I'm trying to set up my Gmail account in K-9 Mail, and it opens the browser to log in to a google account. I use a yubikey for 2FA for my google account. The issue is, the following notification appears just as the page waits for the yubikey button to be pressed:

Google Play services error
Please complete action required by Vanadium

Clicking the notification gives a dialog box with the following:

This app won't work properly unless you allow Google Play services' request to access the following:

  • Files and media

To continue, open Settings, then Permissions, and allow all listed items.

Clicking through opens the App info page for Google Play services, but it's not straightforward what to do next. There are no listed permissions for files or media. There is a menu item called "Storage and cache", but there's no configuration to change.

Is it possible to use a YubiKey for Google 2FA on GrapheneOS?

    My workaround was to use SMS as a second factor instead of yubikey. I would like to have the ability to use yubikey in this way in the future though.

    Is this a bug/feature request for GMSCompat?

    As a sidenote, Yubikey does work with keepass2android via ykdroid, but that's probably a separate implementation from the Google Play Services one.

    In Android 13, the Files and media permission has been separated into "Music and audio" and "Photos and videos". That dialog is just outdated. Oddly, Play services doesn't actually need access to you files for FIDO2 authentication to work. You can use GrapheneOS's Storage Scopes feature for this to make Play services assume it has Files permission. Tap on either of those permissions and enable Storage Scopes and it should work.

    kyuweftea I too want to use yubikey for Gmail on k9 but it would not work for me so I had to roll back to TOTP. I'm hoping there's a solution for this.

    Hulk changed the title to FIDO2 won't currently work because Vanadium isn't whitelisted by Play services .

    Thanks for everyone's help! I tried everything again in a new profile to confirm the solution. As a summary:

    • install Google Chrome
    • enable storage scopes for Google Play Services

    When the dialog sends you to the App info page for Google Play services, storage scopes can be enabled by going to either the "Music and audio" or "Photos and Videos" permissions, and enabling storage scopes. You don't need to give access to any files.