awesome-webauthn
SoftU2F
| awesome-webauthn | SoftU2F | |
|---|---|---|
| 6 | 3 | |
| 1,360 | 2,144 | |
| - | - | |
| 7.4 | 0.6 | |
| 30 days ago | over 3 years ago | |
| Swift | ||
| Creative Commons Zero v1.0 Universal | MIT License |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
awesome-webauthn
-
Discord Rolled Out Yubikeys for All Employees
https://github.com/herrjemand/awesome-webauthn
- List of WebAuthn and Passkey Awesomeness
- Apple Passkey
-
FIDO Alliance
You don't need those either, perhaps https://github.com/herrjemand/awesome-webauthn is more to your liking than the website of a standards organization.
-
Login with a Public Ed25519 Key
> Thatâs my point. If itâs not worth your time then let others who are interested discuss rather than just pissing all over the authorâs project.
I feel like there's a glass houses/stones thing going on here.
Please, quote me anything I said that was "pissing all over" it. I'm getting a strange hurt feeling vibe from you given that my only comments were entirely material.
> And whatâs left is essentially wireguard for logins.
I don't get the comparison.
> People love wireguard for its simplicity because it doesnât use certs and PAKEs and whatnot.
I don't know of a VPN that uses PAKE, so I don't get this comparison, but whatever.
> WebAuthnâs crowd and browser implementers on the other hand seem fixated on making sure users never have the option to deploy the protocol in such a way. Thatâs the problem.
https://github.com/herrjemand/awesome-webauthn#software-auth...?
- How is your method not to be locked in?
SoftU2F
-
On-device WebAuthn and what makes it hard to do well
It's been a few years, but the main references I remember using:
1. Windows: https://github.com/frankmorgner/vsmartcard/tree/master/virtu..., which is a fix-up of the older https://www.codeproject.com/Articles/134010/An-UMDF-Driver-f..., and https://github.com/Watfaq/SoftU2F-Win/tree/master/SoftU2FDri.... Note that neither of these actually implement CTAP2.
2. Linux: There's plenty to refer to on HID gadgets, but https://blog.hansenpartnership.com/webauthn-in-linux-with-a-... and the code at https://git.kernel.org/pub/scm/linux/kernel/git/jejb/fido2-c... were my entrypoint.
3. Mac: I ended up not implementing a Mac version, but GitHub themselves used to support a CTAP1/U2F software authenticator, now archived at https://github.com/github/SoftU2F. I was going to work from that.
For the service I looked at different software "devices" interfacing with these kinds of drivers (or just the browser directly in Firefox's case).
1. Generic NIST SP 800-73 PIV: https://github.com/CCob/PIVert. Very limited scope, pentest tool with no extraneous features. It uses the BixVReader driver.
-
FIDO Alliance
Most open source tools I've seen that implement FIDO use a shared Attestation cert[0].
[0]: https://github.com/github/SoftU2F/blob/master/SelfSignedCert...
- Why Cloudflareâs CAPTCHA replacement with FIDO2/WebAuthn is a bad idea
What are some alternatives?
webauth-via-ssh - Authentication for web services using ssh public keys.
webauthn - Web Authentication: An API for accessing Public Key Credentials
OpenSK - OpenSK is an open-source implementation for security keys written in Rust that supports both FIDO U2F and FIDO2 standards.
tpm-fido - A WebAuthn/U2F token protected by a TPM (Go/Linux)
webauthn-ruby - WebAuthn ruby server library â Make your Ruby/Rails web server become a conformant WebAuthn Relying Party
virtual-fido - A Virtual FIDO2 USB Device
YubiKey-Guide - Guide to using YubiKey for GnuPG and SSH
BlueRSA - RSA public/private key encryption, private key signing and public key verification in Swift using the Swift Package Manager. Works on iOS, macOS, and Linux (work in progress).
ssh-mars - An experiment using SSH to sign in to websites
SwiftShield - đ Swift Obfuscator that protects iOS apps against reverse engineering attacks.
discord - RPM Package for discord
softfido - A software FIDO2/U2F authenticator