The key is either stored on the device (called “resident key”), which requires the device to support storage, or it isn’t, and you need to store the data somewhere else. That means that, by extension, you can use the device to prove you are who you say you are to any server who asks. The device can then use this secret key to prove that you have the device in your possession, without the key ever leaving the device. OpenSSH now supports FIDO (U2F) and FIDO2 for authentication, with FIDO2 with resident keys having a nicer UX.Īt a high level, the USB device (FIDO2 devices don’t have to be USB, but they usually will be) will generate a secret key. Using FIDO2 with SSHĭeanna had heard of phishing, and was extremely suspicious of the sound of rubber boots.Īs you may have suspected from the two seemingly unrelated points above, and the dead giveaway title of this section, it would be tremendous if we could use FIDO2 keys to authenticate over SSH, and the OpenSSH developers made it happen. Very little, but I like rambling, it is known. This is great news for us, because now we can have dirt-cheap USB keys that can be used to secure all our authentication very easily, without requiring any special security knowledge.Īll you need to know to be completely immune to phishing, password theft, and a whole host of other ways of losing Bitcoin is to just plug your USB key in, press the little button/type your PIN/enter your fingerprint, and you’re logged in. In summary, WebAuthn and FIDO2 aim to make it really easy to use security devices with stuff by standardizing the way the two talk to each other, and using better terms than “stuff”.

One of the most exciting security-related developments recently has been the development of WebAuthn and FIDO2, which are basically euphemisms for “nice security stuff”. If securing your devices has been something you’ve wanted to easily do yourself, read on, because it’s finally happening. I recently installed Ubuntu Wacky Whatever, the latest version, and I’m very excited about it shipping with SSH 8.2, which means that I can finally use hardware USB keys for secure, easy to use authentication.

Fido u2f fido2