Updating FIDO U2F to WebAuthn

Back in 2018 I published a post on adding support for FIDO U2F second factor authentication to a flask application. At the time, FIDO U2F was a relatively new technology and, based in part on its development, work had already begun on a new standard. The Web Authentication (WebAuthn) proposal had been published as a draft in 2016 and reached the recommendation standard by 2019.

I recently revisited a project that included FIDO U2F support and realised that the packages I used in the original post were no longer supported with WebAuthn recommended as the successor.

When first searching for alternative packages I found this site and the associated python package. I then paired this with SimpleWebAuthn on the frontend. Unfortunately I was only able to get registering the device to work with this combination and the actual authentication failed.

A major driver between the switch from FIDO U2F to WebAuthn has been a desire to support alternative devices such as the fingerprint scanners on many laptops and phones. Although the demo on webauthn.io works with my device I was unable to create a working implementation. I suspect I may simply have some incompatible settings but I switched to the FIDO2 server implementation from Yubico and quickly had a working solution.

The code created in the original blog post has now been updated and can be found in the github repository.

Post a comment ...

An improved pre-clinical model of sepsis incorporating vasopressor support

A new article was recently published that I participated in during my time at NIH. The study was led by Tetsushi Yamashita and focuses on changes in blood pressure and heart rate during sepsis. Unlike previous articles that focused on the pathways involved in the progression of sepsis this study examined some of the treatment options that are typically used in patients.

Although this study built on our knowledge of the complex response to sepsis it also developed an existing mouse model of sepsis closer to what humans might experience during routine care. The more accurately our models can simulate human disease the more likely we are to successfully translate therapies from mice into humans.

Mice are widely used as models of disease including kidney disease and sepsis despite differences between these mouse models and humans. There are a variety of reasons for these differences with medical care being one we can reduce.

When sepsis is diagnosed common medical treatments include giving fluids, antibiotics and vasopressors such as norepinephrine (also called noradrenaline in the UK) to treat low blood pressure. Each of these treatments alter disease progression in humans but are relatively new developments in mouse models. Our lab had a long history of using fluids and antibiotics but vasopressors were not used.

The reason for this is simple: their use is technically very challenging. While fluids and antibiotics can be administered intermittently and via common injection routes vasopressors would need to be administered:

  1. directly into a vein
  2. continuously
  3. and with careful monitoring

The experimental procedures necessary for this model were first brought together by Brianna Halasa and then finalised when Tetsushi joined the lab. Each mouse undergoes approximately one hour of surgery in which the jugular vein is catheterised to enable the infusion of a vasopressor and then the carotid artery is catheterised to implant a pressure transducer to monitor blood pressure. Although the exact procedures are slightly different these videos demonstrate the jugular vein and carotid artery catheterisations. Only when the mice have recovered does the more usual sepsis model surgeries begin.

I would like to congratulate Tetsushi on publishing this study. If you are interested in learning more the complete article is now freely available in PLoS One.

Predicting progression in acute kidney injury

Last month the final study from my time at NIH was published. This study explored a promising, and relatively new, biomarker for acute kidney injury during critical illness. Although the biomarker had been previously tested in humans we were able to develop a potential refinement in a preclinical model.

During critical illness, such as sepsis, organ failure is a major complication increasing the risk of death. For the kidneys, treatment is limited to more focused management. This means avoiding further harm and keeping the patient alive long enough for kidney function to return.

The sooner kidney injury is detected the better the likely outcome but this can be surprisingly difficult. Some significantly improved options have been developed but further, even better, options are still desired. A new approach is giving the kidney something to do and measuring how well it performs. This idea is similar to the treadmill stress test commonly used to detect cardiovascular disease such as angina.

The test that was developed gave a dose of a drug called furosemide that is actively excreted by the kidneys and stimulates urine production. If the kidneys are healthy, the furosemide will be excreted and the amount of urine produced will increase. In a human clinical study this approach performed very well and there have been several subsequent studies in different settings.

Urine volume is altered by a variety of factors and we decided to investigate whether further improvements in performance would be possible by measuring furosemide excretion directly. When used in ideal conditions results were comparable. However, when we gave a drug called vasopressin that is commonly used to manage blood pressure during critical illness measuring urine volume gave erroneous results while furosemide excretion remained reliable.

The study is published in Critical Care Explorations and is freely available.

Circadian rhythm and variation in small extracellular vesicles

Exosomes have been an ongoing interest for several years. Beginning with my PhD in Edinburgh and continuing in my current position I have published several articles on exosomes. The field is also maturing with a growing appreciation for the complexities of exosomes and related vesicles. Exosomes are formed and released by a specific mechanism from cells. Once released exosomes are difficult to distinguish from other sources of similar vesicles. In many experimental settings it would be difficult to confirm an exosomal origin. To reflect this uncertainty the use of the term small extracellular vesicles was suggested following a broad consultation by the International Society for Extracellular vesicles.

We have recently published an article on two related investigations:

  1. the circadian pattern of small extracellular vesicle release in the urine
  2. possible methods for normalizing biomarkers derived from small extracellular vesicles

Circadian patterns, or rhythms, are natural oscillations in biological processes that repeat roughly every 24 hours. They are widely seen in biological systems but little is known about variations in exosome, or small extracellular vesicle, release. A circadian rhythm is just one source of variation that may contribute to the wide variability seen in biomarker studies of small extracellular vesicles. In this article we suggest that normalization by small extracellular vesicle number may help correct for some of the variability encountered.

Cryptography talk at DC Python

At the April meeting of DC Python I gave a talk on cryptography. A video of the event is now available on youtube.

DC Python is the local user group for the python programming language in the Washington, D.C., Maryland, and Northern Virginia area. I have been hosting a monthly event called Project Night with the group since 2015 and we have recently restarted a monthly talk event. All events can be seen on our meetup page.

My presentation was a summary of two of my recent posts on two factor authentication and partial passwords with an introduction to using cryptography in python.

The other presentation was given by Alan Swenson on JSON web tokens in flask. The video for his talk is also available.