iButton and U2F: identity is not authentication
Compare a contact key that presents an identifier with a security key that participates in authentication.
Understand it
An iButton uses physical contact rather than an RF link. Supported types differ: a Dallas DS1990 exposes a UID, while some other Dallas devices also contain memory. “iButton” is a form factor and protocol family, not a promise that every key has the same capabilities.
An identifier names a device. Authentication supplies evidence that a party is entitled to act as that identity. A reader that accepts a copied static number has a different security model from one that verifies a cryptographic response.
The Flipper’s U2F app can serve as a second factor for compatible accounts. U2F support is not a promise of every FIDO2 or passwordless feature. Treat a learning device differently from a dedicated everyday security key: use a disposable test account, keep independent recovery methods, and understand what happens when device data is reset.
Lab: build the evidence
-
Use a practice iButton that is not enrolled in a building or workplace. Read its documented model before trying it.
-
Open iButton → Read and make data/ground contact as shown in the manufacturer’s diagram. Save a lab alias and record which fields were actually read. Do not publish real credentials.
-
If your bench includes a compatible standalone training reader, compare the original key with emulation. Otherwise record the reading and explicitly mark emulation as untested.
-
Optional U2F lab: on a disposable account that supports U2F, establish and verify another recovery method first. Close qFlipper, connect USB, open U2F, and follow the service’s security-key registration flow.
-
Sign out and verify a test sign-in, including physical confirmation on the Flipper. Confirm the independent recovery method still exists; remove the test registration when finished.
-
Write a comparison: data read, proof presented, reliance on a reader/service, and what a lost device would mean.
Show that you can do it
- A supported training-key reading, or a documented unsupported result.
- A comparison of a static identifier and cryptographic authentication.
- A recovery plan; optional tests clearly distinguished from completed ones.
Record the result in your learning notebook. Repeat the explanation tomorrow without looking at this page.
Check yourself
Sources
Read the primary sources: Flipper: reading iButton keys · Flipper: U2F authentication. Course review: 10 September 2026.