0

Quoting from agl's article from Mar 2018:

At the time of writing, all Security Keys are based version one of FIDO’s “Client To Authenticator Protocol” (CTAP1). [...T]he core protocol [can be] transported over USB, NFC, and Bluetooth.

Are there any roadblocks for writing an app for my Android/iOS phone, which would make it work as a U2F hardware token over Bluetooth (assuming my PC has Bluetooth connectivity)? Are there reasons why this would be a bad idea? I tried to search for such an app, but didn't manage to find anything.

  • Not quite the same as what you're proposing, but krypt.co is an app that lets you use your phone as a U2F device. I believe the tradeoffs are similar to those described in @DoubleD's answer - with the addition of an external service for communication with the phone. – dwurf Dec 10 '18 at 23:41
1

Definitely Less Secure

The two biggest concerns apply to all software tokens, not just FIDO.

Platform Vulnerabilities

Hardware security keys provide a relatively strong protection of their cryptographic secrets (either a private key or a seed value). This protection is severely reduced when you implement the functionality on a general purpose OS. If the OS is compromised, an attacker could steal the secret. This extends the risk to include firmware bugs, debug modes, OS vulnerabilities, other software, user issue, etc.

With the well-known problems keeping Android phones up to date, it is especially risky on that platform.

Exclusive Control

The second issue is that compromised credentials are apparent with a hardware token. A user probably will never notice when their smartphone is hacked. In all likelihood, the 2FA app will continue to function normally. With a hardware token, a user will definitely notice when their token is lost or stolen.

You can generally assume a user has exclusive control over their 2FA hardware until shortly before it is reported lost. There can be no such assumption for 2FA credentials stored in software.

Bad Security, But Possibly Worth The Trade-off

In the end, a software 2FA implementation is more prone to being compromised and less prone to detecting successful attacks.

However, it will be cheaper and easier to provision if your users already have supported devices.

This is a classic cost-vs-security trade-off, and organizations make decisions like this all the time. Personally, given the low cost of hardware tokens, I would never choose the app, even if it were free.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.