Webauthn The Fabulous works how?

[NeuronsNeeded (470 1445)]

Could someone please explain WebAuthn AND how to use it in simple terms

• I use BitWarden because I want to manage one easy to access vault without having to remember or dink around with hundreds, no actually thousands of passwords and now webauthn interfers with that.
• I use a Yubico key in extreme cases to prove I am me, and the little documentation I have found IMPLIES a security issue (bypassing 2FA) without explanation of the alleged problem. Nevertheless, I expect never to have to use Yubikey as I know. My Bitwarden master password.
• Webauthn asks for things I don’t have and in several options, don’t understand how to setup. Blocking access to my vault despite having a master password, so also blocking access to thousands of accounts, which is almost as bad, perhaps as bad, a just breaching all my accounts, at least I could change passwords and still access accounts.
  • Webauthn offers one particular way to get ‘authorized’ which I find to be a weak form of security, EMAIL. So, now you are asking me to check my email to for a code to open my vault? Isn’t that why 2FA was supposed to be better? Is this comedy or what?

And as all the BitWarden doc and posts seem years old, I’m asking the community how SHOULD we be setting up and using or how to avoid Webauthn, and why i need or want this layer challening my vault management? “Explain it, as you would [to] a child.”

Thank you.

[Nail1684]

@NeuronsNeeded I’m not quite sure if I understand everything you wrote, but if you get emails with a verification code…

@NeuronsNeeded

So, now you are asking me to check my email to for a code to open my vault?

… and you are asked to enter such a code in this dialog here…

… then that has nothing to do with WebAuthn/FIDO2, but that would be the so-called New Device Login Protection. And you’re experiencing it, because you don’t have 2FA set up for your Bitwarden account/vault.

Are this dialog and those “email verification codes” you get the thing you’re experiencing right now?

[marlin]

@NeuronsNeeded

and the little documentation I have found IMPLIES a security issue (bypassing 2FA) without explanation of the alleged problem

Can you please post a link to that documentation?

@NeuronsNeeded

Webauthn asks for things I don’t have and in several options, don’t understand how to setup.

Just to get the terminology straight: WebAuthn is a standard or specification and therefore does not ask anything. Are you referring to 2FA setup with a Passkey? What screen did you actually see and when?

@NeuronsNeeded

I’m asking the community how SHOULD we be setting up

Just configure one or more 2FA methods you feel comfortable with. For me this is my (hardware) Passkey and a TOTP app as fallback.

[grb]

@NeuronsNeeded

“Explain it, as you would [to] a child.”

Could you please do us a favor and explain more clearly the problem that you need help with? Specifically, I would like clarification of the following:

@NeuronsNeeded

now webauthn interfers with that.

WebAuthn should not “interfere” in any way with your use of Bitwarden (or the credentials stored in your vault), unless you have made the choice to deliberately enable WebAuthn-related features that are disabled by default.

@NeuronsNeeded

Nevertheless, I expect never to have to use Yubikey

This is true — you never have to use a Yubikey to use your Bitwraden Password Manager, unless you have made the choice to deliberately enable WebAuthn-related features that are disabled by default.

Thus, can you please explain which WebAuthn functions you have enabled in your Bitwarden account and why (i.e., what were you trying to accomplish?)? In addition, please describe in detail (with screenshots, if possible) how WebAuthn now “interferes”.

[Nail1684]

@grb

which WebAuthn functions you have enabled

@NeuronsNeeded For overview: there are three locations where WebAuthn (/FIDO) would be involved with Bitwarden:

1. Storing passkeys in your Bitwarden vault and using those passkeys to authenticate to your sites/accounts (–> Autofill Passkeys | Bitwarden)

2. Using “passkey”-2FA for your Bitwarden account/vault (–> Passkey Two-Step Login | Bitwarden)

3. Using passkeys as an alternative login option to your Bitwarden account/vault (–> Log In With Passkeys | Bitwarden)

If any of those is involved in your issue(s), then please clarify which exactly (apart from other details regarding the issues itself).

[grb]

@Nail1684

1. Storing passkeys in your Bitwarden vault and using those passkeys to authenticate to your sites/accounts (–> Autofill Passkeys | Bitwarden)
2. Using “passkey”-2FA for your Bitwarden account/vault (–> Passkey Two-Step Login | Bitwarden)
3. Using passkeys as an alternative login option to your Bitwarden account/vault (–> Log In With Passkeys | Bitwarden)

If @NeuronsNeeded is being prompted for the NDLP verification code (“We don’t recognize this device”), then we can probably rule out #2 and #3.

If I had to guess, it is a website (RP) that is automatically prompting for passkeys during login, and OP is assuming that these prompts are triggered by Bitwarden. For example, if doing a username/password/TOTP login on amazon.com, then a passkey prompt appears after the 2FA has been entered: