Yubikey 5 NFC and Google signup on fresh profile

martinko5mb

I am using GOS for couple of months without Play just fine. Recently upgraded my secutity model with 2 Yubikeys.

What i am trying to do is to split different apps to different GOS profiles ( banks, garmin ... )

No matter how or what i try, i am unable to sign up to a google account on freshly installed G Play / services.

nor NFC or USB work.

What i get is an error with a message that i should try a USB, when i do i get promped to fill the pass for passkey twice but then i get 'error occured"

How am i supposed to signup to play services with my yubikey?

ask whatever you need for this to be resolved.

fid02

martinko5mb Not clear why you are unable to sign up to a Google account because of FIDO2 issues, as Google doesn't enforce FIDO2, it's completely optional.

Not clear if you're doing this from Vanadium or some other app.

You need to grant network access to both Play Store and Play services. The issue description is consistent with the behaviour that occurs when Play Store and Play services don't have network access. Grant it to them and then reboot. If it's already granted, make sure that a DNS or VPN is not blocking access to Google domains.

LeslieFH

I have an NFC Yubikey as 2FA set up for my accounts and Google Play Services signup worked just fine. I don't use multiple profiles, so it was on owner account, but I got a prompt to use the NFC yubikey in Vanadium and it worked.

martinko5mb

I am just trying to sign in via G services

just tried via vanadium on freshly new profile and before that i removed my only profile that i was logged in ( i logged in before i have set up yubikey)

again the same error

**Something went wrong**
Try inserting your security key in your phone's USB port or connect it with USB cable or adapter.

Your USB port is usually the same one that connects to your charger.

When i try with USB i get at least to fill the password for passkey. It shows "You are all set" for a second but then shows error " Something went wron" ( different way then above )

i get promptet by system to attach secutiry key but it just doesnt work

martinko5mb

Weird that i can't login via vanadium on any of my profiles, which should ostensibly work.

martinko5mb

Also weird, that sometimes when i try USB connection with Yubikey it prompts password, but after confim it claims passowrd is wrong and that i have 7 attemps remaing to try, but no matter how many times i fill right password it says the same

wth

fid02

martinko5mb Also, Play services doesn't support PIN entry when NFC is used. Play's FIDO API is almost a complete joke usability-wise. Expect issues to occur. It will not give you useful error messages.

martinko5mb

fid02

i have activated passphrase in google account on desktop, now i want to log in on my phone, that's all

there is no way i am accessing passphrase without pin set up on yubikey

fid02
Not clear if you're doing this from Vanadium or some other app.

none works for me

martinko5mb

fid02

does this mean, that i won't be able to log into google with yubikey via NFC ( only with USB ) ?

martinko5mb

Both Play and Services have permision to network ( granted during installation ) and i do not use any VPN.

I am trying to sign in to a google by clicking on Google Play and then follow the instructions

fid02

martinko5mb Do you also use autofill with a password manager that supports passkeys? Can't use both simultaneously on GrapheneOS, there are some issues with that. If so, try to disable autofill in Settings > Passwords, passkeys and accounts.

Edit: actually that sounds like an unlikely culprit. I don't know what could be wrong.

martinko5mb

i have a google ( and proton pass before), not disabled all of them, but stil getting "Something went wrong" during log in into Play

when i try USB i get through it but need to fill password twice for passphrase and then get "We weren't able to sign you in. Try again or try another way"

martinko5mb

It just worked.

Honestly i do not know what has changed. Before i went off, i deleted all MFA ways of signing in in google settings. Added passkey again and tried it without luck. Then switched to my non-gservices main profile and let it be.

i came home, read message again about NFC not working with PIN and tried again.

switched to profile and this time i just went directly for USB option.

woala, loged in

thanks for hints, we can lock this

fid02

martinko5mb Glad to hear that it worked out in the end!

fid02

martinko5mb i came home, read message again about NFC not working with PIN and tried again.

I think it makes sense that it didn't work when you attempted first with NFC and then USB in the same UI flow. I haven't had success with that. I would have to cancel the dialogs and then only try with USB. The thing is buggy.

martinko5mb

I am struggelling to log into Proton with only USB :D

same user, already log into Gservices, it's like a neverending story :D

Also doesn't work on another user profile, same old error messages ... feels like a coinsidence that it worked yesterday

martinko5mb

I have finally figured it out!

I was always using Yubikey as a primary option ( instead of filling password i have directly clicked on "Try different way")

This doesn't work no matter what you do.

You have to first fill password and then wait for google to show you options, then you can choose "passphrase" from options, then USB, plug in and without need to fill in PIN, it works.

wuala, log in