Standards Compliant Passkey User Verification

[DenBesten]

Currently, passkeys never prompt for user verification (UV), which has been noted as a non-compliance issue by the relevant standards body.

Please make Bitwarden compliant. Notably, when the Relying Party requests:

• UV=Required prompt for verification, proceeding only when successful,
• UV=Preferred prompt for verification, with the option to “skip” and reply with UV=true or UV=false as appropriate,
• UV=Discouraged proceed without prompting for verification.

This differs from a similar FR in that this proposes strict compliance, whereas the other proposes always requiring UV, apparently even when UV=Discouraged.

[grb]

@DenBesten

This differs from a similar FR in that this proposes strict compliance,

Perhaps consider adding the adjective “Standards-Compliant” to the start of your topic title…

And for the benefit of others visiting this feature request topic, I would also like to promote the following, related feature request:

Passkey User Verification Independent of Vault Unlock Method

Background: As of version 2024.6.0, Bitwarden passkeys now honor requests by Relying Parties to require User Verification. Currently, this results in the user being reprompted for their Bitwarden Master Password (or alternative vault unlock method) any time that they use a passkey for which User Verification is required (see PR 8746). For those who have strong Master Passwords and vault unlock PINs (something that Bitwarden presumably encourages), this new behavior can create significant frict…

[Nail1684]

@grb

@DenBesten

This differs from a similar FR in that this proposes strict compliance,

Perhaps consider adding the adjective “Standards-Compliant” to the start of your topic title…

I also thought that adding something like “Spec-compliant” to the title would make that more clear…

[DenBesten]

Thanks for the suggestion. Title updated.

Bitwarden previously indicated they will be adding support for this (thanks, @Nail1684 for the screenshot), but has now removed that commitment from the help document.

[EmkayCA (Mike King)]

So, even though I’ve unlocked the vault with a PIN, password, pattern, or biometric factor, I would be required to do so AGAIN each time I access a site/service that has a passkey?

[grb]

Yes, if Bitwarden starts adhering to the requirements of the WebAuthn and CTAP2 standards.

[DenBesten]

@EmkayCA

, I would be required to do so AGAIN each time I access a site/service

It depends upon what the site/service wants.

• Yes, if the site/service specifies UV=required. Bitwarden would prompt you for a PIN, password, pattern, or biometric factor at the time that you use the passkey, even if you are already logged into the vault.

• No, if the site specifies UV=discouraged then a logged in vault would be sufficient.

In other words, to remain (become) Standards-Compliant, Bitwarden needs to comply with the site’s requirements. The current state is that Bitwarden claims it verified the user when it did not.

Lying is a really good way to get blackballed, and my suspicion is that the only reason we have not seen much of it is because so many passkey providers are non-compliant.

I was motivated to create this FR after seeing the first sign of trouble. While enabling passkeys within my employer’s SSO, I had to manually whitelist Bitwarden whereas Yubikey, Apple and others were on there by default. Hoping that if Bitwarden plays by the rules, they can work their way onto vendor’s default whitelists, leading to much wider usability.