Will this change somehow with /e/OS v4.x? On my v3.7.3 the FIDO:/… links are not registered and it seems to me it cannot be easily enabled.
interesting, I’ve never been exposed to a FIDO:/ url and had to read up what it packs. The only way I debug is using the test pages https://www.passkeys.io/ and https://webauthn.io/ - on what platform can I register passkeys that will send me a fido:/ url for auth?
My use-case is using my phone as a hardware key (kind of poor man’s Yubikey Bio). Google supports it from Android 14. If you open https://webauthn.io/ on your PC (in Chrome-derived browser), it provides as one of possible methods a QR code, which codes FIDO:/code, which if open on the phone uses Google’s authentication on the phone and authentificates (using bluetooth) https://webauthn.io/ on the PC.
microg does know about the fido url scheme: fido/core/hybrid/model/QrCodeData.kt and had the “hybrid flow” merged in April, it’s in a release past 3.14. - it was front page on that release page
/e/OS 4.0 ships version v0.3.15.250932 .. /e/OS 3.7.3 (predecessor) has v0.3.13.. so it should indeed arrive with the new release. If not, check credential provider settings.
1 Like
Perfect, thanks a lot for the info. Looking forward to 4.0 on my phone.
So after update to 4.0 (and microG v0.3.15) the FIDO:/ url scheme still does not work for me. I’ve looked into the settings of microG or something, where it should be maybe enabled, but didn’t find anything.
Yes, we should switch everything over to Yubikey here, too. Unfortunately, it doesn’t work with either USB or NFC. I also tested it with the Brave browser. It gets me a little more there, but it fails in the end, too.
the release notes of 3.14 lists three different flows, with nfc being the experimental, the other two are
- where a microG device has the passkey and does scan a qrcode from a different device
- where microG doesn’t have the passkey and presents a qrcode to a device that does have the passkey
I should do some fido testing again - but last time I did, microG has a local, non-syncing way of storing a passkey.
Which scenario do you test in what way, as in concrete steps? microG can’t use any Passkeys known to a Google Account on its device as far as I know. If it’s the scanning device, its own passkey needs to be enrolled with the service you authenticate on a pc/laptop.
I was startled by your line, as I don’t understand why “Google” is used there:
.. which if open on the phone uses Google’s authentication on the phone and authentificates (using bluetooth) on the PC
My scenario is number 1. But with registering the passkey to the microG device, where the passkey does not exist yet.
The concrete steps are:
- open in Brave/Chrome https:// webauth .io (sorry for the split, and click on Register
- get the QR code (the text says: Use your phone or tablet. Scan this QR code with camera on the device where you want to create and save your passkey for https:// webauth .io)
- scan it with the microG device and save the passkey (I was talking about Google, because on plain Googled Android this is now taken into the Google passkeys and authentications, in microG, I suppose this should be handled by the authentication “subsystem” as well, that thing requiring fingerprint when used directly on the device for instance)
- open in Brave/Chrome https:// webauth .io and click on Authenticate
- get authenticated via the microG device
Does not seem to be working in the 4.1.1-a16.
This topic was automatically closed after 60 days. New replies are no longer allowed.