Add FIDO2 / Hardware Key (YubiKey, MetaMask Metal Card) Login Support for MetaMask Extension

What is this about?

I would like MetaMask to support logging in or unlocking with FIDO2 / WebAuthn hardware security keys such as YubiKey or the MetaMask Metal Card.
This would allow users to add a physical security factor or even log in passwordlessly if they choose.
It would make MetaMask safer against password theft, keyloggers, and unauthorized access on shared or compromised devices.

Scenario

As a MetaMask user on Windows Chrome or mobile,
I want to use my hardware security key (e.g., YubiKey or MetaMask Metal Card)
so that I can securely unlock my wallet using a trusted physical device,
and optionally choose a passwordless unlock flow for faster access.

Design

Users could enable this feature optionally in settings:

• Add a toggle like “Enable hardware key unlock.”
• Allow using the hardware key together with or instead of a password.
• On mobile, NFC-based keys like the MetaMask Metal Card could be tapped for authentication.
  The overall design should remain simple, optional, and non-intrusive.

Technical Details

Implementation could rely on the WebAuthn / FIDO2 standard,
which is already supported in major browsers (Chrome, Edge, Firefox, Safari).
No change to MetaMask’s non-custodial nature is required — the feature would simply add an extra or alternative unlock layer handled locally.
MetaMask Metal Card’s FIDO2 compatibility could make this integration straightforward across desktop and mobile NFC.

Threat Modeling Framework

Implementing a FIDO2 / hardware key unlock feature introduces new authentication flows, so it should be evaluated through a basic threat modeling framework.

Objective:
Identify potential risks, attack surfaces, and mitigations related to the new hardware-key login functionality.

Key Considerations:

• Assets: User private keys, session unlock state, and hardware key credentials.
• Actors: Legitimate users, malicious local users (with device access), remote attackers, and malware.
• Potential Threats:
  • Theft or loss of the registered hardware key.
  • Unauthorized local access if hardware key is left inserted or paired.
  • Replay or spoofing attempts on the WebAuthn/FIDO2 flow.
  • Phishing or fake MetaMask extension mimicking the login screen.
• Mitigations:
  • Mandatory seed-phrase backup and multiple key registration.
  • Hardware attestation and PIN/biometric support where possible.
  • Clear UI warnings and secure recovery workflows.
  • Encourage users to store backup keys in separate, safe locations.

Conclusion:
A structured threat modeling review (e.g., STRIDE or PASTA-based) should accompany implementation to ensure that the hardware-key unlock feature strengthens MetaMask’s overall security posture rather than introducing new vulnerabilities.

Acceptance Criteria

• Users can optionally enable “Hardware key unlock.”
• Unlocking can require the physical key (YubiKey or MetaMask Metal Card).
• Passwordless (key-only) mode can be offered as an optional setting.
• Works on both desktop (USB) and mobile (NFC).
• Does not affect the seed phrase or wallet storage model.
• Maintains current security best practices and user-friendly flow.

Stakeholder review needed before the work gets merged

• Engineering (needed in most cases)
• Design
• Product
• QA (automation tests are required to pass before merging PRs but not all changes are covered by automation tests - please review if QA is needed beyond automation tests)
• Security
• Legal
• Marketing
• Management (please specify)
• Other (please specify)

References

No response

No implementation files, entry points, or tests are identified. Start by reviewing the existing unlock and wallet-storage flows, then assess the WebAuthn/FIDO2 desktop and mobile requirements and the proposed threat model; done means a scoped design and validated acceptance criteria for hardware-key registration, recovery, and unlocking.