Hacker News Reader

Comment by acdha | Hacker News Reader

They list other advantages in the README such as tying into the web authentication model, which is pretty big for enterprise use as everything moves towards OIDC. If they could eventually use passkeys that’d be really nice.

View on HN

SSH supports passkeys: https://developers.yubico.com/SSH/#_fido2

With hardware tokens, yes, I use that. I was thinking that building it on a web server would be really handy with an integrated client you could use with iCloud, Windows Hello, etc.

This already exists too

With /passkeys/, actually! It's more generic than just hardware keys. I don't know of any good implementation yet, but there were a few projects on github mentioned in some passkey-related discussions here. I do not use anything like iCloud or Windows Hello and I don't know what these services actually use, but if they implement these open standards, it's only a matter of adding some glue code. I'd say it's likely that Putty will implement this over on Windows eventually. That is my speculation, as I said, I don't actually use any of this.

I mentioned those because key management is the hard part and most people are going to be using platform authenticators for that reason. In some cases there are APIs (this was one of the features in the last macOS / iOS release) but I was also thinking that moving it closer to a browser is interesting because between platform passkeys and SSO, there are a lot of people who have all of their credentials & MFA ready in a browser and would like to reuse that.

Some searching suggests there’s at least one implementation of the SSH agent protocol using Windows Hello, which is great.

For oidic there's at least:

https://github.com/salesforce/pam_oidc

https://github.com/EOSC-synergy/ssh-oidc

I already already use passkeys for ssh. libfido.

You can already do all of this with ssh

Reply on news.ycombinator.com