Emulating a hardware Token with software? (and using the fingeprintscanner on the Pixel2)

[Roman]

Hey;

Really stoked for how fast the WebAuthn is growing; I'd love to look into what happens between the browser and the USB token to try and build my own "un-certified" token. Is there a way to emulate the new FIDO2 certified tokens with software? I've found those two projects for the U2F standard which I was thinking of modifying :

 - https://github.com/carybran/u2f-ble-helper
 - https://github.com/mplatt/virtual-u2f

But I was wondering if it's even possible to run it entirely as software. 

P.S.

Does anyone know how the Webauthn API will communicate with the Androids Fingerprint scanner? They use it as an Authenticator In Balaz's I/O presentation from two weeks ago (the WebAuthN portion begins at 16:40). Will it be using the Androids Fingerprint Authentication? I'm actually interested how it will work with the permissions for the browser to use it at all...

Thanks,

Roman

[Ki-eun Shin]

You can use WebAuthn API for web application and FIDO2 API for the native application.

Google is now providing beta API for FIDO2. Please refer following link.

https://developers.google.com/android/reference/com/google/android/gms/fido/package-summary

[Roman]

Hey!

Thanks for the reply; just to clarify: so for example in the presentation they use the Webauthn API in the Chromium app; which sends the request to authenticate to the Fido2 API; which then uses the

Fingerprint Authentication to "sign" the request and send it back to the web service, is that correct?

Thanks,

Roman