Canonical has added hardware-bound API tokens to Launchpad, where Ubuntu packages, PPAs and a lot of code get built.
Until now, tools like lp-shell and ubuntu-archive-tools logged in with a saved token, usually a text file or something in the keyring. If malware stole it, it could act as you. For package uploaders, that’s a juicy target.
How it works
- The stored token gets replaced with a long-lived OAuth refresh grant that’s useless without your physical FIDO2 key.
- To log in you touch the key and enter its PIN. That gives you a short-lived token for normal requests.
- Malware on a logged-in machine could still use that short-lived token while it lasts, but it can’t mint a new one.
My take
After all the supply-chain hits this year, this is exactly where hardware keys belong. It’s opt-in, but if you upload anything to Launchpad, turn it on. I wrote a quick how-to on using a FIDO2 key for SSH in this same batch.
God Bless, and Happy hacking!
