Ext issue Biometric Unlock doesn't recognize BW windows app is running & unlocked

I am by no means an expert in this area (having never enabled Windows Hello), but I believe that if you have enabled biometrics in Windows Hello, then the Windows Hello biometrics prompt also gives you a “fall-back” option to enter a previously configured Windows Hello PIN (unrelated to your Bitwarden PIN) instead of using biometrics.

Do you see a “More choices” link on the Windows Hello prompt, and if so, does that give you the option to enter a PIN?

grb

Hi, thanks for your reply! After the error is shown in the extension, I don’t even get the Windows Hello popup screen. It only gives me the option of entering in my master password each time.

I can however, set a PIN for the extension in the settings and use it instead.

And when you try to do the same with the desktop app?

If you believe that the issue you are experiencing is different than what has been described in Github Issue #13291, then please provide detailed information about how your issue differs from the known issue. Also, if you have not already done so, please (temporarily) install Chrome, and check if the issue is reproduced there, as well.

With the desktop app I get the Windows Security Windows Hello pop up screen and can enter my Windows Hello Pin and unlock it.

I did explain the error with a screenshot and steps. I also installed Brave which is also Chrome based and it also has the same issue.

By way of background, there are two completely separate PINs.

The Bitwarden Unlock PIN

...has absolutely nothing to do with biometrics and does not need any sort of interprocess communication to function. It is handled completely internally to Bitwarden and can be used to unlock, but not to login to your vault.

It is configured in bitwarden extension >> settings >> account security >>>unlock with PIN


Help is available at Unlock With PIN | Bitwarden .

The rest of this comment does not discuss Bitwarden’s unlock PIN.

This Windows Hello PIN

...is part of the Windows operating system. Hello is Window's interface to the TPM and only works locally on a single device. Hello can not be used when remoting in, e.g. with Remote Desktop. Hello has three ways of authenticating, face, fingerprint and PIN. The Bitwarden desktop app can access Hello to unlock a vault (agin, but not login) by retrieving your encryption key from a combination of Credential Manager, the TPM, and the biometric device. The biometric data never leaves Hello, including the Hello PIN. Bitwarden considers all three methods biometrics.

Interesting tidbit is that web browsers do not permit extensions to access Widows Hello. Because of this, the extensions use inter-process communication to ask the desktop perform the authentication on their behalf and return the encryption key to the extension.

This is the Hello login screen, with PIN selected from “more choices”.

It is configured on the windows menu >> settings >> Acocunts >> sign-in options.

help is available at Unlock With Biometrics | Bitwarden.

The Chrome Problem

The “Chrome Hello Face” bug manifests itself as an error on the Windows Security prompt. This indicates that a number of things have succeeded:

  1. The extension understood the request to use biometrics
  2. The extension was able to forward the request onto the desktop app.
  3. The desktop app was able to ask Windows Hello to authenticate.
  4. Hello successfully recognized my face and asked me to click OK.
  5. An error message “something went wrong” is displayed inside the Windows Hello prompt.

My personal guess is that extension is passing something through the desktop and onto Hello that Face does not like, but PIN does not care about.

Randy's problem

@randy 's problem appears quite different. He is getting a message "Bitwarden desktop is closed" in a Bitwarden window. This implies a failure happening much earlier, at step 2. Things I would suggest @randy try (restating earlier comments for completeness):
  1. Verify desktop app and extension are both relatively current and a similar version.
  2. Carefully review the unlock with biometrics instructions, making sure each setting is set as expected, both in the desktop app and the extension.
  3. Pay particular attention to the note “…ask you to accept a new permission for Bitwarden to communicate with cooperating native applications. This permission is safe, but optional, and will enable the integration that is required to enable unlock with biometrics. Declining this permission will allow you to use the browser extension as normal, without unlock with biometrics functionality.”
  4. Try totally disabling biometrics in the extension and unchecking “Allow browser integration” in the desktop app. Then, follow the instructions to set up biometrics again. I have found that sometimes it claims success, but does not work till I review all the steps and find the one checkbox that did not save its setting. When @Nail1684 suggests “disabling Windows hello”, I believe this is what he is referring to, not disabling it at the OS level.
  5. Bitwarden has a bit of a reputation for leaving bits of old versions around when one upgrades, which then causes weird behaviors. This typically can be fixed by uninstalling, deleting local storage and reinstalling (again as @Nail1684 earlier suggested).
2 Likes

Actually, I think I suggested both in this thread here. Setting up biometrics for the BW apps again (i.e. disabling and re-enabling it) would be one of the first things to try. Resetting Windows Hello as a whole, I only suggested as a “last resort” (and @Neuron5569 warned validly, that would reset all FIDO credentials in Windows Hello).

