Question on FIDO2 WebAuthn (2FA) - FIDO2

Ask the Community Password Manager
1

Hello Bitwarden Community,

I just got two new YubiKey 5C security keys and just went through the process to set them up on all my accounts. On my Microsoft account, the webauthn setup process stored a resident credential record for microsoft.com in the key itself. I can view this using the “ykman fido list” command line function that Yubico provides. However, after setting up the key on the Bitwarden site I do not see a resident FIDO2 credential record stored on the key. The key is working on the Bitwarden site and appears to be using the browser’s webauthn functionality. I’m just confused as to why the resident FIDO2 credential record is missing for bitwarden.com. Maybe this is because the Microsoft site allows passwordless login (via Edge only) and Bitwarden’s site does not? Any insight would be appreciated.

Thanks,
John

2

Resident keys are only used for “passwordless” logins or attestation. They key replaces the “username” or proves the manufacturer. If you’re already supplying a username, there is little to no benefit.

3

Makes sense. Thanks for the confirmation. :+1: