✅ 2FA when 'unlocking'

Would like to bring to everybody’s attention that FIDO2 (The standard that is used for 2FA) actually supports offline mode, and almost all authenticators implement it.

https://fidoalliance.org/specs/fido-v2.0-rd-20180702/fido-client-to-authenticator-protocol-v2.0-rd-20180702.html#sctn-hmac-secret-extension

You can use this to derive a shared secret between bitwarden and the yubikey to lock and unlock the database.

Microsoft Hello uses this for offline login; for example

More context: https://groups.google.com/a/fidoalliance.org/forum/#!topic/fido-dev/tosNJvfjMBM

3 Likes