Can I use phone as webauthn security key with Windows 10 Sign-in options

user_7738142 0
Viewed 1651

Edit: -

Look is it just me or doesn't the W3C spec say this should be happening already: -

1.2.2. Authentication

On a laptop or desktop:

User pairs their phone with the laptop or desktop via Bluetooth.

User navigates to example.com in a browser and initiates signing in.

User gets a message from the browser, "Please complete this action on your phone."

Next, on their phone:

User sees a discrete prompt or notification, "Sign in to example.com."

User selects this prompt / notification.

User is shown a list of their example.com identities, e.g., "Sign in as Mohamed / Sign in as 张三".

User picks an identity, is prompted for an authorization gesture (PIN, biometric, etc.) and provides this.

Now, back on the laptop:

Web page shows that the selected user is signed in, and navigates to the signed-in page.

===============

My WebAuthn code happily interacts with Windows Hello for user verification via PIN. My Samsung Android phone happily interacts with the https://webauthn.appspot.com demo and accepts fingerprint verification.

But I can't seem to use my phone as an Security key like a YubiKey connected on my computer?

I can pair it with the PC via Bluetooth or tether it with a USB cable, but Windows will not recognize it as a security key.

Is this possible, or is the functionality restricted? If we could use our phone as security keys, we'd need no special dongles for platform agnostic authentication.

yubico fido webauthn google-chrome android
3 Answers

In order for that to work, the phone device manufacturer would have to either always present itself as a FIDO2 authenticator, or have some sort of switch that allows it to change mode, kind of like how you can configure USB connection to be for charging or for data transfer. I don't see any technical reason why that could not be done, in fact it's come up multiple times in various discussions, but to my knowledge that is not an Android feature, at least not yet.

user_153560600

For that either smartphone OS or a 3rd party application needs to implement CTAP protocol to receive and process authentication operations on the phone. Currently, Android does - but not in a way to be used as a cross-platform authenticator to not stick to only one PC. For 3rd party apps, there are some certified solutions that are listed on the FIDO Alliance website as certified authenticators.

user_15229250

I recently find that the PIXEL phone can do this. When you open a FIDO2 Web via Chrome or Edge, it will prompt a dialog shows add Android Phone. Click it and a QR code(FIDO:/AAACCC...) appeared. Scan the QR Code by your Pixel Camera (registered FIDO2 Token). Magic... A push notify show on the Pixel. Click it and wait and scan FP. Finally your WebAuthn web Verify OK via BT.

The only question for me is what kinds of Andoid phones can support this scnerio. Can any other phone except Pixel support scan the QRCode(FIDO:/....).

user_193563350
Related