a passkey query

[Rick]

Android employs use of notifications for passkey challenge and response. Is FCM the protocol used? If not, what is the protocol?

Does Google plan to add BLE support to Android passkey?

Does Apple plan to add notifications as an option to iOS passkey?

 

[Tim Cappalli]

Apparently I never hit reply all. Resending to the list.

Just to be more crisp with terminology here, both Android and iOS support FIDO Cross-Device Authentication. CDA has an optional mode which allows an authenticator to be persistently linked with the platform. The QR code is used to initially link the client and authenticator. If the authenticator doesn't support linking, the QR code is displayed every time. If the device supports linking, the remote authenticator can automatically be invoked. How the remote authenticator handles this invocation and how it is presented to the user is authenticator-specific. 

tl;dr, please avoid calling it "notifications for passkey challenge and response" as that is not really what is happening. It is just CDA with a linked device.

[rjhal...@gmail.com]

In regard to my poorly worded question, my interest was in learning if push like notification protocol were used as part of the passkey authentication ceremony. It arises from my research into passkey authentication security risk landscape. While forcing errors and failures I came upon dialogs including the word “notification” in their messages. And as it happens, yes, push notification is employed in some passkey modes.

My follow-on question in regard to protocol used remains unanswered.

So, there you have it, and thank you for yours.

BTW, CDR is a recognized  passkey mode, there are others. As to whether its optional QR code is suggestive of a protocol or not may be splitting hairs. The QR code is used to deliver a “fido:/” URI and as I understand it, that URI is used by the passkey authenticator to establish a network session with a server for the purpose of exchanging authentication challenge and as response.   

[Tim Cappalli]

There is no "push notification protocol" for FIDO Cross-Device Authentication. 

tim

On Sat, Mar 16, 2024, 06:40 <rjhal...@gmail.com> wrote:

This message originated outside your organization.

---

[Sourav Dhiman]

ale a satatione

--
You received this message because you are subscribed to the Google Groups "FIDO Dev (fido-dev)" group.
To unsubscribe from this group and stop receiving emails from it, send an email to fido-dev+u...@fidoalliance.org.
To view this discussion on the web visit https://groups.google.com/a/fidoalliance.org/d/msgid/fido-dev/CACZ9TyCGSY%3DOaGo%2BKtZD2U38UN6WqmByXa4dm8tgE2i9DmM5sw%40mail.gmail.com.

[Sourav Dhiman]

Faizabaid

[Joshua Zhao]

Are you asking about the caBLE (Cloud-Assisted BLE) protocol? The linked authenticators are just long-term connections via caBLE. I suspect that push notifications are utilized to reactivate the long-term connection.

[rjhal...@gmail.com]

Joshua,

 

Correct, it appears the framework is caBLE while underlying protocols are Web Bluetooth, BLE and an as yet unknown/undocumented network protocol. In addition to the exchanges between Web App and caBLE cloud over internet, and the exchange between Web App and passkey device over BLE, there is also an exchange between passkey device and I’m guessing the caBLE cloud. It is the later that I believe for the moment is initiated by caBLE cloud. It thought to be a necessary component providing a way for caBLE cloud to learn the present BLE random BLE address. That would be necessary for the caBLE to do its job to fulfill the Web App request. I alone I guess consider this exchange initiated by caBLE to be a form of “push” notification from caBLE to the passkey device (just me splitting hairs 😊).

 

BTW, pointing me to caBLE specifications would be appreciated.

 

Rick

[Yehua Tmah]

--

You received this message because you are subscribed to the Google Groups "FIDO Dev (fido-dev)" group.
To unsubscribe from this group and stop receiving emails from it, send an email to fido-dev+u...@fidoalliance.org.

To view this discussion on the web visit https://groups.google.com/a/fidoalliance.org/d/msgid/fido-dev/022401da79ed%2481c06290%24854127b0%24%40gmail.com.

[Yehua Tmah]

[Tim Cappalli]

FIDO Cross-Device Authentication uses CTAP 2.2 with hybrid transport. As I mentioned earlier, message delivery to linked devices is platform-specific.

On Tue, Mar 19, 2024 at 7:06 AM <rjhal...@gmail.com> wrote:

This message originated outside your organization.

---

[Sophia Liam]

Interesting update on Android’s use of notifications for passkey challenges and responses! I’m curious—does Android use FCM for this, or is there a different protocol in play? Also, is there any word on Google adding BLE support to Android passkeys? On the Apple side, are there plans to introduce notifications as an option for iOS passkeys? For the latest details and related options, check out Rahimsoft. They often provide in-depth coverage on these tech developments!

[Kevin Goldman]

A couple things:

• Read all about the Cross-device Sign in Patter in FIDO Alliance here: https://fidoalliance.org/design-guidelines/patterns/cross-device-sign-in/
  
• If you're signed in to Chrome on say Mac and you're also signed in on Chrome on Android, and you initiate a sign in on Mac on Chrome, then you'll get another experience without a QR even for the first time. You can read about this at the link above, too.