FIDO2 / U2F / Yubikey error

DeletedUser43

I have exactly the same problem, and I've been using USB to work around it as well.

monotype-uselessly-credibly

DeletedUser43 But are u able to use U2F or passkeys by USB? because I can neither via USB nor via NFT.
Maybe you can give me some hints on how to enable it at least for USB.

DeletedUser370

monotype-uselessly-credibly
DeletedUser43

I have written a draft for a text to summarise FIDO compatibility with Sandboxed Google Play. Please see the sections titled "Signing in with passkeys". And "Other notes" contains a note on NFC and network access for Play services. See if they help: https://gist.github.com/FID02/48f5130c2151b6d10a04bdfda0cb1c90

DeletedUser43

monotype-uselessly-credibly Sorry, I misread your message.
Github is asking me for "use security key", you're getting asked for "use passkey".
After I click on "use security key", Google Services popup says "No passkeys available", then I click "Use a different device", then "USB security key" ("NFC security key" doesn't work for me). I just went through this process to confirm.

Do you have passkeys configured on your Github account? (Passkeys are different thing then a standard FIDO challenge I use).

monotype-uselessly-credibly

DeletedUser43 I have configured my GitHub account with passkey (so no user, no password required), and as well with U2F as 2FA after entering user/pwd.

After reading the guide post by DeletedUser370 and enabling network permission in Google Play Services I was able to login in GitHub in two ways (passkey and U2F) while my yubikey was plugged to USB connector. But again it is not working, even with network permission assigned to Google Play Services. Later I will give another try.

Be aware, passkeys (so no user, no pass required) normally require a PIN. Based @DeletedUser370 guide entering PIN does not work via NFC, so for passkeys you should use only USB, but 2FA UTF should work with NFC.

I can't login in Proton Calendar app, still getting same error warning at 2FA U2F step.

DeletedUser43

monotype-uselessly-credibly Do you have Google Play installed and active?

monotype-uselessly-credibly

DeletedUser43 yes, I have. It seem to be important give initially network permission to google-play-services.

DeletedUser370

monotype-uselessly-credibly After reading the guide post by fid02 and enabling network permission in Google Play Services I was able to login in GitHub in two ways (passkey and U2F) while my yubikey was plugged to USB connector. But again it is not working, even with network permission assigned to Google Play Services.

Sorry, I don't understand. You were able to sign in to your GitHub account, yet it's still not working? What is not working?

Please try rebooting your device after enabling network permission for Play services if you didn't already do that.

Edit: You can easily test all this stuff by using https://passkey.org/

monotype-uselessly-credibly

DeletedUser370 It works once via USB after enabling network permission for google-play-service as u pointed in your guide like magic. But then stop working. Now my yubikey is not detected when it is USB plugged. I have rebooted my phone, I have re-enable network permission to google-play-services multiple times, I have force stop google-play-services, but still not working.

This error is different than before, before somehow the yubikey was detected but the FIDO2 step fails. But now it seems to me that yubikey is not detected at all.

I gonna try passkey.org

This setting in your guide "A third-party autofill service is enabled:" and "chrome://flags" is not required to yubikey, right?

DeletedUser370

monotype-uselessly-credibly This setting in your guide "A third-party autofill service is enabled:" and "chrome://flags" is not required to yubikey, right?

My guide intends to be relevant for all types of physical security keys, including Yubikeys. If, in Vanadium, the following dialog pops up when you try to sign in with a passkey, I believe your Vanadium settings are fine: https://ibb.co/44cWRgY
Alt. text: a small dialog showing the text "No passkeys available" with the options "Use a different device" and "OK".

monotype-uselessly-credibly By now, at least for me, it is not very reliable/consistent. But it works now :)

Could you explain what is not reliable? Does the phone sometimes still not detect the Yubikey?

Another user had the issue that their Pixel devices weren't detecting their Yubikey (although a different model). It was apparently solved by installing the Yubico Authenticator app. If your problems persist, perhaps you could try that. Play Store link. GitHub releases link

monotype-uselessly-credibly

This pop-up is not shown anymore, https://imgur.com/a/qBEiZZx

monotype-uselessly-credibly

Today I can login in GitHub from Vanadium with my yubikey passkey, and also with user/pwd + yubikey U2F :)

By now, at least for me, it is not very reliable/consistent. But it works now :)

When I try to login in Proton Calendar app after entering user/pwd I am getting an error warning when I try to use my yubikey for U2F, I will ask to Proton support anyway.

Google Pixels from Pixel 6 come with a Security chip. Is that security chip as secure as using a yubikey for passkeys? Can we use in GrapheneOS such built-in security chip for passkeys? So instead of using my yubikey for signing in GitHub use a passkey stored in Google Security chip? thanks