Passkeys not working on certain sites #10374

t4moxjc7 · 2024-03-10T19:03:04Z

Not working

Browser	Passkey Action	URL	Website error	KeepassXC error	Notes	Team response	PR 2141 a80fe66 fixes issue	v1.9.0.3 fixes this issue
Chromium	Create	https://en.wikipedia.org	InvalidArgumentException	[none - prompt can be gone through successfully before website error]	This may not be a KeepassXC bug, as it worked on another MediaWiki wiki.		No	No
Chromium	Create	https://www.playstation.com	A passkey couldn't be created for this device or you cancelled creating a passkey.	No supported algorithms were provided			No	No
Chromium	Use	https://gitlab.com	404.	[None]				No
Edge	Create	https://bestbuy.com	Unspecified Error
Chromium	Create	https://microsoft.com	We encountered an issue setting up your security key.	[none - prompt can be gone through successfully before website error]		Only security keys can be registered.	No	No
Brave, Chromium	Create	https://passkey.org/	[blank error]	[none - prompt can be gone through successfully before website error]			No (on Chromium)	No (on Chromium)
Firefox	Use	https://coinbase.com			#10374 (comment)
Chrome	Register	https://vercel.com	"Passkey registration could not be verified. Please try again."	[none - prompt can be gone through successfully before website error]	in debug console there is "400 bad request" in final step. #10486
Chrome	Create	https://zoho.com	"Use device instead of security key"	None		Will be fixed in the next version	No	No

Restrictions

Website	Restricted to / explanation
Amazon	With desktop only Chrome works
Kayak	Only works with Chrome with newer operating systems
Nintendo	Only works with Chrome
PayPal	"Passkeys can only be created on devices for which you have set up a screen lock with Chrome (Android or Apple iOS devices) and Safari (Apple devices only) browsers". However, a security key can be registered instead.
X/Twitter	Only security keys can be registered, which is not working. Passkeys are supported only with Android and iOS.

Instructions

Enable Debug Logging from the extension settings and see if the Web Developer / JavaScript console has any error messages. That is helpful for detecting possible errors.

varjolintu · 2024-03-10T19:52:07Z

It would be also nice to report with what browser the problem occurred (some sites might have exceptions for Firefox). The Passkeys support is not yet fully complete, so reports like this were expected. Some of the problems might be possible to fix on the extension side.

varjolintu · 2024-03-10T20:14:40Z

GitLab does not set rp.id at all, and one check on KeePassXC side fails (the check returns too soon). Eventually this must be fixed on KeePassXC side, but we can also add an exception to the extension.

t4moxjc7 · 2024-03-10T20:20:53Z

It would be also nice to report with what browser the problem occurred (some sites might have exceptions for Firefox). The Passkeys support is not yet fully complete, so reports like this were expected. Some of the problems might be possible to fix on the extension side.

Good thought, I've added the browser for my entries.

varjolintu · 2024-03-10T20:46:37Z

PayPal says in their FAQ:

Who can set up a passkey?
Passkeys are currently available for eligible personal and premier accounts. Passkeys can only be created on devices for which you have set up a screen lock with Chrome (Android or Apple devices) and Safari (Apple devices only) browsers.

It's possible to register a 2FA security key to KeePassXC, but when trying to authenticate it, the request only supports usb, nfc and ble transports. KeePassXC currently requires internal to be in this list.

droidmonkey · 2024-03-10T21:23:34Z

Seems a little strange to allow registration though? How come there is no constraint on that side?

varjolintu · 2024-03-11T04:47:23Z

Seems a little strange to allow registration though? How come there is no constraint on that side?

This works because we allow cross-platform authenticators as well, possibly acting as security keys. Microsoft's site is the same, but there's no separate Passkeys section at all. Just a security key option.

klixx23 · 2024-03-11T05:41:41Z

Hello,

i have also found another website

Browser	Passkey Action	URL	Website error	KeepassXC error	Notes
Brave	create	https://passkey.org/	[none]		PassKey created and save in database, but login is not possible

traviss64 · 2024-03-11T08:13:47Z

My question is how to add passkey on keepass? It only shows an option to "impport passkey" but most sites I use passkey on don't have an option to export passkeys

Edit: Okay had to enable in the extension

Getting error - Origin and RP ID do not match. on techlore forum

luzat · 2024-03-11T10:50:36Z

I have tried to add a Passkey to coinbase.com using the Firefox browser extension. KeePassXC 2.7.7 added this key to its database, but Coinbase stored it as a security key (just like a YubiKey). Now, when trying to authenticate, Coinbase can't find the security key, possibly because it's requesting only usb and nfc:

{
  "challenge": "***",
  "enterpriseAttestationPossible": false,
  "rpId": "coinbase.com",
  "timeout": 30000,
  "userVerification": "discouraged",
  "allowCredentials": [
    {
      "id": "***",
      "transports": [
        "usb",
        "nfc"
      ],
      "type": "public-key"
    }
  ]
}

