I currently use keepass2android and KeepassXC (linux & mac) with a yubikey challenge-response as a hardware factor. I'm worried about the long-term viability of this setup, which I think is an ideal way to have hardware-factor security on all three platforms without relying on internet access or a private company.
Problem:
HMAC-SHA1 challenge-response with a YubiKey currently requires the external ykDroid app. ykDroid was last updated in 2023 and is unmaintained afaik. With Google's upcoming verified-developer rules, which requires developer government-ID verification, an abandoned app like ykDroid is supposed to become (nearly) uninstallable in a couple months. That would break challenge-response unlock for everyone relying on it.
Possible solution:
Replace the ykdroid dependency with direct use of the official yubikit-android library. YubiOtpSession.calculateHmacSha1(slot, challenge, state) does exactly what ykDroid returns today. The desktop KeepassXC app uses the driver provided by yubico.
I understand this is not trivial because yubikit-android is Java, so it would require some sort of binding like you have for Dropbox.
I don't know any of the languages involved, but I volunteer to test stuff (with a google pixel 10 and yubikey 5C NFC), and I'll donate more Oktoberfest beers. Thank you for your work on this essential app.
I currently use keepass2android and KeepassXC (linux & mac) with a yubikey challenge-response as a hardware factor. I'm worried about the long-term viability of this setup, which I think is an ideal way to have hardware-factor security on all three platforms without relying on internet access or a private company.
Problem:
HMAC-SHA1 challenge-response with a YubiKey currently requires the external ykDroid app. ykDroid was last updated in 2023 and is unmaintained afaik. With Google's upcoming verified-developer rules, which requires developer government-ID verification, an abandoned app like ykDroid is supposed to become (nearly) uninstallable in a couple months. That would break challenge-response unlock for everyone relying on it.
Possible solution:
Replace the ykdroid dependency with direct use of the official yubikit-android library. YubiOtpSession.calculateHmacSha1(slot, challenge, state) does exactly what ykDroid returns today. The desktop KeepassXC app uses the driver provided by yubico.
I understand this is not trivial because yubikit-android is Java, so it would require some sort of binding like you have for Dropbox.
I don't know any of the languages involved, but I volunteer to test stuff (with a google pixel 10 and yubikey 5C NFC), and I'll donate more Oktoberfest beers. Thank you for your work on this essential app.