What is U2F?

Hey there, just one question: what exactly is U2F? What does that abbreviation mean and what is the purpose of that?

U2F stands for “Universal Second Factor”. You can read about it here.

Hot! Is there some documentation how to use it with a Flipper Zero?

Not at the moment, but it’s really straightforward. Just connect your flipper via usb and open the app, navigate to any website that supports U2F, and from there you can add the flipper as you would any other hardware U2F token. Here’s a demo website

2 Likes

Looks great, the first step is also working (some of the time, if Flipper does not decide to break the connection within 3 seconds) but once I get through the first 2 pages (Device not verified, Unknown device ???) I end up at the Playground and then I can’t use it to sign in anymore. (This security key can not be used, please try a different one ???)

Yes, this is the right behavior.

  1. Open the demo.yubico.com website
    Part 1/2: Registration → click button [Next]
  2. If your browser is supporting WebAuthn you’ll maybe need to confirm some dialogs (Firefox at Linux does have some questions ‘the site is asking for extended information about your security key’ and ‘this site wants to create a account with your key. authorize or cancel her’).
  3. Now go to your flipper, choose ‘U2F’. Maybe the app complains ‘already connected, please disconnect first’. This happens when the Flipper is connected with qFlipper, for example.
  4. The site is waiting for confirmation. On the Flipper display you’ll see ‘(o) OK’. With a click at the middle button you are confirming you are physically available.

“Registration completed!” If you come to this point with a youbikey, some information will be provided. But the Flipper is not giving this extended information, right now. ‘Device not verified, Unknown device’ is fine at this point.

Click on the button [Authenticate].

  1. Part 2/2: Authentication
    Click on the button [Next]
  2. Again on the Flipper display ‘OK’ will appear, again with a click on the middle button you’ll confirm you are physically present.
  3. With the dropdown ‘Show technical details’ you’ll even able to see what the server and the Flipper are talking about.

In my experience, most errors are based on
a. timing. Not fast enough → Timeout
b. Forget to press the button. → Error/Timeout/whatever

The ‘Playground’ isn’t a part of the test. You need a Yubikey account to play around with the other kids. But this is a story for another time.