Stolen API tokens just got a lot less useful

Canonical adds FIDO2 hardware key support to Launchpad

Developers who use Launchpad can now use a USB FIDO2 security key to restrict API access, which makes any stolen login details useless without it.

Launchpad is, as I’m sure you know, where Canonical builds Ubuntu’s package, hosts code, PPAs and many other things that end up on a users’ system.

Developer tools, like lp-shell and ubuntu-archive-tools, log in with a saved token, normally kept as a text file or in the desktop keyring on the developer’s machine. Anyone who gets hold of it, malware included, could act as them, with the permissions it carries.

Canonical’s Jürgen Gmach says “for most people that is an acceptable risk”. For core distro dev, engineers and package uploaders? Well, they have more to lose and could become a ‘tempting target’ for bad actors (not the Tommy Wiseau kind).

Which is why Launchpad has added support for hardware-bound API tokens.

These replace the stored token with “a long-lived OAuth refresh grant” that can’t do much without the physical security key attached. Logging in requires touching the key and entering its pin. This issues a short-lived token for everyday requests.

The key protects the stored grant, so malware that ran with the developer logged in could still use any short-lived token for its (brief) lifetime, but it wouldn’t be able to request a new one.

Developers wanting to opt-in will need a supported device (only USB keys are supported; NFC keys and passkeys stored on a device are not) and the python3-fido2 package installed.

Full setup details are listed in the launchpadlib docs.