News about Fido2 compatibility?

I have many OnlyKeys myself and also gave many away. But I would rather use the OnlyKey Duo on a cell phone instead of OnlyKey in the OTG adapter.

I have always used Onlykey in Firefox. No idea if it works in vanadium.

OT: I'm excited about the OnlyKey Pro (currently in early development), which offers encrypted storage, quantum-resistant encryption, and a built-in password manager with nearly unlimited storage. :-)

boldsuck yes it works in vanadium, but only with play services enabled. OP's question was about compatibility WITHOUT play services, which is a query I'm also invested in, webauthn compatibility without play services is at the top of my GOS wishlist. But I imagine it's probably far from trivial to implement.

Your reply looks like an advertisement

dirksche Firefox uses the Google Play FIDO library, which requires sandboxed Google Play, like Vanadium.

dirksche FIDO2 works fine without sandboxed Google Play in apps using a library which doesn't depend on Google Play for it. https://github.com/cotechde/fido-browser is a WebView-based browser providing this but they stopped maintaining it.

So what's the difference between onlyley and yubikey? I was thinking of getting a yubikey for keepassDX.

dirksche You can't go wrong with a Yubikey. As far as I know, it has the highest compatibility with the various services.

YubiKeys don't support firmware updates, so you're stuck with whatever firmware (and bugs/exploits) the device shipped with. Next to preferring Open Source it's my main reason not to go with a YubiKey.

Regarding OP it looks like you're out of luck as currently OnlyKeys won't work for your use case. You could create a user profile with Sandboxed Play Services exclusively for the apps and websites you use with your OnlyKey, but I guess it's not a good solution for you (it wouldn't be what I want at least)...

To prevent attacks on the YubiKey which might compromise its security, the YubiKey does not permit its firmware to be accessed or altered.

https://support.yubico.com/hc/en-us/articles/360013708760-YubiKey-Firmware-Is-Not-Upgradeable

boldsuck can’t seem to find any info about this so called OnlyKey Pro that isn’t just wish lists on forums. Do you have an official link, or failing that a semi credible rumour of its existence?

mmmm https://onlykey.discourse.group/t/onlykeys-future/1221/2?u=mango_mungo
But that will take some time (possibly 1-2 years), Onlykey is a small 3-man Kickstarter project.

dirksche I don't know if I understood the question, but you can use one key on multiple devices.

I've never used Paypal, but many sites have a similar 2FA/MFA setup:
(Important: With 2FA there is no option like password reset! That's why a backup is always necessary on 2 or more hardware keys or an OTP APP).

1. Enable TOTP (often called 'Google Authenticator' in instructions)
2. Generate recovery-codes. Which you have to save safely!
3. Then you can add U2F and or WebAuthn/FIDO2 devices.

I can only say what is most practical for me. A hardware key in every laptop and an OTP app on the phones.
andOTP is unfortunately no longer being developed further. Some users in this forum use Aegis and FreeOTP+.
We recently had a thread about hardware keys and the difficulty of using them without Play Services.

I would also love to see GOS incorporate a FIDO2 library into Vanadium for security key use. Currently, I use my yubikey to unlock keepass2android and as a TOTP method, but being able to use the FIDO/Webauthen without GPS would be amazing.