How to make FIDO2 WebAuthn work with Bitwarden on GrapheneOS?

ticklemyIP

I have set up a new profile, installed Bitwarden and Play services, after entering login credentials inapp webview with Bitwarden Webauthn webpage appears, tap Authenticate WebAuthn, Security key dialog appears, Popup asking play services to access "Fido KB" appears, Tap Ok to access Fido KB, proceed with Security Key dialog, tap my physical security key, after going back to Bitwarden app and loading I get error: Two-step token invalid. Try again.

What could be the issue? How to make Fido work on GrapheneOS?

fid02

ticklemyIP Which security key and Pixel device? Which version of Play services? Does Play services and Play Store have network access?

ticklemyIP

fid02 Token2 T2F2 key, Pixel 8a, I would imagine the latest play service version, notably, 25.06.32, everything is the latest, I didn't give network access to Play. Does it need it for Fido2 to work?

fid02

ticklemyIP Does it need it for Fido2 to work?

It is known to require it, perhaps for Play Store to download dynamite modules for FIDO.

fid02

ticklemyIP I would imagine the latest play service version, notably, 25.06.32

Please check

ticklemyIP

fid02 I did, that is the version I see in the Graphene App store

ticklemyIP

I gave Play services access to network, still didn't work. It has sensors, and network permissions. I will try disabling some exploit protections

ticklemyIP

Okay disabling exploit protections for Bitwarden did it. Ill check which one was it

Edit: Dynamic code loading via memory needs to be enabled in order for Bitwarden to work with WebAuthn.

fid02

ticklemyIP Okay disabling exploit protections for Bitwarden did it. Ill check which one was it

Maybe Play Store needed time to download the dynamite modules? I don't know.

I have the same issue with my Token2 key with FIDO as MFA (not clear which FIDO version) for any website. Works on PixelOS. The key is going in the trash anyway. Perhaps smashing it to bits with a hammer first. 🔨

ticklemyIP

fid02 I know you're probably joking anyway, but if you're not, I would sell it if I were you or keep it, don't throw it out.

fid02

ticklemyIP Forgot to mention that it's damaged. (https://discuss.grapheneos.org/d/13051-hardware-fido-keys-from-token2-anyone-tried-them/29)

fid02

Sorry for the jokes. I tried to blow off some steam but I shouldn't do that in public. Glad the issue is resolved.