There are plenty of fingerprint readers on the market, doesn't really excite me because it just makes it 2-in-1.
What does excite me? Smart rings like https://store.nfcring.com/products/omni
What does excite me? Smart rings like https://store.nfcring.com/products/omni
- It's a Type B card, and apparently most devices refuse to operate with Type B cards as FIDO2 authenticators: https://github.com/LedgerHQ/ledger-u2f-javacard/issues/12
- I'd otherwise like to use it as a GPG card, but it's unclear if NFC-only GPG cards work with desktop gnupg. Maybe they do and I'm just missing the documentation for it.
If you mean this applet
https://developers.yubico.com/ykneo-openpgp/Releases
then it would work just fine, you just need a proper contactless PC/SC reader. I don't have this ring, but I did use a smartcard with the applet to login to a server via the phone with
https://play.google.com/store/apps/details?id=org.sufficient...
I'm aware that's what Android apps like OpenKeychain do, but I haven't been able to find much information on how gnupg/pinentry/etc behave with contactless cards.
> is gnupg aware of contactless readers and will it e.g. ask for your PIN without the card being present and then prompt you to tap the card?
No, it will behave as if there's no card/ring if you don't have it around the reader. Software polish is a weak point, e.g things like `ssh-add -s /usr/lib/opensc-pkcs11.so` can be used to 'cache' the PIN for a session as far as `ssh -A` connection is concerned, but that's not exactly the height of usability.
Thanks for the info!
EDIT: It seems like requesting a decryption, removing/inserting a Yubikey while the pinentry screen is up, then entering the PIN does not work. I suppose I've broken the session then. So I'm guessing to use a ring form-factor card, I'd have to keep the ring above the reader during the whole operation, which means I'd have to remove it to place on the reader and can't just keep it on/tap when needed.
Hm. That's a bit unfortunate.
(Also possible the Yubikey behaves differently as it's both reader and card in one... I don't have a dedicated reader set up to test with at the moment.)
EDIT 2: For anyone who comes across this later: no, a dedicated reader behaves the same way; once the pinentry prompt is open, you can't remove the card and reinsert without invalidating that request.
Research before you buy, don't look for NFC, looks for contactless PC/SC
I was about to press the Buy button for the McLear payment-enabled ring priced at £89.99
https://mclear.com/product/payment-ring/#
but paused for thought after reading the terms and conditions (it's a PrePay Visa account) and finding this gem:
"Your McLEAR Product(s) will be valid for 24 months from date of registration, after which your Product(s) will no longer be able to make contactless payments or have any funds available into your Account."
and less severe but annoying opt-out not opt-in:
"You can tell us if you don’t want to receive any marketing materials from us in accordance with the GDPR 2018, by emailing dpo@mclear.com."
https://www.instructables.com/RFID-NFC-Tap-and-Go-Ring-for-C...
That 'daring route' looks like an ideal project for our maker-space -thanks!
The selling point here isn't 'yet another external fingerprint reader', it's 'portable fingerprint-authenticated OpenPGP smart card'.
My main point though was that it's not a device-specific authentication, or even an external reader for unlocking a secret provisioned onto one or many devices, it is the sole thing needed, so you can walk up to a new device and use it without provisioning it with secrets.
An OpenPGP one would be cool though - replace passphrase with fingerprint.