Feature request: Support for Passkey (WebAuthn) authentication in LuCI #8273
Description
What would you like to see in luci?
Description
I would like to propose adding support for Passkey (WebAuthn) authentication to the LuCI web interface.
Motivation
Currently, LuCI primarily relies on traditional username/password authentication. As the central gateway of a network, an OpenWrt router is a high-value target. Relying solely on passwords poses several risks:
- Brute-force attacks: Even with strong passwords, HTTP interfaces are often targets for automated cracking attempts.
- Credential theft: Passwords can be phished or leaked.
- Complexity vs. Security: Users often choose weak passwords to make it easier to log in from mobile devices.
Proposed Solution
Implementing WebAuthn support would allow users to log in using Passkeys (TouchID, FaceID, Windows Hello, or hardware keys like YubiKey). This would provide:
- Phishing resistance: WebAuthn is inherently secure against phishing.
- Improved Security: Eliminates the risk of brute-force attacks on the web interface.
- Better UX: Faster and more secure login experience across devices without typing long passwords.
Additional Context
Since LuCI is a critical component, modernizing its authentication mechanism aligns with the industry trend toward passwordless security. I'd like to start a discussion on the technical feasibility and whether this should be implemented as a core feature or an optional luci-app.
What are your thoughts on this?