WebUSB compatible? about opensk

[jmichelp]

The FIDO HID page is locked down by operating systems for security reasons. The fact that you can't connect to a security key using WebUSB is working as intended.

[kaczmarczyck]

What do you intend to achieve through WebUSB? We have a --vendor-hid flag on develop for this purpose, and it allows you to run non-FIDO commands through WebUSB.

[trustkeysolutions]

My goal for utilizing WebUSB is to facilitate seamless communication between a web application and the user's FIDO device. By leveraging WebUSB, I was trying to see if we can improve user experience with a more straightforward device setup and management process via the browser instead of a desktop app.

Thanks for the info on --vendor-hid flag. This flag indeed allows running non-FIDO commands through WebUSB, which could be useful for our application. However, my current focus is primarily on implementing FIDO-related functionality, but sounds like this is a dead-end.

That said, we will keep the --vendor-hid flag in mind for future development stages, especially when expanding our application to support non-FIDO features or when working with vendor-specific commands. Thanks, again.

[kaczmarczyck]

Warning to all future users that come here: The following advice is dangerous if done wrong, please read to the end.

If you don't mind patching the OpenSK logic (and use the develop branch that is currently worked on), it's not hard to allow FIDO commands over vendor HID. The switch that is responsible is here:

OpenSK/libraries/opensk/src/ctap/mod.rs

Line 603 in 645c1ba

Channel::MainHid(_) => self.process_fido_command(env, command, channel),

Remove the match over channel, always call process_fido_command and OpenSK allows FIDO calls over WebUSB.

There is a reason why we don't allow this, though: Anyone with WebUSB access can then freely send CTAP requests to your device. That includes silent authentication, which means any website could impersonate the user cross origin. I strongly suggest you don't do that, but instead have an authenticated vendor command. FIDO's security model relies on the browser being trustworthy, and therefore opening a hole to circumvent the browser is a bad idea.

Doing some management over the vendor HID channel should be fine though. For example, we send signed upgrades through that channel. The signature guarantees that we can't be impersonated.