Bitwarden hijacked passkey creation but did nothing later

Ask the Community Password Manager
,
1

When I tried to use my yubikey as a security key to my google account, bitwarden hijacked the passkey creation process and I couldn’t bypass it for yubikey. So I said OK let me try and see what bitwarden passkey could do for now and let it add a passkey in the related google account.

Now whenever I try to do something and google asks for passkey, nothing happens. Bitwarden doesn’t do nothing with its passkey sitting in the vault.

The account is half locked now. I can’t change any security settings because I lost the passkey to bitwarden.

2

@bitgarden Hi!

In the popup window, there is this option with which you could have gotten to the YubiKey:

image

So your Google passkey is still in your “Google” vault item in Bitwarden?

In the extension, go to Settings → Excluded domains. If there are Google domains in the list, delete them.

(In Settings → Options → “Passkeys” are activated, I assume? Otherwise Bitwarden wouldn’t show you the passkey-popup…)

1 Like
3

In the popup window, there is this option with which you could have gotten to the YubiKey:

I know this. It was there for 2fa security key. But there wasn’t this option for passkey creation. You can try on google website adding passkey (not 2fa security key).

I will try exclude google domain and see if bitwarden would work as passkey. I do have google domain in the excluded list.

1 Like
4

Then you need to delete it from the excluded list (if you want to use the passkey stored in Bitwarden).

1 Like
5

Deleting google domain from the excluded list gets bitwarden to be used for passkey prompt.

Now we still need one more thing to fix: bypassing bitwarden passkey intervention. There’s no opt out option in either passkey creation or usage.

The following is me trying to creating a new passkey but getting hijacked by bitwarden:

image
image1063×712 26.3 KB

1 Like
6

In your browser extension, go to Settings > About. What version of the browser extension do you have installed? And what is your browser and operating system?

7

Linux x86-64bit
brave browser:
Version 1.66.115 Chromium: 125.0.6422.112 (Official Build) (64-bit)

Bitwarden Password Manager 2024.4.2

8

Not sure why your prompt looks like that. In the 2024.4.2 browser extension for Chrome on Windows 11, if Bitwarden already has a passkey for a site, then the prompt looks as follows:

image
image366×564 11.2 KB

 

In the above prompt, clicking Save passkey leads to the following alert:

image
image366×563 10.6 KB

 

It’s unclear to me why your prompt looks so different.

Perhaps you can try creating a test account on the demo website https://www.passkeys.io/, then saving a passkey in Bitwarden, and subsequently creating a second passkey to store in Bitwarden. Do you get the same prompt (“A passkey already exists for this application”) as you are getting on google.com, or do the prompts now look like mine?

Unfortunately, I don’t have a Google account for testing, and I’m not about to create one.

9

Tried on passkeys.io so there was the option for using hardware keys instead.
I don’t know why it wasn’t there when I was creating a passkey for google, whose domain name had even been in the exclusion list at that time.
There was also a brave browser update between then and now. So not sure what happened…

10

So is it working on Google, too, now?

11

Not OP but I’m facing the same issue: When creating passkeys for other websites I’m able to chose for “Use your device or hardware key” but not for Google. This option simply doesn’t exists. Adding “google.com” to the exclusion list doesn’t work either.