✅ Store WebAuthn/FIDO2 Credentials in Bitwarden (Passkey support)

Feature Requests Password Manager
, ,
104

Completely. Unless a website has a Single Sign On (SSO) domain (it is not an issue in that case), we are stuck (needing to duplicate the Vault Item) if it has multiple domains.
I created a feature request here Allow storing multiple passkeys on one vault item for the above subject

@DoctorB Same here on Windows, but it does work with Google on my Mac and Raspberry PI !
If you go into Passkeys (in google manage account) and click “give it a try” button then it works OK but not if you actually login with Chrome on Windows.

Thanks, it’s completely the same behavior as me, that’s a good start :slight_smile:
I just found a previous issue about that on GitHub. Please refer to that answer: Passkey not found · Issue #6764 · bitwarden/clients · GitHub => we need to write to them and put a reference to this issue, saying that we have the same behavior.

1 Like
106

@DoctorB I got a reply by email and they reopened the issue on GitHub for the passkey not found on Google as they were able to reproduce it based on my video recording :slight_smile:

107

@Handwrite8268 Dissapointing to see the issue closed yesterday suggesting you had not unlocked your BW vault.
I noted an update last night 2023.10.1 so I waited to see if the bug was fixed. It isn’t :frowning: :cry:

Well done on getting the bug report reopened :+1:

1 Like
108

That was a suggestion to the original reporter of the issue I found with a search, but still a bit disappointing, yes. I sent them the issue link in my email with the video evidence and it was reopened.

109

I’m getting the same issue logging in to Google. Not sure if it matters than the the subdomain where the passkey is created is myaccount.google.com and the subdomain on login is accounts.google.com?

110

I wondered the same for a minute at the beginning, but it’s working with other passkeys managers, so it should not be an issue. It’s working with 1Password and with Windows Hello for example.

For the domains rules, the specifications here Create a passkey for passwordless logins  |  Articles  |  web.dev are telling that a website’s relying party ID (rp.id) can only be its base domain or any subdomain to let the user login on a specific subdomain, or on all of them.
But as it’s working with other passkeys managers, I guess that Google is sending its base domain “google.com” as a relying party ID :slight_smile:

111

I doubt it relates to a sub domain because I can login to Google with passkeys and BW on my MacBook and Linux box. Same google account, same browsers, same bitwarden extension, same passkey.
The problem seems to only happen on Windows.

112

Yes I forgot that part, one more reason that is confirming my thought, thanks :slight_smile:

113

It seems it is:

$ bw get item *** | jq '.login.fido2Credentials[]'
{
  "credentialId": "***",
  "keyType": "public-key",
  "keyAlgorithm": "ECDSA",
  "keyCurve": "P-256",
  "keyValue": "***",
  "rpId": "google.com",
  "userHandle": "***",
  "counter": "***",
  "rpName": "Google",
  "userDisplayName": "***@gmail.com",
  "discoverable": "true",
  "creationDate": "2023-11-02T19:08:10.687Z"
}
1 Like
114

Thank you for the confirmation :slight_smile: So it’s definitely an issue on BW side :slight_smile:

115

Please add a setting in ‘Options’ to turn it off - I cannot login with my FIDO2 hardware key as second factor any more because Bitwarden extension is hijacking it (only to say ‘no passkeys found’, brilliant).

To make it worse the pop-up doesn’t render correctly until I move it to its own workspace (tiling window manager). ‘Use browser’ does nothing but close it, still doesn’t return control correctly to the browser/key.

This is not really related but seems to have started happening in the same update: logins are getting stored in Bitwarden without me consenting to do so on the pop-up (ignored or dismissed).

116

For me “Use browser” does work, but I also think it’s really annoying. If I don’t have a passkey then don’t open the window, just let me use my security key right away!

117

I’m seeing the same thing. In the past I was using Apple TouchID as my MFA and it worked great. Now when I try to log into things I get the Passkey dialog box and I can no longer just touch my keyboard to log in. I guess I could hit the “Use browser” link but that just adds extra steps to my process.

NOTE: It might be better to start a whole new post with this information rather than hijacking this one.

118

There is one…

119

Mobile will come in a future release.

Can you put a rough timeline on this? Will this be soon-ish or rather later like 2025 or would it be best to not hold our breaths?

Thanks :slight_smile:

1 Like
120

It doesn’t just depend on Bitwarden …

Note: Starting from Android 14, users can opt to use third-party credential management apps to store their passkeys.

1 Like
121

Yeah, we know it’s possible in Android 14 and in iOS 17. Of course that means a lot of people are left out, but having it on those platform would be great, and I hope it’s from sooner rather than later.

122

True, but Google and Apple release like clockwork, so planning a roadmap accordingly is not a stretch, and Android 14 was released 6 weeks ago, iOS 17 was released in September.
Both companies release developer / “beta” versions early so apps can be ported to them.

123

Hopefully you have already seen this as there is now the option to Use device or hardware key when the prompt comes up for a passkey. Select the option “for this site” so the browser extension will save a prefer to exclude the site for passkey prompt.

124

Closing this topic as passkeys have been available since October 2023 for the browser extension. Follow this topic for updates on passkey support on the mobile app.