BitWarden with YubiKey

locked

binaryhellstorm Just to confirm, I was able to log in to the bitwarden app from github, and authenticated with yubikey via NFC,, on a P8 running 2025070800.

binaryhellstorm

locked Werid I am running a Pixel 8 also, on the same build. Freshly flashed this morning.

Skyway

binaryhellstorm
Are you trying to login to Google or bitwarden with 2fa?

binaryhellstorm

Skyway
I am trying to log into BitWarden. I can also confirm that the test page works fine.
https://demo.yubico.com/webauthn-technical/registration

binaryhellstorm

binaryhellstorm
I also just completely reset and wiped the device. Install Google Play and Google Play services from the Graphene App store, Installed F-Droid and Aurora App stores, then installed Bitwarden via Aurora and I'm getting the same exact error.

Also fails with the BitWarden app direct from F-Droid

DeletedUser370

binaryhellstorm Do Play services and Play Store have the Network permission? They need that for at least the first sign-in with a security key. Grant them the Network permission, reboot, and try again.

locked

binaryhellstorm I am assuming you have NFC enabled. Also, try the github version of bitwarden. The yubikey should be placed on the back of your P8 in the center. Works best for me. Have you tried re-pairing the yubikey with your account?

UPDATE: ok I see you resolved the issue. I suspected as much.

binaryhellstorm

DeletedUser370
They do

binaryhellstorm

binaryhellstorm
Steps I took this morning.

Wiped device and set up again.
Installed F-droid via APK from f-droid.org page (allowed network access)
Added the Bitwarden repo to F-Droid (https://mobileapp.bitwarden.com/fdroid/repo?fingerprint=BC54EA6FD1CD5175BCCCC47C561C5726E1C3ED7E686B6DB4B18BAC843A3EFE6C)
Installed Google Play Store (and the GmsCompatConfig and Google Play Services dependencies) from the GrapheneOS app store. Gave both Google Play Store and Google Play Services network access when prompted.
Installed BitWarden from F-Droid (allowed network access)
Logged in with username and password to BitWarden.
Got prompted to WebAuthn with my YubiKey
Get the pop up "No passkeys available. There aren't any passkeys for vault.bitwarden.com on this device. Use a different device"
Tried NFC option, was prompted to turn on NFC (I did), WebAuth reads Yubikey via NFC and I get a "Logging in" spinner, after about 5 seconds I get the "An error has occurred Two-Step Token is invalid. Try again" error.
Go back to WebAuthn prompt in BitWarden, select USB Key, plug in YubiKey to phone, get prompted to allow Google Play to access YubiKey, accept, get a "Logging in" spinner, after about 5 seconds I get the "An error has occurred Two-Step Token is invalid. Try again" error.
Tried all the same steps above with the BitWarden Beta app from f-droid, same issue.

DeletedUser370

binaryhellstorm Thanks for the detailed overview of what you have attempted so far!

At this point I'm wondering if you have double-checked that the key is actually registered to your account. Are you able to sign in to Bitwarden from other devices (if you have another device available)?

Bitwarden has two options for security keys: passkeys and non-passkeys. Confusingly, they're both called passkeys in the Bitwarden web interface. The key you're using for two-step sign-in must be registered from Bitwarden's Two-step sign-in menu under Security (I think that's where it is; can't check right now).

If it is correctly registered, I'm wondering what happens if you test the following:

Go to webauthn.io through this URL (I set the settings for you): https://webauthn.io/?regUserVerification=discouraged&attestation=none&attachment=all&algEd25519=true&algES256=true&algRS256=true&discoverableCredential=discouraged&regHints=&authUserVerification=discouraged&authHints=
Enter a username and register your key
Sign out and go to the URL again, and try to sign in with the username you registered

binaryhellstorm

DeletedUser370

At this point I'm wondering if you have double-checked that the key is actually registered to your account. Are you able to sign in to Bitwarden from other devices (if you have another device available)?

Yup, I signed out of Bitwarden on my Ubuntu laptop, signed back in and was prompted for the YubiKey, inserted it and logged in no problem.

Can confirm that if I go into the WebVault I see the YubiKey registered under "Passkey: Use your device's biometrics or a FIDO2 compatible security key."
Drilling down into that menu I see my key listed under "Turned on, This two-step login provider is active on your account." WebAuthn "YubiKey (Migrated from FIDO)"

DeletedUser370

binaryhellstorm Can't really think what's going wrong here. I can't reproduce the issue.

If you're unable to get it to work with Play services, I'd suggest you try HW FIDO2 Provider. It's not available from an app store, so it'll have to be manually downloaded. When installed, it must be enabled in Settings app > Passwords, passkeys & autofill.

binaryhellstorm

Their support had me remove and re-register the Yubikey and it now it magically works (thows hands in air).

I blame ghosts at this point. /s

Thank you for all the help and debug on this, it really means a lot.

DeletedUser370

binaryhellstorm Thanks for letting us know how it worked out!