Passkey login to OpenWRT router...?

Installing and Using OpenWrt
1

Hi. Is there way way to add passkey login to OpenWRT router...?

Not this forum site the router itself.

I am writing the password far too often. I would want to avoid putting critical password like this to a password manager but I could very well save passkey to Windows PC TPM if it was possible. AI claimed that some oauth tokens might be possible but they are not as secure as passkey as they can be stolen.

If not is this feature in planning or do you think it is good or bad idea...?

Worth noting is that I am not sure if I would want to have that passkey as syncable passkey in google password manager, icloud chain or even MS manager, but non-syncable passkey directly in security chip (or security USB key if that's your thing) feels more secure.

2

Unless your router is x86_64 (or OO, or some ARM SBCs), it doesn't work. All these fancy 2FA mechanisms depend on all devices having roughly the correct system time, but your off the mill plastic router doesn't come with a battery backed RTC, which means the system time can be vastly (months/ years) off, until a WAN connection can be established (NTP) - but you can't rely on WAN to function, just to log in. Another topic for all these fancy gizmos would be installed size (and that of their dependencies), most routers are still very flash constrained.

tl;dr: doesn't work.

3

I can't follow you. That's exactly the purpose of a password manager.

4

Do you mean GUI?

I know that this is not answer foru your question, but when connecting by ssh you can use ssh keys, so password is not needed.

5

For LuCI specifically, I would not expect passkeys/WebAuthn to be a simple add-on today. It needs server-side support in the web UI, and on small routers the time/flash constraints mentioned above can make these auth features awkward.

A practical middle ground is: use a long unique router password in a password manager, keep LuCI reachable only from LAN or VPN, and use SSH keys for shell access. If you want hardware-backed auth, an SSH key stored on a security key is probably the closest fit right now.