FIDO2 / U2F / Yubikey error

monotype-uselessly-credibly

I have installed recently GrapeheneOS for first time. Prob not very relevant but my device is a Pixel 7.

I have a couple of Yubikeys, one of them Yubikey 5 NFC, that I use to login ie in GitHub from Vanadium browser.

I can login to GitHub
(1) with username/password and U2F (in Yubikey) as 2FA. Please, see screenshot while trying to login, https://imgur.com/a/fCNWyUR
(2) or with passkey (without user/password) also stored inside my Yubikey. Please see attached screenshot login by passkey: https://imgur.com/a/JffLtMw

To isolate problems right now I'm using my Yubikey plugged directly to phone by USB, although I could use NFC. Once I see that it works by USB I will try NFC.

But the U2F and FIDO2 passkey seem not to be working. Please, have a look to attached screenshots.

Similar issue I have when I try to signin in Proton-Calendar app using my Yubikey U2F as 2FA. I am getting the warning "An error occurred". I think this error is very related to login in GitHub

Please, see my sandboxed Play Services settings, https://imgur.com/a/Krhzphm
and my Vanadium settings, https://imgur.com/a/9WW8Q11

PS: I can use Yubico-Authenticator app in GrapheneOS with no issues. In this app I can list the passkeys I have stored in. Among them I can see the GitHub passkey.

Thanks

fid02

monotype-uselessly-credibly
DeletedUser43

I have written a draft for a text to summarise FIDO compatibility with Sandboxed Google Play. Please see the sections titled "Signing in with passkeys". And "Other notes" contains a note on NFC and network access for Play services. See if they help: https://gist.github.com/FID02/48f5130c2151b6d10a04bdfda0cb1c90

DeletedUser43

monotype-uselessly-credibly Do you have Google Play installed and active?

DeletedUser43

I have exactly the same problem, and I've been using USB to work around it as well.

monotype-uselessly-credibly

DeletedUser43 But are u able to use U2F or passkeys by USB? because I can neither via USB nor via NFT.
Maybe you can give me some hints on how to enable it at least for USB.

DeletedUser43

monotype-uselessly-credibly Sorry, I misread your message.
Github is asking me for "use security key", you're getting asked for "use passkey".
After I click on "use security key", Google Services popup says "No passkeys available", then I click "Use a different device", then "USB security key" ("NFC security key" doesn't work for me). I just went through this process to confirm.

Do you have passkeys configured on your Github account? (Passkeys are different thing then a standard FIDO challenge I use).

monotype-uselessly-credibly

DeletedUser43 I have configured my GitHub account with passkey (so no user, no password required), and as well with U2F as 2FA after entering user/pwd.

After reading the guide post by fid02 and enabling network permission in Google Play Services I was able to login in GitHub in two ways (passkey and U2F) while my yubikey was plugged to USB connector. But again it is not working, even with network permission assigned to Google Play Services. Later I will give another try.

Be aware, passkeys (so no user, no pass required) normally require a PIN. Based @fid02 guide entering PIN does not work via NFC, so for passkeys you should use only USB, but 2FA UTF should work with NFC.

I can't login in Proton Calendar app, still getting same error warning at 2FA U2F step.

monotype-uselessly-credibly

DeletedUser43 yes, I have. It seem to be important give initially network permission to google-play-services.

fid02

monotype-uselessly-credibly After reading the guide post by fid02 and enabling network permission in Google Play Services I was able to login in GitHub in two ways (passkey and U2F) while my yubikey was plugged to USB connector. But again it is not working, even with network permission assigned to Google Play Services.

Sorry, I don't understand. You were able to sign in to your GitHub account, yet it's still not working? What is not working?

Please try rebooting your device after enabling network permission for Play services if you didn't already do that.

Edit: You can easily test all this stuff by using https://passkey.org/

monotype-uselessly-credibly

fid02 It works once via USB after enabling network permission for google-play-service as u pointed in your guide like magic. But then stop working. Now my yubikey is not detected when it is USB plugged. I have rebooted my phone, I have re-enable network permission to google-play-services multiple times, I have force stop google-play-services, but still not working.

This error is different than before, before somehow the yubikey was detected but the FIDO2 step fails. But now it seems to me that yubikey is not detected at all.

I gonna try passkey.org

This setting in your guide "A third-party autofill service is enabled:" and "chrome://flags" is not required to yubikey, right?

fid02

monotype-uselessly-credibly This setting in your guide "A third-party autofill service is enabled:" and "chrome://flags" is not required to yubikey, right?

My guide intends to be relevant for all types of physical security keys, including Yubikeys. If, in Vanadium, the following dialog pops up when you try to sign in with a passkey, I believe your Vanadium settings are fine: https://ibb.co/44cWRgY
Alt. text: a small dialog showing the text "No passkeys available" with the options "Use a different device" and "OK".

monotype-uselessly-credibly By now, at least for me, it is not very reliable/consistent. But it works now :)

Could you explain what is not reliable? Does the phone sometimes still not detect the Yubikey?

Another user had the issue that their Pixel devices weren't detecting their Yubikey (although a different model). It was apparently solved by installing the Yubico Authenticator app. If your problems persist, perhaps you could try that. Play Store link. GitHub releases link

monotype-uselessly-credibly

This pop-up is not shown anymore, https://imgur.com/a/qBEiZZx

monotype-uselessly-credibly

Today I can login in GitHub from Vanadium with my yubikey passkey, and also with user/pwd + yubikey U2F :)

By now, at least for me, it is not very reliable/consistent. But it works now :)

When I try to login in Proton Calendar app after entering user/pwd I am getting an error warning when I try to use my yubikey for U2F, I will ask to Proton support anyway.

Google Pixels from Pixel 6 come with a Security chip. Is that security chip as secure as using a yubikey for passkeys? Can we use in GrapheneOS such built-in security chip for passkeys? So instead of using my yubikey for signing in GitHub use a passkey stored in Google Security chip? thanks