FIDO2 won't currently work because Vanadium isn't whitelisted by Play services

kyuweftea

I'm trying to set up my Gmail account in K-9 Mail, and it opens the browser to log in to a google account. I use a yubikey for 2FA for my google account. The issue is, the following notification appears just as the page waits for the yubikey button to be pressed:

Google Play services error
Please complete action required by Vanadium

Clicking the notification gives a dialog box with the following:

This app won't work properly unless you allow Google Play services' request to access the following:

Files and media

To continue, open Settings, then Permissions, and allow all listed items.

Clicking through opens the App info page for Google Play services, but it's not straightforward what to do next. There are no listed permissions for files or media. There is a menu item called "Storage and cache", but there's no configuration to change.

Is it possible to use a YubiKey for Google 2FA on GrapheneOS?

spiral

kyuweftea I too want to use yubikey for Gmail on k9 but it would not work for me so I had to roll back to TOTP. I'm hoping there's a solution for this.

kyuweftea

My workaround was to use SMS as a second factor instead of yubikey. I would like to have the ability to use yubikey in this way in the future though.

Is this a bug/feature request for GMSCompat?

As a sidenote, Yubikey does work with keepass2android via ykdroid, but that's probably a separate implementation from the Google Play Services one.

kyuweftea

Looks like this is a known issue: https://github.com/GrapheneOS/Vanadium/issues/192

Hulk

kyuweftea
Yes, unfortunately

FIDO2 won't currently work because Vanadium isn't whitelisted by Play services as a browser allowed to use FIDO2 but we'll be implementing a workaround for it and we've tried to apply to get it whitelisted.

https://github.com/GrapheneOS/Vanadium/issues/192#issuecomment-1156855291

You can install Chrome browser from Play Store to utilize your Yubikey.

shorty

In Android 13, the Files and media permission has been separated into "Music and audio" and "Photos and videos". That dialog is just outdated. Oddly, Play services doesn't actually need access to you files for FIDO2 authentication to work. You can use GrapheneOS's Storage Scopes feature for this to make Play services assume it has Files permission. Tap on either of those permissions and enable Storage Scopes and it should work.

kyuweftea

Thanks for everyone's help! I tried everything again in a new profile to confirm the solution. As a summary:

install Google Chrome
enable storage scopes for Google Play Services

When the dialog sends you to the App info page for Google Play services, storage scopes can be enabled by going to either the "Music and audio" or "Photos and Videos" permissions, and enabling storage scopes. You don't need to give access to any files.