2FA suddenly stopped working on one of the profiles

L3m0n3K

Hi,

This is my first post on the forum, so first of all I would like to thank the developers for the operating system, I am a user of it for the past 2-3 years and I am loving it!

Regarding the topic - I am using Bitwarden with Yubico (2FA WebAuthn done through Vanadium). I have Bitwarden installed on two profiles - main (degoogled) and the one I call Google (googled). I suddenly started getting errors on the main profile: An error has occurred. Two-step token is invalid. Try again. The error is somehow not happening on the googled profile.

I read on the topic a bit and most posts point to the device time issue. I have tried the following things:

disable "set time automatically" in System -> Date and Time with various combinations of e.g. setting the incorrect time and then checking whether it will adjust;
clear Bitwarden, Vanadium and Clock app cache;
reinstall different versions of Bitwarden (f-droid one, stable and beta releases available on github).
Unfortunately none of them have ended with success.

I am a bit lost as there must be some difference between the main and "google" profile, but I simply can't find it. Time settings seem to be the same, at least judging by the Clock app and whatever is in System -> Date and Time.

Do any of you have an idea on how to fix, or have some ideas towards what else might be going wrong?

Best wishes,
Mateusz

[EDIT] I also normally use VPN, however I tried logging in with and without it as well. The VPN server that I am using is located in my home country, so I believe that it shouldn't be negatively affecting the process, but thought that it might be worth mentioning it as well

DeletedUser87

L3m0n3K it is a bit unclear, what you mean. Just to clarify, are you trying to log in to Bitwarden by using the YubiKey as a second factor? In that case I'm surprised you got that far - WebAuthn doesn't even work for me.
Just by chance, did you install Bitwarden through Google Play/Aurora Store?

L3m0n3K

DeletedUser87 Correct. I am actually using Obtainium for installing most applications. It is an app that is effectively looking at github pages and tracking applications' releases. I highly recommend it:) In any case, WebAuthn authorization is correctly "triggered" (and it has been this way for the past 2+ years). It is just that recently I started getting the An error has occurred. Two-step token is invalid. Try again. error on the main profile, but not the googled one, where the authorization process is working as expected

DeletedUser87

L3m0n3K well, that is most likely because WebAuthn is reliant on Google libraries. See for example here or here or here. So the answer is: FIDO/WebAuthn doesn't work without Play Services. I have no idea how it worked for you previously, maybe the recent overhaul of Bitwarden broke it. I personally just use TOTP to log in to Bitwarden with my YubiKey and call it a day.

L3m0n3K

DeletedUser87 Sure, I am aware of that. Sorry, maybe I should have been more explicit in the previous response. I have sandboxed google play installed on the main profile, per the article here, and had them installed for a long time exactly for WebAuthn purposes

DeletedUser87

L3m0n3K oookay, that's an entirely different story then. Do you use the "classic" Bitwarden app (MAUI based) or the new "native" one? I just tried FIDO login on my google-profile and had to allow Google Play Services access to my Yubikey when I plugged it in. I guess you tried clearing cache and storage for Play Services on your main profile?

L3m0n3K

I tried clearing the cache for Play Services in the main profile without success, but eventually managed to fix it using a different method! I somehow haven't seen this topic earlier and a couple of solutions are suggested there which I haven't tried before, most importantly the network permission that is given to Google Play Services. What eventually worked was:

grant network permission for Gogle Play Services;
login to Bitwarden, "native" app (it worked);
disable network permission;
logout and login to Bitwarden again (it now works!).

I am not sure what caused this, but maybe there was some update to Google Play Services or one of its services that required this operation? Not sure. In any case, if anyone encounters such a problem, refer to the above topic or the steps explained above.

Thanks a lot @DeletedUser87 for quick replies and willingness to help:)

Best wishes,
Mateusz

DeletedUser87

L3m0n3K yeah, that sounds like a fix. Iirc the Play Services have some kind of time based token or something that can run out after a while if it doesn't get renewed! I'm glad you fixed it!

fid02

L3m0n3K grant network permission for Gogle Play Services;

I was just going to ask you to check this but I refreshed the page and saw that you had already resolved it. 👍