avatar
  • 2,609
1 vote
1 answer
181 views

Using CredUIPromptForWindowsCredentials to authenticate a FIDO2 token

I have an Azure AD joined system set up to log on using FIDO2 tokens. With that token I am able to logon as well as unlock the Windows 10 computer so I know that the token is registered and working. ...
Edz1o's user avatar
  • 21
0 votes
0 answers
154 views

Should shared secret be hashed (SHA-256) in ECDH?

FIDO2 uses ECDH (elliptic curve diffie hellman) for key agreement. However, in its sequence diagram, I see they hash the shared secret using SHA-256. Is there any specific reason to use the hash ...
Mohammad Siavashi's user avatar
0 votes
0 answers
141 views

Assertion failure for WebAuth data with libfido2

I have integrated libfido2 library release dlls in my Windows application which is developed in c# for enrolling and authenticating the user via FIDO device. So, After enrolling the user I store the ...
Aditya Sharma's user avatar
1 vote
1 answer
351 views

Any cordova plugin to add WebAuthn API to Android WebView?

We've developed a cordova app that shows one of our websites (which is also accessible using a web browser). Recently, FIDO2 authentication using WebAuthn has been added to that website. This works ...
Victor's user avatar
  • 11
1 vote
1 answer
265 views

Using CTAP2 to authenticate to an app on the same device

CTAP2 allows apps on mobile phones to act as roaming authenticators. An app may implement the protocol over one or more of the supported transports. However, there are use cases where the web or ...
Frank's user avatar
  • 911
1 vote
1 answer
439 views

Challenge fetched from sever does not match challenge created by ASAuthorizationPlatformPublicKeyCredentialProvider credential creation request

I followed WWDC 2022 passkeys video and I am trying to register a passkey for my service in iOS as described in that video. Below is the function where I obtain challenge from server and then make use ...
letsbondiway's user avatar
5 votes
2 answers
646 views

How to remove WebAuthn credentials on Chrome MacOS?

For example, the one created on this WebAuthn demo page: https://webauthnworks.github.io/FIDO2WebAuthnSeries/WebAuthnIntro/UsernamelessExample.html I found the similar question without answer on ...
korywka's user avatar
  • 7,547
4 votes
1 answer
239 views

FIDO2 / WebAuthn Heuristic discovery of ambient /pre-authorized user(s) at authentication time

Edit respose to @cody salas Following on from your sensible and detailed break down: - Require Username: Yes this seems well understood. The RP prompts for username/other-id and finds all credentials ...
McMurphy's user avatar
  • 1,245
0 votes
1 answer
282 views

How to handle the alert of FIDO authentication in selenium?

As title, there would be a alert "verify your identity with webauthn.io" poped when I regisetered a user through FIDO. The alert might have some options. My target is to write a script that ...
Eusden Lin's user avatar
3 votes
2 answers
809 views

What information does FIDO2 url contain and how can we decode it in Swift?

In WWDC 2022 Apple launched GA for Passkeys which will enable in FIDO2 authentication, the next gen open standards based authentication mechanism to replace passwords. On a Relying Party (RP) server ...
letsbondiway's user avatar
1 vote
1 answer
419 views

What is the difference between FIDO2 vs Push for a mobile app

I'm trying to understand the difference between biometrics triggered by a push notification (most used) vs using FIDO2 in a native mobile app. This refers to Multi Factor authentication. What's the ...
geolykos's user avatar
  • 383
0 votes
1 answer
718 views

FIDO2 seamless sign-in across devices - Passkeys

EDIT 2 Just to ellaborate on what @Tim has already explained, I made these changes to the credential.create Authenticator Selection Options: - authenticatorSelection: { //This defaults to ...
McMurphy's user avatar
  • 1,245
1 vote
1 answer
512 views

Limit accepted cross-platform authenticators WebAuthn API

I'm currently creating a POC for WebAuthentication and I'm looking at a scenario where we could use cross-platform authenticators as a 2FA method. So essentially: user logs in to their account on the ...
Charise's user avatar
  • 55
7 votes
4 answers
2k views

Is password still needed when using Passkeys?

Both Apple and Google have demonstrated Passkeys at their developer conferences (Google I/O and Apple WWDC 2022), and Microsoft is also on board. Being able to transfer passkeys from device to device ...
Codo's user avatar
  • 75.8k
-1 votes
1 answer
122 views

python fido2 server with if statement

I'm using the this example as inspiration for my project about Yubikey. At the end of authenticate.html, I want to add an if-statement. So if the authentication is successfull redirect to a specific ...
Paco 2015's user avatar
0 votes
1 answer
158 views

How to get a "fido-u2f' attestation fromat

I tried to create a basic webauthn implementation, using the "Web Authentication API" to use user's biometric. There's one thing I don't get and I didn't find the answer online, it is: Why ...
defless's user avatar
  • 103
0 votes
1 answer
623 views

Fido2 authentication for offline .net application

I know that fido is for authentication in web applications. But my question is whether fido is also suitable for authentication on a local .net application. The Fido server should be on the same ...
Julian Krebs's user avatar