On Linux, SSH keys and other secrets are traditionally stored on the computer's disk as regular files (like in ~/.ssh/). While easy to use, file based keys are passive, any malicious npm package or background malware can read those files and copy them without you knowing. Hardware security keys like YubiKeys fix this with physical touch, but they add extra cost, require carrying a dedicated dongle, and lack a screen leaving you to blindly tap a metal button without knowing what service or domain is actually asking for access.
uKey offers an alternative to a dedicated hardware key by using something you already carry, your Android phone. It connects your phone to your computer over a regular USB cable or your local Wi-Fi, without using the internet or any cloud servers. The operating system treats your phone as a genuine FIDO2 security key. The private key stays locked inside your phone's built-in security chip, and the phone screen shows you the requesting service or domain before you scan your fingerprint.
In this talk, I will share the journey of building uKey and the challenges I ran into along the way. I'll walk through how I got Linux to recognize the phone as a real hardware device, the bugs I faced when the phone went to sleep or disconnected, and how I designed the pairing flow so random devices on your network can't connect. I'll also share what I learned about getting Android's fingerprint prompt to reliably guard the hardware security chip.
The talk also includes a live demo. I'll show the whole setup working live: connecting the phone, having the computer recognize it as a FIDO2 security key, and approving an authentication prompt (like sudo or SSH) in real time with a quick fingerprint scan on the phone.