U2F key stopped working recently?

EEkleog · 2025-04-02T15:32:05+00:00

Hey!

I haven't used my yubikey on my GrapheneOS phone in a few weeks, but after the recent updates it seems to me like Okta no longer wants to log me into my work account, on my work profile. When in the yubikey stage, it doesn't even prompt me to plug the yubikey in.

The issue is weird, because when I do try to re-enroll my yubikey, I'm actually seeing the prompt to plug the yubikey, and it tells me my yubikey is already enrolled.

I checked with someone else, and the same flow seems to work fine on regular androids.

Here is what I'm seeing in my Chrome logs (as ISTU Vanadium can have compatibility problems with yubikeys, I'm just using Chrome on my work profile):

I ImeTracker: com.android.chrome:[...]:onCancelled at PHASE_CLIENT_ALREADY_HIDDEN
[3 seconds later]
E cr_Fido2Request: FIDO2 call to enumerate credentials failed. Dispatching to CredMan. Barrier.Mode = ONLY_CRED_MAN
[... a long stack trace I'm skipping because I'm retyping everything from my phone]
E cr_CredManHelper: CredMan getCredential call failed: android.credentials.GetCredentialException.TYPE_NO_CREDENTIAL (No credentials available on this device.)
[1 second later]
E AtomicFile: Failed to sync file output stream
[2 seconds later]
E cr_Fido2Request: FIDO2 call to enumerate credentials failed. Dispatching to CredMan. Barrier.Mode = ONLY_CRED_MAN
[etc, 3 times in total]

Does that ring a bell to anyone?

fid02 · 2025-04-02T17:48:17+00:00

Ekleog Is Sandboxed Google Play enabled in the profile where you are trying to use the key?

In practice, Sandboxed Google Play is currently required for most FIDO security key functionality.

There is no native support for FIDO in GrapheneOS or in the Android Open Source Project, which GrapheneOS is based upon, at this time. While apps can provide FIDO functionality without Play services if they include a non-Play FIDO library for that, very few apps actually do this. Most apps choose to use the Google Play FIDO library, which depends on Play services. Chromium also has no native FIDO security key support.