Why doesn't Bitwarden ask for the FIDO2 PIN when using Webauthn?

[Nail1684]

@unkulunkulu

So this is FIDO 2 Webauthn and not U2F? Also, does it use a resident key?

No expert here, but it’s FIDO2 / WebAuthn protocol (and not the FIDO/“FIDO1” U2F protocol).

(–> Passkey Two-Step Login | Bitwarden)

And it uses a non-discoverable credential (or server-side credential – “non-resident” would be a somewhat outdated terminology).

See this lengthy and also “confusing” – or “confused” – thread: Discussion about U2F vs FIDO2 passkeys for Bitwarden Two-Step Login

@unkulunkulu

So this probably means that this is not U2F, but a non-resident FIDO 2 webauthn, which I thought was not a thing.

It’s a thing – I posted the definitions here: Make Login Passkeys Identifiably Distinct from 2FA Passkeys on End Device - #18 by Nail1684

PS: The discussion about WebAuthn and U2F seems to be even more complicated – see this discussion here. If I sum up that discussion correctly, even older (FIDO1) “U2F” keys can still be added, but they then use the (FIDO2) WebAuthn protocol. (however this technically works… don’t ask me…)