After patching kpxcPasskeysUtils.buildCredentialRequestOptions in passkey-utils.js (transports: [...transports, 'internal']) I was able to authenticate with Coinbase again, even though it requested an external key. An advanced option in KeePassXC to allow handling usb and nfc requests would be helpful. Also, the original registration should either not have succeeded or somehow indicated that the key is a Passkey, not a hardware security key.

varjolintu · 2024-03-11T14:07:30Z

Deleted Namecheap from the list. They only support U2F keys.

varjolintu · 2024-03-11T14:09:15Z

Seems GitLab is using this extension: https://www.w3.org/TR/2019/REC-webauthn-1-20190304/#sctn-appid-extension (which we are not handling yet).

varjolintu · 2024-03-11T14:43:02Z

keepassxreboot/keepassxc-browser#2141 This PR can be tested with the problematic sites.

t4moxjc7 · 2024-03-11T16:10:31Z

keepassxreboot/keepassxc-browser#2141 This PR can be tested with the problematic sites.

I've put test results for my entries (and passkey.org) in the table now - its fixed PayPal and Discourse.

I also removed google from the table as that is now working with the current extension version. Maybe a change on their end or I did something differently.

varjolintu · 2024-03-12T04:52:38Z

In my own testing Nintendo should be also fixed. For Playstation.com I could not log in even with normal credentials (there's always some error).

With Microsoft I managed to create a Passkey and login normally. After that I tried it again and then it just gave me a OS/browser level popups again. I really don't know why it fails most of the tries.

Wikipedia requires a separate rollout for 2FA with new users, so I didn't manage to test that. I'd like to see some debug data if possible.

(If anyome wants to help the process, enable Debug Logging in the extension and inspect the JavaScript console on the web page during logins. You can find the public key objects there.)

varjolintu · 2024-03-12T06:25:54Z

For MangaDex (which uses Keycloak), I am unable to set up a passkey since it returns the following:

Security key registration result is invalid.
9: No supported algorithms were provided.

(Note: I can create and use passkeys with GitHub, so I am wondering whether MangaDex's issue is similar to bitwarden/clients#6804 .)

This seems like a Keycloak issue, that is already resolved: keycloak/keycloak#20832
Can you verify if the algorithm identifier is still a string with the site you are using?

varjolintu · 2024-03-12T06:35:54Z

Can you verify if the algorithm identifier is still a string with the site you are using?

How do I check the algorithm identifier (on Firefox)?

Enable Debug Logging from the browser extension settings and inspect the JavaScript console via Inspect when right-clicking on the web page. It should show you the Public Key object during register (do not paste any ID's or actual data from it here).

varjolintu · 2024-03-12T07:03:01Z

Is this the information you requested?

[Debug passkeys.js:36] KeePassXC-Browser - publicKey global.js:124:13
(... ... ...) pubKeyCredParams: (6) (... ... ...) global.js:127:17
[Debug keepassxc-browser.js:843] KeePassXC-Browser - No supported algorithms were provided. global.js:124:13

Yes. That object should include the pubKeyCredParams list.

t4moxjc7 · 2024-03-12T13:09:19Z

In my own testing Nintendo should be also fixed. For Playstation.com I could not log in even with normal credentials (there's always some error).

With Microsoft I managed to create a Passkey and login normally. After that I tried it again and then it just gave me a OS/browser level popups again. I really don't know why it fails most of the tries.

Wikipedia requires a separate rollout for 2FA with new users, so I didn't manage to test that. I'd like to see some debug data if possible.

(If anyome wants to help the process, enable Debug Logging in the extension and inspect the JavaScript console on the web page during logins. You can find the public key objects there.)

No luck with Nintendo, but here is the debug output for Wikipedia:

{
    "attestation": "none",
    "authenticatorSelection": {
        "requireResidentKey": false,
        "userVerification": "preferred"
    },
    "challenge": "[removed]",
    "pubKeyCredParams": [
        {
            "type": "public-key",
            "alg": -7
        }
    ],
    "rp": {
        "name": "Wikipedia",
        "id": "en.wikipedia.org"
    },
    "timeout": 60000,
    "excludeCredentials": [],
    "user": {
        "displayName": "[removed]",
        "id": "[removed]",
        "name": "[removed]"
    }
}

varjolintu · 2024-03-12T13:47:30Z

@t4moxjc7 Nintendo.com still works fine for me. The debug output of Wikipedia doesn't show anything strange.

EDIT: And just tested Microsoft again. It let me create a Passkey and even sign-in works without problems.

Ollipop030 · 2024-03-13T12:10:54Z

Nintendo.com still works fine for me. The debug output of Wikipedia doesn't show anything strange.

