Passkeys and 2FA keys compatibility

Eddie_DS

Good evening everyone,
I’m soon moving from an iPhone 15 pro to a Pixel 10 Pro with Graphene OS, and I’m trying to figure it out what would work and what won’t.

One of the things that I’m quite unsure about is its compatibility with physical 2FA keys and passkeys. On some places I’ve read that it works as intended, while on some others Google Services are required.

I’ll probably have a profile using sandboxed Google Services, however, I’d rather avoid installing them in my main profile (focused on FOSS apps). Is there any workaround? Do they work out of the box?

I’ll probably be using either yubico or nitrokeys if that matters, tho I’m open to other alternatives.

My experience with iOS and pass managing has been quite straightforward. I’m using Bitwarden and it allows to just auto fill by pressing a pop up directly integrated in the keyboard, after authentication with Face ID. Is it possible to archive something like this? Or is it more “manual”.

Thanks in advance!

NoahRaketic

Eddie_DS Password manager apps can manage passkeys on GrapheneOS, as well as filling in passwords.

fid03

Eddie_DS Signing in with security keys, including passkeys stored on them, usually works fine as long as Play services is installed and running in that profile. There are some edge cases but it mostly seems to work fine in both Vanadium and in most other apps; in apps other than web browsers it mostly works fine except for passkey sign-in. Note that Play services NFC doesn't support PIN entry (use USB).

If you don't use Play services you can install this app and enable it in Settings > Passwords, passkeys & accounts: https://codeberg.org/s1m/hw-fido2-provider It will work in Vanadium but currently doesn't support apps other than web browsers. In my experience it works fine for sign-ins but I can't get it to register passkeys with Vanadium. Security keys on GrapheneOS is a bit of a bumpy road; don't expect everything to work.

Password managers are a different story: very good support for passkeys and non-passkey FIDO credentials in Vanadium, also without Play services. It's a much better experience usability-wise. Note that in apps other than Vanadium you will still need Play services for passkeys and FIDO.

W1zardK1ng

Eddie_DS you can keep using Bitwarden on GrapheneOS and it will work, i use keepassDX and no issues with passkey logins.

Eddie_DS

NoahRaketic but physical keys too? Or just passkeys stored in the device?

Thanks!

gk7ncklxlts99w1

fid03 replied to one of my posts about this:

No one has figured out yet how to reliably register a FIDO2 passkey to a security key using Vanadium. You might be able to do it using Brave and Play services. Doing it from outside of a web browser, such as in the Play Store, is known not to work at all. Some people report having luck in Vanadium with this app set as a credential provider: https://codeberg.org/s1m/hw-fido2-provider (I'm not one of them).

Source: https://discuss.grapheneos.org/d/29005-cant-create-passkey-or-add-security-key-for-google-account/4

Eddie_DS

fid03 So basically I should just skip physical security keys if I plan to use them mainly for passkeys, especially since I want to avoid Google services in my main profile.

Would relying entirely on a password manager for both TOTP and passkeys be the best apporach instead? Is there any solution that’s particularly well suited for GrapheneOS?

So far I’ve been using Bitwarden (without passkeys so far), but here I've usually seen KeePass recommended.
Thanks for answering!

chock-a-block

I'm confused what the difference is between using a passkey stored in a password manager, and using a password stored in a password manager. Is the passkey any more secure than a long string password? Is the passkey in the password manager tied any way to the hardware?