Security keys and Microsoft

schweizer

Hi,
I need to use MS Teams on my Pixel 6 while security tokens (FIDO2) are enforced.

Although many say it should work it does not for me.
When I log in to https://login.microsoftonline.com in Vanadium I can tap "Use windows hello or a security key". After tapping, I just see waiting dots on the top of the screen.

I can login to github using a Yubikey connected by USB. However, If I try the same Yubikey with NFC, sandboxed google play crashes.

When using https://demo.yubico.com/payground I can login using username/password/key. But when I choose "enable passwordless login with this key" I get an error "Can't create passkey To create a passkey, make sure your're signet into your google account and have a screen lock set up." When I try the same in Firefox I get an error "Operation cancelled".

However, I do not want do sign in into a google account. That is one of the main reasons I use GrapheneOS.

If you don't have those problems it would help me if you could post screenshots of successful logins where I currently fail.

schweizer

Has anyone managed to authenticate with FIDO2 to https://login.microsoftonline.com using any browser in GrapheneOS?

[deleted]

Personally I don't see the option to use a security key to connect to microsoft.
In connection options I only have "connect with github" or "connect to an organization" : https://answers.microsoft.com/en-us/outlook_com/forum/all/cant-login-into-outlookcom-from-android-phone-with/8c2e1a87-35ad-477c-b87c-d32b380bec32
But I guess this is normal. Fido2 on outlook is passwordless, not a second factor, and this mode isn't used on android.

If you want passwordless mode, I think you have to enable the option in the settings and use the login system with notification to validate with microsoft authenticator. I guess it works on android too.

pdagenius

[deleted] This would seem to be correct. This will inform: https://learn.microsoft.com/en-us/azure/active-directory/authentication/fido2-compatibility

I use MSTeams and O365 apps on my phone successfully with GrapheneOS.

schweizer

Thank you for the helpful replies. I have only one device and it is GrapheneOS so I did not recognise it does not work on other phones too.

However passwordless login would be a great feature for Vanadium! Or is it a feature of Android? Because passwordless does not work in the apps too so it's not only a browser issue.

schweizer

Passwordless login to Microsoft apps is possible through the Microsoft Authenticator app.
https://allthingscloud.blog/working-passwordless-on-mobile-devices/

I still would prefer a method without the Authenticator app

GiftedAccess

Dang: worse thing: you can remove the TOTP, or other 2nd factor from an account, what has a yubikey added, so on one side you can be "OMG-secure" with a key, while the other method to log in to the same accountis is a single password (what is charactel limited).
In MS's case -in my eyes- it is less secure, than it possibly be: A username+PW+key would be more secure than a username+PW+TOTP OR passwordless hardwaretoken specially is the later could be made to a username+pw OR pw-less hwtoken. And even if i would, i can not go to A pw-less hwtoken OR B pw-less hwtoken (only), because the PW is undeletable... even if both other would be "Passwordless"...
This kind of illogicalness makes me mad.