Authentication with 2FA after device Reboot - Impossible?

Friedemann

Hello,

(1)
I'm currently using a password with over +120 bit of entropy to unlock my phone, and yes, it takes some time to unlock it, especially with these sausage fingers. So I was thinking to shorten the password (to an acceptable strength) and add some type of second factor to compensate for this. But to my surprise, this can't be done since there is no native support. At least not when the device has been newly rebooted and promts for Password/PIN or Pattern.
I guess the reason why I have not noticed this before on Android is because I just used my previous phones for call/sms/snake (in a nutshell), hence there was no need for even thinking of using 2FA. But now, owning a Pixel 6 with GrapheneOS, I feel safe and confident enough to increase its use cases, as an example: hardware-secured password manager. Thank you GrapheneOS team!

I have always used a strong password along with a keyfile/security-key (my Yubikey is antique) as authentication method for Win|macOS|Linux PC-environments and I would really like to have the same approach with Android also.

**Solution (a BIG maybe) - auto-type USB static password + manually enter a short password (or reversed)**

Perhaps by changing the USB permissions to allow data transfers while the device is locked (current setting is only allowed when device is unlocked as it felt more secure) it could allow my USB Security-key to auto-type a static password (mimicking a USB keyboard). After I would just manually enter a much shorter password.
*** Could this even work?**
*** Any other ideas?**

(2) - I added a fingerprint so I don't need to re-enter my password every single time I must use the phone for whatever. I suppose adopting a 2FA solution for this use-case is somewhat easier by just installing an app? (Fingerprint + PIN/Pattern/Securitykey/Photo/Location/Other)
*** Any suggestions on how to do this?**

Oh, this is my first post, hi all! :)
,, and sorry if this post doesn't belong here on grapheneos.org (some plain Android forum?), but I rather take this up here with like-minded people, that is in terms of security & privacy. - Thank you for your attention <3

kopolee11

Friedemann Regarding your second point, there has been a long time issue filed to create an extra factor when enabling fingerprint unlock. https://github.com/GrapheneOS/os-issue-tracker/issues/28

I also want to mention that a shorter password on a GrapheneOS device is more secure than on a traditional desktop/laptop device. That's because Pixels have a security chip which limits how many password attempts an attacker can attempt. (I'll leave the technical explanation for someone more qualified to explain) So while a second factor authentication would obviously increase security, unless your threat model includes a security chip exploit, it may be overkill.

Friedemann

kopolee11

Thanks for your reply, I checked out the provided link.
Yes, I'm aware of the HSM (Titan M2 & Tensor). Yes, perhaps this could help against some exploits, but this would certainly help against shoulder surfers.

(1) - Solved. Works after Reboot
I'm now using Yubikey (with OTG adapter) together with manually entering the password. For this to work I had to change: Settings > Security > USB accessories > Allow new USB peripherals
I did not have to use developer settings. USB Preferences is still (always) to: No data transfer.
If one was to buy YubiKey Bio, then it would be possible use Fingerprint + normal password to gain access to the phone. Now I need to figure out how this new setting affects the system, then consider risks and benefits and make a decision.

(2) - Still not solved