Problem
Login with passkey from another device does not work:
Bitwarden Web app in Win11 VM’s thinks the Samsung S10+ phone passkey belongs to my Samsung Galaxy Tab S2 tablet (which is way too old to support passkeys).
There seems to be a corruption in my Bitwarden Samsung Galaxy S10+ passkey when attempting ‘Login with passkey’ on the Web app in Chrome from a Windows11 PC VMware Workstation Windows11 virtual machine.
The problem only manifests in both Windows11 VM’s (but not the host PC Win11 OS). However the VM’s are where I need the functionality to work - so that I can use my phone as a passkey 2FA device and don’t need to buy a separate Yubikey for each VM, or continually manually switch my existing USB Yubikey between the host and different VM’s every time I need to authenticate.
‘Login with passkey’ also does not work back the other way from Android Samsung S10+ to any Win11 host or VM OS.
How do I resolve this?
.
My Devices:
- Windows11 PC (MSI Z590 motherboard, Intel CPU 8-core, 64GB RAM, NVMe4 C: drive)
- Windows11 VMware Workstation VM’s.
- Samsung Galaxy S10+ phone with Secure Folder sandbox enabled (Model: SM-G975F. Android version: 12)
Bitwarden on Windows11 thinks the S10+ passkey belongs to:
- Samsung Galaxy Tab S2 tablet (Model: SM-T819Y. Android version: 7.0)
The S2 tablet is way too old to support any passkey functionality whatsoever.
.
My Bitwarden Web app login passkeys:
Bitwarden web app / Security menu / Log in with passkey section:
-
Yubikey 5C NFC (Used for encryption)
-
YubiKey 5C Nano (Used for encryption)
-
Samsung Galaxy S10+ (Used for encryption)
-
Windows11 VM #1 (Encryption not supported)
-
Windows11 VM #2 (Encryption not supported)
.
Detail of Problem:
Attempting Bitwarden web app login in Chrome browser from the Windows11 PC:
Click ‘Login with passkey’
Click ‘Use a different passkey’
Click ‘On other devices’:
From ‘SM-T819Y’ (Samsung Galaxy S2 tablet. Should say: ‘SM-G975F’ (S10+))
‘A notification was sent to SM-T819Y’ (Should send to: SM-G975F … so authentication has failed)
.
Click ‘Try again’
Click ‘Use a different passkey’
Click ‘Use a different phone, tablet or security key’
Click ‘Use another device’
Click ‘More choices’: then click ‘iPhone, iPad, or Android device’
It then presents the QR code.
It will not successfully authenticate with QR code via either the Samsung S10+ or ‘SM-T819Y’. The Android device cameras on both devices read the QR code, but the URL does not establish communication and validate the authentication attempt. It just times out attempting.
.
Attempting ‘Login with passkey’ in the opposite direction (from S10+ to Win11) presents a similar problem.
From the Web app in Chrome browser on S10+ to both Windows11 host and Win11 VM it presents, then accepts, the ‘Are you trying to login’ window with the ‘Fingerprint phrase’ after clicking on ‘Confirm login’.
But then it fails with error on the S10+ ‘No passkey found on device’. Even though I have a fully functioning Yubikey inserted into the Win11 PC, and a Windows Hello passkey created in Bitwarden for each Win11 virtual machine.
If I use the Yubikey 5C Nano inserted into my S10+, local passkey login works immediately.
I need ‘Login with passkey’ to work from the S10+ to the Win11 PC, because neither the USB nor NFC Yubikeys work in the Samsung Secure Folder sandbox. This is where I store all my sensitive Android apps that require passkey login. Android blocks USB and NFC into Secure Folder.
.
Total Passkeys:
- I have about 25 relying party passkeys setup in each of the five above passkey authenticators.
- The Bitwarden sync’d passkeys work fine on the S10+ for relying party passkey login’s on both the Android host OS, and in Samsung Secure Folder.
- Apart from the ‘Login with passkey’ problem, all of these passkeys work fine on all supported devices, O.S.’s, and virtual machines.
.
Possible solution but catch:
- I could try deleting the ‘Samsung Galaxy S10+’ passkey and recreating it, to see if it fixes the corruption. But then I would have to re-create the passkeys for the 25 relying party passkeys attached to that Android S10+ device passkey.
- Plus, I would have to re-create all passkeys for all devices with relying parties that do not allow labelling of passkeys – there is no way to identify which passkey is which, so they all need to be deleted and re-created.
- Even if I did all that work, there is no guarantee it would fix the corruption.
Is there an alternative way to fix this?