Don’t understand why hardware security keys (fido2) don’t work

Jdjeowld

I’m trying to sign in to Proton mail app with security key but I receive an error message that there is no API available. What gives?

fid02

Jdjeowld You need Sandboxed Google Play for practically most FIDO functionality with security keys on Android. AOSP and GrapheneOS does not natively support FIDO security keys at this time. I don't know of an Android app that exposes this functionality to the user and that is
reliable, does not require Google Play, and is actively developed.

mmobder

Jdjeowld
If you already have passkey on your key, use Firefox, it looks like atm that's the only browser that works. Vanadium stopped to work for me some time afo.

You may also need to:

use isolated play services (don't give it network permissions and disable it once done) - it's not a big deal read the GOS guide if you're hesitant
select Google as autofill in Android Settings

GrapheneOS

Jdjeowld Most apps implement FIDO2 support via Google Play services. Vanadium supports passkeys via arbitrary passkey providers without Google Play including hardware-based passkey providers. Android has standard passkey support without Google Play but you need a passkey provider and the main one people use with hardware support is Google Play services. There are non-Google software-based passkey providers like Proton Pass, but very few with hardware keystore or security key support. There is a tiny app someone made providing this but it does not provide password management despite still taking the place of one due to passkey support being part of the APIs for that.

GrapheneOS

fid02 Someone did make an app providing hardware-based passkeys via hardware security keys as a passkey provider, but it doesn't have other autofill functionality. It would be best if apps with passkey providers added support for using the secure element in the phone and optionally external security keys. At the moment, nearly all non-Google passkey providers are software-based ones.

CueHD

I didn't go through these steps personally, but maybe this thread helps:

https://discuss.grapheneos.org/d/1903-using-yubikey-with-vanadium

fid02

CueHD That user did a lot of things that aren't needed to get this working. No need to overcomplicate things here. :-) They just need to install Sandboxed Google Play as a starting point.

Jdjeowld

I’m trying my best to get rid of google and now you guys tell me I need google play to sign in to my Proton account with security key 🥲

fid02

Jdjeowld I’m trying my best to get rid of google and now you guys tell me I need google play to sign in to my Proton account with security key 🥲

I'm sorry.

fid02

mmobder If you already have passkey on your key, use Firefox, it looks like atm that's the only browser that works. Vanadium stopped to work for me some time afo.

Vanadium works for me. I haven't seen other reports of regressions in Vanadium regarding FIDO. More details about your setup would be needed to assist you with this.

mmobder You may also need to:
use isolated play services (don't give it network permissions and disable it once done) - it's not a big deal read the GOS guide if you're hesitant
select Google as autofill in Android Settings

This is definitely not related to getting security keys working with Play services. Play services actually needs to contact the internet the first time you authenticate with a security key.

mmobder

fid02 Play services actually needs to contact the internet the first time you authenticate with a security key.

hm, not in my case, I would never allow any google shit to !directly access internet. And I don't recall any Firefox logs accessing Google domains - I run Firefox in isolated mode allowing it to access only relevant domains. I'll retry Vanadium though, tnx.

mmobder

fid02
@Jdjeowld

Ok, so I've double-checked - in my case (not Proton):

Play services needs to be enabled (I do not grant Network permission)
Firefox works just fine for FIDO2 auth both on web and via 3rd party app (for 3rd party app, I, obviously, have to set Firefox as a default browser). It's interesting, but I don't even need to set Google as preferred auto-fill provider in Android settings.
Vanadium (the latest), on the other hand:
** in order for HW passkey unlock screen to even show up (so I can enter PIN) requires Google to be set as preferred auto-fill provider. I do get "failed to auth by the passkey" if I don't set autofill
** after an attempt to sign-in, all the typical HW key dialogs are shown (PIN unlock, etc)
** as opposed to Firefox, I get smth like passkey auth result is invalid
I don't know, maybe, if I grant Network permission to Google Play services, Vanadium will start to work, but no way I'm going to grant it.

Lusca

GrapheneOS

I believe GrapheneOS is referring to this app:

https://codeberg.org/s1m/hw-fido2-provider

mmobder

GrapheneOS There is a tiny app someone made providing this

which one is that? I know there was/is a KeePass android apk/driver for HW keys, but I guess it's not relevant to this particular case

GrapheneOS

mmobder FIDO2 and passkeys work fine in Vanadium via either Google Play services or a third party passkey provider. If you block Network for either Play services or the Play Store, you're breaking them installing and updating modules which will create problems. You can use other apps as passkey providers for either hardware or software passkeys with Vanadium. It doesn't require Play services for passkeys.

CueHD

I haven't tested the following myself:

My understanding is that Play Services is required to get the phone to display the unlock screen for you to enter your PIN to unlock the Yubikey.
You may be able to use a Yubikey-Bio since you can authenticate on the Yubikey itself and don't need the phone to be a middleman. The Onlykey may work also.

See:
https://github.com/microg/GmsCore/issues/849

mmobder

Lusca
Thank you! Do you use it by chance?
Are there any prerequisites or settings I need to enable to get it running. I haven't found any wiki/instructions on codeberg/issues so far.
I've tried it in Vanadium with demo.yubikey.com (or smth) by setting the app as autofill provider - though the actual passkey was written to the key, I've got "operation cancelled" on the web and the key wasn't visible on the test account site

mmobder

mmobder
the correct test site is https://demo.yubico.com and if I try to login with the passkey, I also get "operation cancelled"
I don't know if that's because the key wasn't linked to my account in the registration process, or there is some generic issue with the lib and it doesn't reach the actual verification.

GPServ are disabled, of course

GrapheneOS

mmobder Did you set Vanadium to use other passkey providers and did you set it as a credential service in the OS? Both are needed.

fid02

mmobder the correct test site is https://demo.yubico.com and if I try to login with the passkey, I also get "operation cancelled"
I don't know if that's because the key wasn't linked to my account in the registration process, or there is some generic issue with the lib and it doesn't reach the actual verification.

I think I've figured out why this doesn't work with HW FIDO2 Provider in Vanadium and other Chromium-based browsers, but works in Firefox: https://codeberg.org/s1m/hw-fido2-provider/issues/7 and https://github.com/GrapheneOS/Vanadium/issues/61#issuecomment-2833515385

I updated my guide.

mmobder

GrapheneOS If you block Network for either Play services or the Play Store, you're breaking them installing and updating modules which will create problems.

No problems so far if I use Firefox for sign-in

mmobder

GrapheneOS "Yes" to both. I've checked with Brave - it's the same behavior as in Vanadium:

if I register the key, I do get "Operation cancelled" though the passkey itself was written to HW key
if I attempt to login using passkey, I get "Operation canceled"
I use demo.yubico.com for tests

fid02

mmobder I use demo.yubico.com for tests

This site's default settings allow me to create a non-discoverable credential on a security key in a profile with Sandboxed Google Play. The site doesn't seem to create a passkey by default. It's possible that the HW FIDO2 Provider app has an issue with creating a non-discoverable credential, which I can reproduce in a profile without Sandboxed Google Play.

If you go to the demo site's "Developer tools", you can set "resident_Key" to "required" to force it to create a passkey.

Or perhaps try it on a different site in case this one is wonky?