WebAuthn

Web Authentication (WebAuthn), commonly referred to as passkeys, is an authentication method for the Web that does not use passwords, but instead a USB dongle and usually some biometrics.

WebAuthn itself is a standard published by the W3C and developed as part of the FIDO2 Project, whose goal is a standardized way to log into services that resists to attacks like phishing, man-in-the-middle, and malware. (This is achieved by replacing passwords with public-key cryptography.)

FIDO2 vs U2F

FIDO2 is the successor of the FIDO Universal 2nd Factor U2F legacy protocol, which is only designed to act as a second factor to strengthen existing username/password-based login flows.

Similar to legacy U2F, Web Authentication is resilient to verifier impersonation, that is, it is resistant to active man-in-the-middle-attacks, but unlike U2F, WebAuthn does not require a traditional password. Moreover, a roaming hardware authenticator is resistant to malware since the private key material is at no time accessible to software running on the host machine.

Authentication for websites

WebAuthn/FIDO2 is supported by major sites like Google, Facebook, Twitter, or GitHub. See https://www.dongleauth.com/ to find other websites and links to setup documentation. Major sites offer different WebAuthn variants but may first offer Passkeys authentication, since that allows to transiently synchronize credentials to a cloud-based account instead of relying on a separate hardware authenticator or password manager.

Modern browsers like Firefox and Chromium support WebAuthn authentication standalone, additional dependencies are not required.

For a demo site to test the WebAuthn authentication process, see https://webauthn.io/.

Local Linux authentication (PAM)

For using U2F authentication see U2F.

Using a FIDO2 authenticator for local login

The FIDO2 specification includes an extension called HMAC Secret Extension (hmac-secret), which allows the secure use of a shared secret stored on the authenticator for local authentication.

One of the easiest ways to setup the local authentication process with FIDO2 is through the use of systemd-homed and the setup options of homectl.

Authenticators and tools

Using TPM as a FIDO device

To use TPM as a FIDO device, install tpm-fido-git^AUR. This is useful for testing or if you do not have a FIDO key. Alternatives include linux-id^AUR, a fork of the original tpm-fido, and passkeyd^AUR.

Software-based authenticators (without TPM)

For software based authenticator, passkeyd^AUR and passkeez^AUR are available.

Support

Chromium: supported since v70
Firefox: supported since v60
bitwarden: the web extension firefox-extension-bitwarden-bin^AUR, bitwarden-chromium^AUR enables saving passkeys directly in the vault without the need for a security key.
KeePassXC
pass with passless^AUR