Closing gaps in strong auth: FIDO2 device support

on YouTube ↗16m

" summary

A D-Bus proxy service lets sandboxed apps use CTAP2 authenticators without raw USB access by routing requests through a host agent that enforces per-device permissions and activates on demand via systemd. Implementation uses D-Bus proxy, libfido2 and TPM2 with xdg-dbus-proxy, an unnamed pipe forwards PINs from the app to the host, and demos show GitHub login from a Flatpak and an emulated passwordless flow; Firefox integration is implemented and awaiting review.

AI-written summary · about

" chapters (9)

1. 0:00Introduction to FIDO
2. 0:50Authentication concepts
3. 2:11Security and authentication
4. 3:51Technical workflow and protocols
5. 6:16Passwordless authentication
6. 8:21Challenges in sandboxing
7. 10:41Implementing host services
8. 12:25Demonstrations
9. 14:30Status and future work

" related talks

• 56mPasskeys 101: Technical Principles of FIDODavid Turner · Authenticate 2024
• 02h 22mFIDO 101David Turner, Paul Heim, Christina Hulka · Authenticate 2022
• 17mFIDO CTAP 2.1Yves Massard · Authenticate 2022
• 23mBorderline: Examining the edge cases of FIDOKaren Larson · Authenticate 2024
• 23mEnhancing FIDO2 Security for Safety-Critical Applications: Best Practices and Consid...Rishita Shaw · Critical Software Summit @ Open Source Summit Japan 2023
• 14mSecuring Authentication with and within FIDOManish Khedawat · Authenticate 2022
• 22mPasskeys through FIDO: How to write your own client?Mario Bodemann · DevConf.CZ 2025
• 38mBreaking FIDO: Are Exploits in There?Jerrod Chong · Black Hat USA 2016