search

tejado / Authorizer

Authorizer is a Password Manager for Android. It emulates an HID keyboard over USB and enters your credentials on your target device. Additionally it supports OTP :key::mobile_phone_off:
495 stars 53 forks source link

Support for QR codes in FIDO #70

Open carlos22 opened 10 months ago

carlos22 commented 10 months ago

Hi,

I'm pretty new to this thingy, it looks all well and I think the Bluetooth FIDO is implemented in https://github.com/tejado/Authorizer/pull/54. I tried to use it with okta.com but my chromium presents me a QR code that I should scan and it contains a FIDO:/ url, i'm not sure how to proceed with that. Any help? I think its not yet implemented to use QR codes with FIDO?! It also asks me to register over Bluetooth but when I press "Accept" nothing happens.

tejado commented 10 months ago

Hi carlos22 Thanks a lot for the feedback. QR codes in FIDO is interessting - I have to check this. But as you get already the Buetooth registration, there might be some issue with the App: what is the other device where you run Okta in thw web browser? Windows, Linux, iOS, macOS, Android as well?

harhitosw commented 10 months ago

Hi @tejado I too wanted to try out the app , but same issue here when I try to register into any WebAuthN supported website on Google Chrome or Edge it asks to scan for QR code , after that I used the Google Authenticator Android Mobile app to scan the QR code . Hereafter the passkeys were created I was asked some permissions and than I got registered . While this I observed that Google Play services coming into foreground and doing all things , maybe you can try it here on this website in any browser https://webauthn.io/ . You can register/authenticate without Authorizer here

carlos22 commented 10 months ago

Hi carlos22 Thanks a lot for the feedback. QR codes in FIDO is interessting - I have to check this. But as you get already the Buetooth registration, there might be some issue with the App: what is the other device where you run Okta in thw web browser? Windows, Linux, iOS, macOS, Android as well?

The web browser was Chromium on Arch Linux.

Yes the google play services offer that API apparently. Not sure if this is something that could also be picked up by micro-g (which is what I use https://github.com/microg - and is baked into a lot of custom roms like CalyxOS).

EDIT: As it seems they also implement some parts of it at least, not sure if its use able or not need to test that... See: https://github.com/microg/GmsCore/commit/b3032b94c107380899632effdeccf7707fcbdf55 But only USB as it seems: https://github.com/microg/GmsCore/wiki/Implementation-Status

tejado commented 10 months ago

Ah yeah, I forgot. The FIDO QR codes are there for caBLE. So basically over the QR code, the link to the device is created. Unfortunately, this is only device-proximity and no FIDO registration will take place over this channel. The actual FIDO registration is done over usual network (-> Internet). As Authorizer is designed to run on devices without any network connectivity, this is not planned to be implemented.

But this doesnt mean you can't use FIDO with Authorizer over Bluetooth: If you register a new account (e.g. on https://webauthn.io/) you have to choose "Security key" and not "iPhone, iPad, or Android device". Can you test this, @harhitosw ?

@carlos22 I will try Chromium on Arch on the weekend. I also pushed few updates to the repo which fixed some bugs but I didn't released a new version yet for this. I will do this on the weekend as well so it would be great if you can then test this out.

Regarding FIDO over USB: I got a PoC running but have to do some additional work before this gets released. EDIT: The FIDO USB topic at GmsCore is for connecting FIDO devices to it, not implementing one on Android (like Authorizer is doing)

tejado commented 10 months ago

@carlos22 I installed arch + chromium and could not reporudce your issue with my latest version. So Authorizer was full functional and I could register & authenticate on https://webauthn.io. Could you check this site as well? I will provide the new apks tomorrow.

harhitosw commented 10 months ago

@tejado I tried out this on a couple of more websites like https://webauthnworks.github.io/FIDO2WebAuthnSeries/ and also https://webauthn.me/ it works fine as we select security key . For record this works fine in both the browsers Edge as well as Chrome in Windows 11 workstation. Moreover I would be happy to contribute in Authorizer !

tejado commented 10 months ago

@harhitosw thats great! Every contribution is more than welcome! If you have any questiona how to contribute or where to start, you can create a new discussion.

@carlos22 How is it looking for you?

harhitosw commented 10 months ago

@tejado can I get source code implementation details , as I am new to the code I find it tough to go through the code and understand flow of the app !

carlos22 commented 10 months ago

@tejado it is working with webauthn.io, but still not with the original app, I was able to use a different method for the app. Thanks four your help.