Server: FIDO U2F two factor authentication

Created on 12 Oct 2016 · 20Comments · Source: bitwarden/server

I'd love to see FIDO U2F as a method for two factor authentication. Implementation is pretty straightforward, and increases security dramatically.

enhancement help wanted

Source

callaars

👍9

Most helpful comment

I've got U2F configuration and authentication working with the web vault now. I'm still a bit in the dark about if/how this will be possible to work with the browser extension (lack of HTTPS protocol), Android (lack of implementation example), and iOS (lack of implementation example).

kspearrin on 23 Jun 2017

👍3

All 20 comments

Could you please add some information/docs on this method? I am unfamiliar with it.

kspearrin on 13 Oct 2016

The specifications can be found here. There is a C# server library which can be of use. I'm totally inept to add this unfortunately as I don't posses any C#/.NET skill.

callaars on 13 Oct 2016

What type of device is normally used for this?

kspearrin on 13 Oct 2016

Normally for a web login, as it is a physical key (for example this one).

callaars on 13 Oct 2016

Ok cool, so it's the YubiKey thing I have heard about. Is there a test key that can be used for implementation or do I need to buy one?

kspearrin on 13 Oct 2016

Well you got this one, but it's a JavaScript implementation. Not sure there is C# variant.

callaars on 13 Oct 2016

It doesn't need to be C#. Anything will do.

kspearrin on 13 Oct 2016

Just use the JavaScript library then, as it's solid.

callaars on 13 Oct 2016

https://developers.yubico.com/U2F/Libraries/List_of_libraries.html

joshka on 3 Nov 2016

I have a Yubikey and would like to contribute. Can I jump in here?

jcgillespie on 21 Jan 2017

👍2

If you would like to contribute you are more than welcome to. Join our gitter if you need any help getting started: https://gitter.im/bitwarden/Lobby

kspearrin on 21 Jan 2017

Yubikey authorization would be amazing

bcbane on 21 Mar 2017

BTW firefox has a FIDO U2F emulator built into it - makes testing easy

https://bugzilla.mozilla.org/show_bug.cgi?id=1065729

search for webauth.u2f

jhaar on 12 Apr 2017

👍1

+1 for YubiKey support. Any status updates?

paullaros on 27 May 2017

This is planned fro release with our premium memberships which we hope to have out this summer.

kspearrin on 27 May 2017

👍3

I ordered my Yubikey NEO today so I'll start playing around with it soon.

kspearrin on 13 Jun 2017

I don't see a good way to support U2F at this time. It seems it is only possible to make it work on web browsers (chrome). How would we handle other clients such as Android/iOS?

I am planning to implement YubiKey OTP, however. iOS appears to still be out of the question there though since NFC support is lacking.

kspearrin on 13 Jun 2017

iOS 11 seems to include full NFC support, so it'll be possible later on this year. (NFC chips were already widely available as it's the underpinnings of Apple Pay, but the APIs weren't exposed to 3rd party developers. That is what seems to be changing, IIUC.)

Android and iOS support of U2F will require some sort of library that can read the NFC signal from the Neo, or Bluetooth LE for future planned devices, and do the regular handshake. Web browsers implement handling that protocol over USB and were the first to widely deploy it so that's where most of the current tutorials focus on but U2F isn't solely browser-centric.

For an example of Android, Google implemented U2F support as part of Google Authenticator. It's open source and on Github so that might be a place to start. Reading some blog posts implies that there will be an intent other apps can use to handle the U2F protocol for them? But I don't see the source code for the U2F-over-NFC handling, so that's a bummer.

edit: Seems like there are at least a couple of demo applications (Ledger's, Yubico's) for Android & U2F, so there's some public code to start off with.