BitWarden with YubiKey

binaryhellstorm

Having 2FA issues with Yubikey with BitWarden. I installed via Aurora Store. I get the prompt to do WebAuth, it opens in Vanadium, plug in YubiKey and then I get a prompt to allow Google Play Services access to the key, accept, finally get a "An error has occured Two-Step Token is invalid. Try again"

I've cleared storage and cache, removed and reinstalled BitWarden, restarted the phone, checked the date and time. So far nothing has changed my inability to log in.

DeletedUser370

binaryhellstorm Is the information here of any help? https://gist.github.com/FID02/48f5130c2151b6d10a04bdfda0cb1c90

Skyway

binaryhellstorm
Are you trying to login to Google or bitwarden with 2fa?

binaryhellstorm

DeletedUser370

That is extremely well written, thanks for the link. I see the line "Sandboxed Google Play provides support for security keys in Vanadium, and support for non-passkey sign-in in other apps." Which I take to mean that this should be working. I've done the steps outlined :

re-insert your security key
refresh the website / close and re-open the app
reboot your device
double-check that you have actually registered your security key against the service that you are attempting to sign in to
check that GrapheneOS is up-to-date

But that doesn't seem to get me any further along in the sign in process.

DeletedUser370

binaryhellstorm Did you check this one https://gist.github.com/FID02/48f5130c2151b6d10a04bdfda0cb1c90#challenge-1-password-managers ? Might be remains from other password managers in the Settings app.

binaryhellstorm

DeletedUser370
I did, but I haven't been able to log into BitWarden yet it's not even showing up in that field yet.

binaryhellstorm

I'm noticing that I get the same behavior when I try to authenticate to the Bitwarden web vault too.
It hangs on the "Awaiting security key interaction" page. Happens with USB and NFC.

locked

binaryhellstorm Just to confirm, I was able to log in to the bitwarden app from github, and authenticated with yubikey via NFC,, on a P8 running 2025070800.

binaryhellstorm

locked Werid I am running a Pixel 8 also, on the same build. Freshly flashed this morning.

binaryhellstorm

Skyway
I am trying to log into BitWarden. I can also confirm that the test page works fine.
https://demo.yubico.com/webauthn-technical/registration

binaryhellstorm

binaryhellstorm
I also just completely reset and wiped the device. Install Google Play and Google Play services from the Graphene App store, Installed F-Droid and Aurora App stores, then installed Bitwarden via Aurora and I'm getting the same exact error.

Also fails with the BitWarden app direct from F-Droid

DeletedUser370

binaryhellstorm Do Play services and Play Store have the Network permission? They need that for at least the first sign-in with a security key. Grant them the Network permission, reboot, and try again.

locked

binaryhellstorm I am assuming you have NFC enabled. Also, try the github version of bitwarden. The yubikey should be placed on the back of your P8 in the center. Works best for me. Have you tried re-pairing the yubikey with your account?

UPDATE: ok I see you resolved the issue. I suspected as much.

binaryhellstorm

DeletedUser370
They do

binaryhellstorm

binaryhellstorm
Steps I took this morning.

Wiped device and set up again.
Installed F-droid via APK from f-droid.org page (allowed network access)
Added the Bitwarden repo to F-Droid (https://mobileapp.bitwarden.com/fdroid/repo?fingerprint=BC54EA6FD1CD5175BCCCC47C561C5726E1C3ED7E686B6DB4B18BAC843A3EFE6C)
Installed Google Play Store (and the GmsCompatConfig and Google Play Services dependencies) from the GrapheneOS app store. Gave both Google Play Store and Google Play Services network access when prompted.
Installed BitWarden from F-Droid (allowed network access)
Logged in with username and password to BitWarden.
Got prompted to WebAuthn with my YubiKey
Get the pop up "No passkeys available. There aren't any passkeys for vault.bitwarden.com on this device. Use a different device"
Tried NFC option, was prompted to turn on NFC (I did), WebAuth reads Yubikey via NFC and I get a "Logging in" spinner, after about 5 seconds I get the "An error has occurred Two-Step Token is invalid. Try again" error.
Go back to WebAuthn prompt in BitWarden, select USB Key, plug in YubiKey to phone, get prompted to allow Google Play to access YubiKey, accept, get a "Logging in" spinner, after about 5 seconds I get the "An error has occurred Two-Step Token is invalid. Try again" error.
Tried all the same steps above with the BitWarden Beta app from f-droid, same issue.

DeletedUser370

binaryhellstorm Thanks for the detailed overview of what you have attempted so far!

At this point I'm wondering if you have double-checked that the key is actually registered to your account. Are you able to sign in to Bitwarden from other devices (if you have another device available)?

Bitwarden has two options for security keys: passkeys and non-passkeys. Confusingly, they're both called passkeys in the Bitwarden web interface. The key you're using for two-step sign-in must be registered from Bitwarden's Two-step sign-in menu under Security (I think that's where it is; can't check right now).

If it is correctly registered, I'm wondering what happens if you test the following:

Go to webauthn.io through this URL (I set the settings for you): https://webauthn.io/?regUserVerification=discouraged&attestation=none&attachment=all&algEd25519=true&algES256=true&algRS256=true&discoverableCredential=discouraged&regHints=&authUserVerification=discouraged&authHints=
Enter a username and register your key
Sign out and go to the URL again, and try to sign in with the username you registered

binaryhellstorm

DeletedUser370

At this point I'm wondering if you have double-checked that the key is actually registered to your account. Are you able to sign in to Bitwarden from other devices (if you have another device available)?

Yup, I signed out of Bitwarden on my Ubuntu laptop, signed back in and was prompted for the YubiKey, inserted it and logged in no problem.

Can confirm that if I go into the WebVault I see the YubiKey registered under "Passkey: Use your device's biometrics or a FIDO2 compatible security key."
Drilling down into that menu I see my key listed under "Turned on, This two-step login provider is active on your account." WebAuthn "YubiKey (Migrated from FIDO)"

DeletedUser370

binaryhellstorm Can't really think what's going wrong here. I can't reproduce the issue.

If you're unable to get it to work with Play services, I'd suggest you try HW FIDO2 Provider. It's not available from an app store, so it'll have to be manually downloaded. When installed, it must be enabled in Settings app > Passwords, passkeys & autofill.

binaryhellstorm

Their support had me remove and re-register the Yubikey and it now it magically works (thows hands in air).

I blame ghosts at this point. /s

Thank you for all the help and debug on this, it really means a lot.

DeletedUser370

binaryhellstorm Thanks for letting us know how it worked out!