@randy One additional thing I thought the last days: do you have restricted rights of the desktop app, browser and/or browser extension in any way? Like also anti-virus / anti-malware software interfering here? Or did you “sand-box” some processes, or using a virtual machine?

Do you have a second computer (laptop/desktop), where you could test if you get the same result with your setup?

I think you now mentioned Edge and Brave (and @grb suggested to try it with Chrome browser also, and I would still suggest that you do that also) - but maybe just for the experiment try the same with Firefox? (it may be some bug with Chromium-browsers on your system?!)

1 Like

Thanks again for all of your help and also thanks to the others on this thread!

I have full admin on the computer

I have not tried disabling my AV yet, but I can give it a try. I have not sandboxed it. But it does work on other computers I have which run the same AV and extensions.

See above. Windows Hello does work for the BW desktop app, just not the extension. I tried Exiting the BW app, then removing the extension. The I reinstalled the extension and tried enabling Windows Hello without the app running and got the same error, of course. So I ran the BW desktop app and re-enabled browser integration. The extension still has the same error.

The thing is, this all worked at one point. I just don’t know when this issue happened or what changed, except for MS updates and the BW app updating.

At this point, I’ll have to settle for using the extension PIN, or the Master PW until BW fixes the extension issues.

Ah, so it does work to unlock the browser extension with biometrics on other computers of yours?

… of course, there are still open issues (the already mentioned GitHub issue #13291…) but this then seems to be something with your system/computer again - and I’m not sure that new versions of the desktop app and browser extension will fix this for you. (but maybe they do) :thinking:

If we’re casting a wide net, it may be worthwhile to also check the extension’s permissions in Edge (something that came up in a different thread recently). Go to:

edge://settings/content/siteDetails?site=chrome-extension%3A%2F%2Fjbkfoedolllekgbhcbcoahefnbanhhlh

Verify that all settings are set to either “Allow” or “Ask” (except for “Insecure Content”, and “Intrusive Ads”).

In addition, go to:

edge://extensions/?id=jbkfoedolllekgbhcbcoahefnbanhhlh

Verify that the “Site Access” option is set to “On all sites”, and that the listed permissions are:

  • Read your browsing history
  • Display notifications
  • Read and modify data you copy and paste

Just a note, Randy appeared to have disabled and enabled Windows hello here:

1 Like

Thanks for the suggestions.

This was set as you stated.

This was also set as you stated, except I had an additional permission:

  • Read and modify data you copy and paste

I have doubts too. Especially with the error being different from GitHub issue #13291

I mentioned earlier that I do have a backup image of my C: drive that I could restore to. I have full backups taken in January & May. I also have a differential backup taken in April. I just don’t know when the issue started to pick the correct one and it’s a pain to restore, then update everything to current if I get it right. I was hoping there was going to be a quick solution but alas, no luck. I may have to bite the bullet and just do it. :disappointed_face:

Thanks for the suggestion. I did just install Firefox and it does work. Its definitely an issue with the Chrome browser/extension. Unfortunately, Firefox isn’t a browser I want to use regularly. I had too many issues with it causing low memory resources.

1 Like

Yeah, that does indicate that – and probably, that the desktop app isn’t the problem. (though it could still also be an interaction on Chrome browsers with the desktop app)

Did you use Edge and Brave before - or did you install one just recently?

You might try a fresh installation with another Chromium-based browser (only for testing) - like e.g. Vivaldi. If that would also work, “resetting” Edge or Brave might be another consideration. (in the thought, that somehow something with the browsers “went bad” and could be “repaired” that way)

Edge was the only browser I was using on this computer (I have 3) until I installed Brave to troubleshoot.

These are good suggestions, but sine I just installed Brave it should be good? Edge could be corrupt somehow I suppose, since it’s been the only one I’ve used on this computer. Or try another browser Chrome like Vilvaldi.

Have you tried reaching out to support again and explaining how your case differs from the chrome-hello-face issue, maybe referring them to this thread. Maybe they will have some ideas, or maybe it will cause an internal escalation.

Yes, but no reply yet.