Graphene OS 3rd party Passkey support on Android 14

Waethorn

I did the instructions on Proton's website to enable the browser flag but I don't get a "Google Password Manager" prompt at all. The only passkey prompt I get is for USB, NFC, and "this device". Proton Pass doesn't show as one of the options, nor does the Google one as described in their screenshot with the Proton name written under the logo.

I'm using a Pixel 6A with Play Services installed. Using Vanadium. The OS and apps are up to date as of date of this post. Proton Pass says passkeys are supported in their app menu on the phone. I was able to set up a passkey in Proton Pass for Cloudflare on PC, but not on my phone. I tried Outlook.com. Same result. I only get the hardware passkey options.

DeletedUser370

Waethorn The upcoming Vanadium release greatly improves passkey support. You will no longer need to set the custom flag in chrome://flags. I suggest you try again when the new Vanadium release is released to stable. It will now also work with Google Password Manager, if you desire to use that instead of Proton Pass.

The Google Password Manager passkey support will, I think, greatly improve the on-boarding experience for users coming from stock PixelOS, who have set up passkeys on their Google account but do not use a third-party password manager. You will still need Sandboxed Google Play for this.

Waethorn

DeletedUser370 Okay I'll wait for it. On-device passkey is what I've been using in the meantime. I would think that there would be a good security argument to use it in place of any cloud-synced passkey management, but you end up with multiple passkeys for every piece of hardware. I guess this is more secure than just having a single passkey for an account used everywhere, similar to having independent app passwords for email and the like, so you know which ones get compromised, if that ever happens.

I'll have to look up more security details about the Titan chips in Google phones though. The recent news about Apple's secure enclave being not only compromised but also un-patchable is worrying. When I read headlines like "Bitlocker encryption bypassed" it's pretty bad too. How can encryption just be "bypassed"??? That's a total failure if that's the case. That's not encryption. That's just a padlock for access.

p338k

Waethorn I guess this is more secure than just having a single passkey for an account used everywhere,

It also requires compromising a specific device which is an advantage even in the case of a Titan flaw.

Waethorn How can encryption just be "bypassed"???

I am not sure about the specific Bitlocker exploit you cite, but encryption cannot be "simply bypassed." I suspect that the attack involved obtaining the encryption keys which must be available somewhere to allow Bitlocker to decrypt the drive.

Deep-diver

I would like to add my one vote for GPS less passkey support, if I may

Waethorn

p338k Windows patch KB5034441 was supposed to fix this. WinRE was able to just read the encrypted files in the data partition without needing proper user authentication. This patch was extremely buggy though. God help you if the system OEM put the recovery partition at the start of the drive where it couldn't be resized correctly.

p338k

It is possible that there is some flaw in the encryption that could allow it to be effectively bypassed. Weak cyphers such as ROT13 or bit flip cypher or flawed implementation such as using "super AES" in ECB mode on a drive with 0 blocks are extreme examples, but they demonstrate some sorts of flaws that allow "bypassing" encryption.

p338k

I can verify that the F-Droid version of Proton Pass 1.20.4 with Vanadium supports passkey login on GitHub.

bayesian

p338k Vanadium with Google Play Services or without?

p338k

Today, I tested Bitwarden 24.5.1 the same way. It was successful.

p338k

bayesian

Chromium does not support FIDO directly, so it requires Play services.

Tryptamine

EBay, GitHub, and something else, can't find it in Proton Pass right now, but I have 3 passkeys registered through Vanadium on GrapheneOS on the latest, and also 2 updates ago.

With Sandboxed play installed.

Entire277

I don't know how you configured everything, but even after following Proton documentation (https://proton.me/support/pass-use-passkeys) it doesn't work. I'm still prompted with standard Google Password Manager (A key is already registered on my Proton Pass for Github)

https://drive.proton.me/urls/DY75YW6038#a7POpT2i1NLF
https://drive.proton.me/urls/C99KPG842G#NRytGxwvVWxK

Pixel 8
Proton Pass v1.22.1
Vanadium v126.0.6478.50
Android 14 with latest version of GrapheneOS

DeletedUser370

Entire277 Proton's guide is not relevant to Vanadium and will cause issues. Please try these steps and see if they change anything:

Update your Vanadium version
Go to chrome://flags/ in Vanadium > Reset all > Relaunch
Go to System Settings > Passwords & accounts > set Proton Pass as your passkey provider
Go to Vanadium settings > Autofill Options > select Use other providers > select Restart

Entire277

DeletedUser370

Update your Vanadium version

I already have the latest available, or at least the one from yesterday (I don't know how to force it for the one released 4h ago): https://github.com/GrapheneOS/Vanadium/releases/tag/126.0.6478.50.1

Go to chrome://flags/ in Vanadium > Reset all > Relaunch
Go to System Settings > Passwords & accounts > set Proton Pass as your passkey provider
Go to Vanadium settings > Autofill Options > select Use other providers > select Restart

I just tried it now but still the same, even after a full reboot. Just for my understanding: is it correct to select the default option ("this device")? Sorry I'm a bit new with everything around pass keys so maybe I'm doing something wrong. What is sure is that my key is already registered in Github (working with Proton Pass on my computer)

DeletedUser370

DeletedUser370 Go to System Settings > Passwords & accounts > set Proton Pass as your passkey provider

Correction: the Passwords & accounts option is called Passwords, passkeys and auto-fill in the upcoming QPR3 release.

Entire277 Just for my understanding: is it correct to select the default option ("this device")?

It sounds like the GitHub passkey that is stored in Proton Pass is simply not recognized. What happens if you try to register a passkey within Vanadium? (You don't have to complete the registration, just get to the point where it should offer you to save the passkey in a third-party password manager such as Proton Pass).

Entire277

So when it pops out, I cannot "register" my key. I just have the screen above saying basically "no access key available"

I tried to do the following when the menu pops out(sorry for the translation, but I cannot find how to put Vanadium it in english, so it's translated from french...)
Other device => NFC pass key. Then I put my passkey behind my phone to scan it but I have the following error (or kind of, still translated...):

"An error occurs. Please try to plug your key to the USB port."

Unfortunately it's not an USB C key and it doesn't seems to work with an adapter (nothing happens if I chose USB pass key instead of NFC pass key)

EDIT: and yes the autofill option in System Settings is set to Proton Pass. Actually autofill itself (username and password) is working fine

DeletedUser370

Entire277 I'm confused. You're saying that you're trying to use a physical security key to store your passkeys? In addition to storing the passkeys in Proton Pass? I thought you were only referring to Proton Pass.

For physical security keys, please see this post and a possibly relevant update to that post.

« Previous Page Next Page »