FIDO2 security keys on GrapheneOS: a summary

DeletedUser370

DeletedUser370 Registration with passkeys stored on security keys currently only works with a few services.

Update on this: you can now use Brave or Chrome on GrapheneOS to register passkeys on your security key. There are no settings changes needed. The correct dialog will be shown when you attempt to register a passkey within these browsers.

It's currently not possible on Vanadium – or at least, I am not able to do it without changing a specific flag in chrome://flags, which I don't recommend because it will cause crashes in other passkey functionality within Vanadium.

DeletedUser370

Looks like Android 15 (or at least 15 QPR1)* will support selecting between either roaming or on-device authenticators when authenticating. In English that means: when signing in to a service, you will be able to select between using either a passkey in your password manager or a passkey on a device such as a security key. That means you can store one passkey for a service in your password manager, and another passkey for the same service on your security key, and conveniently select between either of them.

This might be a niche feature, but there are cases where this is useful. For instance, your workplace might use a Microsoft account and require you to store a passkey for it on a dedicated security key (disallowing password managers) – but you might prefer to have the passkey for your private Microsoft account stored in your personal password manager. With Android 14, in such a case you would have to temporarily disable autofill with your password manager in order to sign in with the security key.

*At least, this is how Android 15 on the stock PixelOS currently behaves.

DeletedUser370

DeletedUser370 Therefore, for most services, you will have to register the passkey from a different operating system.

Update to this: You can currently use Brave – but no longer Chrome; they appear to have removed the option to do so – to register your passkeys. You can do it in Vanadium, but it requires changing a browser flag. If you want to use Vanadium for this, you should undo the flag after registering the passkey, as it will cause issues with password manager autofill.

In Vanadium, go to chrome://flags
Locate the option called "Android Credential Management for passkeys" and set it to Disabled
Exit and relaunch Vanadium
Reset the flag to Default after registering your passkey(s) (optional but recommended)

I plan to update this guide after having tested security key functionality on GrapheneOS based on AOSP 15.

DeletedUser370

Starting with Vanadium 129.0.6668.54, in order to use passkeys on a security key while retaining password autofill in the browser with a third-party* password manager, the following has to be done:
[Warning: this involves changing experimental settings and is not supported. If you experience browser issues, revert this setting to its default. This will also disable passkey autofill with a third-party passkey manager].

Enter the following into the address bar, which will take you to an entry called "Android Credential Management for passkeys": chrome://flags/#web-authentication-android-credential-management
Set the flag to 'Disabled' and then restart Vanadium

Note for future readers: this is subject to change in the future and might not be applicable at the time you're reading this.

*Meaning any password manager you install yourself, such as Proton Pass and Bitwarden.

DeletedUser370

I have updated the guide/text on FIDO security key functionality on GrapheneOS: https://gist.github.com/FID02/48f5130c2151b6d10a04bdfda0cb1c90
Appreciate any comments or corrections.

A gist allows me to update it continuously and avoids people having to scroll this thread for the latest updates. I have added several other notes to the gist which might be useful when troubleshooting issues. My original post in this thread is out of date and a lot of the info is now incorrect.

If any mod is reading this, I would appreciate if the original post was edited and the URL to the gist added to the beginning of the post.

other8026

DeletedUser370 If any mod is reading this, I would appreciate if the original post was edited and the URL to the gist added to the beginning of the post.

Done.

AelwennBZH

PIN creation and entry
This works fine.

That's where I get stuck.
Ente, Standard Notes and Proton apps ask me my pin code as a second factor (USB is required on the tablet), I enter it, and the same window reappears to ask me for it a second time, then error. Impossible to connect.
On my phone it works fine, because it's NFC, but if I try USB too, I get the same problem. I can't validate the pin code.
The only way I have at the moment is to deactivate fido2 on windows yubikey manager, but this dependence on windows is problematic and it just solve the problem about MFA, not passwordless sign-in.

Otherwise the key works well with porkbun on vanadium, for example, which doesn't ask for the code.

DeletedUser87

AelwennBZH do you have Yubico Authenticator installed on that tablet? We found out that sometimes the app is required to be installed for FIDO functionality, for whatever reason. If you didn't have it installed, try that maybe.

DeletedUser370

AelwennBZH Ente, Standard Notes and Proton apps ask me my pin code as a second factor (USB is required on the tablet), I enter it, and the same window reappears to ask me for it a second time, then error. Impossible to connect.

Grant Play services the network permission and reboot your device.

AelwennBZH

DeletedUser87

Yes, the yubico app was already installed, both on phone and tablet.
When I saw that it wasn't working, I open it with my yubikey and tried the pin code : It works inside yubico app.
I've just reinstalled yubico to test, restarted my phone. Still the same problem: I'm asked for the pin code twice and the sign-in failed...

If the yubico authenticator application also allowed you to deactivate and reactivate the key protocols, like yubico manager on windows, that would partially solve my problem, but I don't know if that's planned.

DeletedUser87

AelwennBZH that's unfortunate. May be a problem with Play Services? I'm not really sure. @DeletedUser370 is a lot more knowledgeable on that matter, so hopefully they can chime in soon.

AelwennBZH

DeletedUser87

May be a problem with Play Services?

Maybe, since without pin code, it works fine. My phone/tablet and apps are up to date, so if it was coming from there, I guess the problem would affect everyone, at least on GrapheneOS.

It's really frustrating that fido/passkey integration is so bad on android, even though google is very involved in the field...
it just makes me want to throw away my keys and give up on 2FA.

trilogy6202

AelwennBZH I completely agree. I haven't invested in HW keys because the solution on Android (at least on GOS) seams so flaky and volatile.

AelwennBZH

trilogy6202

I've registered my keys with a dozen services.
Everything works on Windows. But I had to register again my key on half of these services because on android, some apps or websites, I had to explicitly disable the fido2 protocol and only use fido U2F just to register the key.
GitHub and Bitwarden works with Fido2, but Standard Notes and Proton works only with Fido U2F.
It's not uniform at all. Fido is really a huge improvement in security, but it's currently discouraging.

trilogy6202

AelwennBZH And it's really sad that fido2 and Fido u2f isn't part of AOSP but requires gps. I don't use gps on my main profile so it's not really an option for me until it's included in AOSP or GOS makes their own implementation which I assume is pretty unlikely to happen.

AelwennBZH

trilogy6202

https://gist.github.com/FID02/48f5130c2151b6d10a04bdfda0cb1c90#user-content-fn-2-b5ffcad6ab91d3f1c1b323c46b15ec23

This is planned, but no ETA.
However, if google makes a "bad" implementation right now, I wonder if integrating directly on AOSP will change anything....

trilogy6202

AelwennBZH Thanks I wasn't aware of that. I don't expect anything in the near future however.

AelwennBZH

DeletedUser370

Play services already have network permission, on the tablet and on the phone.
I've revoked then restored, rebooted, still the same problem.

GrapheneOS

AelwennBZH Play Store needs it rather than Play services for it to fetch the dynamite module for FIDO2.

AelwennBZH

GrapheneOS

Yup, but both Play store and play services have network permission, from the beginning.
But it's possible that I'm just unlucky and that the pin code works for other people. Random bug maybe.
I've got a third device I can test, so I'll see.