> I wonder if there is a way to use an iPhone or Android as a Yubikey. Oops, I mean Fido device. Anyone have an idea of how to do that? It seems like getting this to run on an Android would be significantly more functional (no extra device) and cheaper.

Krypt.co. It's been bought and turned into a commercial service but their free platform continues to work without issue. Obviously you shouldn't use this as your own way to authenticate and newer standards aren't supported, but I use it every day for my self hosted services (put everything behind Apache OIDC + Keycloak so I don't even need to set a separate password on my self hosted stuff anymore!)

That's essentially what passkeys are: a consumer-friendly name for on-device FIDO keys you can use over webauthn, along with (in the apple/google/Microsoft case) a mechanism for syncing/backup/recovery provided by your platform account provider. The keys are still backed by hardware, but instead of an external key it uses the internal platform security module (TPM, Secure Enclave, etc.)

You can use your phone without the syncing part to authenticate other device through a mix of a QR code, a tunnel server, and Bluetooth.

> This article is about Yubikeys. Or is it. The project itself is "virtual-fido".

It would be unwise for the author to use the Yubikey trademark in their project name.

> Didn’t RTFA as I know the algorithm is just one line of python using built-in libraries

Time-based OTP (TOTP), which is what Google Authenticator implements, is not the same as FIDO U2F. They use different underlying mechanisms and have different security properties.

TOTP relies on a shared secret key to generate a matching code on client & server. FIDO U2F uses a challenge-response protocol and incorporates the domain of the requesting website (the domain as verified by TLS certificate) into the challenge to ensure that the response is _only_ valid when it was requested directly from the correct website. This prevents phishing attacks, which TOTP does not.

> I wonder if there is a way to use an iPhone or Android as a Yubikey. Oops, I mean Fido device.

Yes / sort of. Both systems provide WebAuthn in their native browser, if they have a suitable place to store the private keys, and a way to authenticate the user. On my Pixel 2 it was the fingerprint sensor, on some iPhones I believe it uses FaceID.

In WebAuthn terms this is a platform authenticator, it also provides both factors so you can (but as far as I know no popular sites do) have usernameless one click login, you say I want to log in, your phone sees you have exactly one identity on this site, it provides credentials for that identity, you are now logged in.

The phones also have the same behaviour for apps via their API. This is masked so that rather than being bound to a DNS name like WebAuthn, it's bound to some app identifier, which you "own" on that platform, so a dubious "Better Flashlight" app can't authenticate as the "My Neat App" on the same phone. On the backend you'd adjust your code so that it can handle e.g. SHA256("myneatapp.example") for the web site but also SOME_APPLE_ID for the iPhone app and SOME_GOOGLE_ID for Android.

I've seen this behaviour (not advertised as such) in several apps in the last 2-3 years. The NHS app I use to order routine medication refills is an example. Tap the app, it asks me to log in, presenting a fingerprint symbol, I touch the symbol (this Pixel 6 has the sensor under the glass, I don't love that but I guess the UI is more obvious). Then I follow the exact same UI as if I'd done all the auth steps with fiddly email addresses and passwords.

[Edited to add]

Ooh, bonus feature. If you have Google everything you can literally use an Android phone as a Security Key on your desktop/laptop PC. Chrome sees a web site asked for WebAuthn, sees there's no Security Key plugged into any USB ports, it calls Google, Google sees you have an Android Phone on this account which can do WebAuthn, tells the desktop Chrome about that phone, the desktop does a Bluetooth beacon, "Hey, anybody around here called "tialaramex's Phone" ? Hit me back." If it can see your phone, it proves to Google that it saw your phone, and then the phone lights up with the details of the login you are attempting on the PC and you can authenticate to your phone in the usual way to approve it. Very complicated technically, but the UX is pretty reasonable.

The Bluetooth step is there to help prevent attackers spamming you with login attempts, they would need to be within Bluetooth range of the phone to make that work, so, if that happened you could have them escorted off the property/ arrested/ shot as seems appropriate.

You could start by saying smartphone, but that was probably intentional.

Robocop is an Android, and the spike extending from his knuckle was used in the film as an authentication device.