kanidm / webauthn-rs

An implementation of webauthn components for Rustlang servers
Mozilla Public License 2.0
491 stars 80 forks source link

Improve QR code scanning for cable_tunnel example #296

Open micolous opened 1 year ago

micolous commented 1 year ago

This issue is free to pick up if you're interested; this is mainly a brain dump to track things. This work is part of #259.

The caBLE authenticator implementation example currently needs a may to get FIDO:/ URLs from caBLE QR codes into it. It currently has two mechanisms to supply this:

  1. inputting the URL directly
  2. scanning an image for a QR code (using bardecoder)

I like having the scanning feature available, because it made things pretty convenient during testing and development. My workflow there was to:

  1. start the authentication flow on the device
  2. take a screenshot of the QR code, either using developer tools (for a mobile device) or local screenshot tools
  3. save the screenshot to a file
  4. open the screenshot with cable_tunnel

This is currently about 80% reliable after manual cropping (which I ideally don't want to do!). There's currently a hack in it to make it accept QR codes from iOS initiators more reliably:

https://github.com/kanidm/webauthn-rs/blob/e9ebff3123263073c3668228fa088f007f3fa555/webauthn-authenticator-rs/examples/cable_tunnel/core.rs#L173-L174

Some observations:

I'm able to reliably scan these QR codes with zxing and Google Camera on Android, and with iOS camera ~100% reliably; and that's taking a picture of the screen, rather than the pixel-perfect conditions of a screenshot. They can cheat a little by using multiple frames in the case of a scan failure, but the process feels very responsive.

Work ideas here include:

I'd like to be able to use a device's webcam to scan QR codes in this demo, but this can't really happen until the QR code scanning is more reliable and faster.

micolous commented 10 months ago

Windows 11's built-in caBLE support uses a QR code with square pixels and a logo over the centre (white square with black logo, similar to Chrome). These are also unreliable to scan from screenshots (well, a HDMI capture device), and the only way around it is to re-roll the QR code (by aborting the caBLE transaction).

The logos on Chrome, iOS and Windows are all of a similar size.

I suspect the design of the logo itself is triggering the issue, but as before, using other scanners has been reliable.