EDIT: And just tested Microsoft again. It let me create a Passkey and even sign-in works without problems.

Strange, Nintendo doesn´t work for me on Brave Browser, "Passkeys cannot be used on this device."

And Microsoft: I can´t even find where to add passkeys. I can add hardware keys (such as a yubikey). When want to convert my account to a passwordless account, it wants me to scan a qr code via the MS authenticator app.

CrendKing · 2024-03-13T13:30:42Z

bitwarden.com doesn't work for me. Error message:

Error creating passkey

There was a problem creating your passkey.

Debug output:

{
    "attestation": "none",
    "authenticatorSelection": {
        "requireResidentKey": true,
        "userVerification": "required"
    },
    "challenge": "<redacted>",
    "extensions": {
        "prf": {}
    },
    "pubKeyCredParams": [
        {
            "type": "public-key",
            "alg": -7
        },
        {
            "type": "public-key",
            "alg": -257
        },
        {
            "type": "public-key",
            "alg": -37
        },
        {
            "type": "public-key",
            "alg": -35
        },
        {
            "type": "public-key",
            "alg": -258
        },
        {
            "type": "public-key",
            "alg": -38
        },
        {
            "type": "public-key",
            "alg": -36
        },
        {
            "type": "public-key",
            "alg": -259
        },
        {
            "type": "public-key",
            "alg": -39
        },
        {
            "type": "public-key",
            "alg": -8
        }
    ],
    "rp": {
        "id": "vault.bitwarden.com",
        "name": "Bitwarden"
    },
    "timeout": 60000,
    "excludeCredentials": [],
    "user": { <redacted> }
}

varjolintu · 2024-03-13T13:45:33Z

@CrendKing We don't support the prf extension yet, which is required by Bitwarden's login.

varjolintu · 2024-06-27T16:54:52Z

@wichtounet That sounds a bit weird. Do you have multiple passkeys defined under the problematic account? I think the creation should fail for every account if there's a systematic problem. You can enable debug logging from the browser and see if the public keys created have some differences. It could help narrow down the issue. (Do not paste them here without omitting important data)

wichtounet · 2024-06-27T19:02:17Z

@varjolintu I have two passkeys, each for a different email. I have looked into the debug messages. One thing I have noticed is that for the passkey that works, one of the challenges is matching KPEY_PASSKEY_CREDENTIAL_ID. For the passkey that does not work, nones of the challenges is matching this value. Should I regenerate the passkey that does not work?

varjolintu · 2024-06-27T19:50:40Z

@wichtounet That's worth trying.

wichtounet · 2024-06-28T04:26:27Z

@varjolintu Updating the passkey did the trick! I must have done something dumb to break it. Thanks!

uprprc777 · 2024-08-21T09:59:52Z

I had no issues creating a passkey and logging into my PlayStation account. However, I decided to remove the passkey and stopped using it because PlayStation disables other login methods, including your password, when a passkey is enabled. This limitation doesn’t make any sense to me.

PAStheLoD · 2024-10-02T02:12:08Z

One more Microsoft/Live.com doesn't work datapoint.

I got prompted from Skype's web version to try to enroll, the URL even had passkey in it, anyway ... on both Firefox and Brave I only get the macOS (Sonoma 14.6) native prompt. (On Brave when I cancel the native prompt Brave offers to save the passkey in a few places: iCloud Keychain, phone/tablet, brave profile, USB security key.)

varjolintu · 2024-11-09T14:34:47Z

Update on X / Twitter: Passkeys are only supported with Android and iOS. The security key option triggers the browser level dialog instead.

qrhfz · 2024-11-10T06:04:10Z

creating passkey in dynadot.com does not work. after entry is added to keepassxc's database. the website does nothing.

varjolintu · 2024-11-10T06:29:32Z

creating passkey in dynadot.com does not work. after entry is added to keepassxc's database. the website does nothing.

Enable Debug Logging in the extension and see if there are any error messages in the console.

qrhfz · 2024-11-13T06:13:35Z

@varjolintu

here's the log for dynadot.com

[Debug passkeys.js:89] KeePassXC-Browser - Passkey request
{
  "attestation": "direct",
  "authenticatorSelection": {
    "residentKey": "discouraged"
  },
  "challenge": "6QVBhms1J1zhwWSvsDhYDAO0dsL7r2kRHun2_xM-j9U",
  "extensions": {
    "credProps": true
  },
  "pubKeyCredParams": [
    {
      "type": "public-key",
      "alg": -7
    },
    {
      "type": "public-key",
      "alg": -8
    },
    {
      "type": "public-key",
      "alg": -257
    }
  ],
  "rp": {
    "name": "Dynadot Webauthn",
    "id": "www.dynadot.com"
  },
  "timeout": 30000,
  "excludeCredentials": [],
  "user": {
    "displayName": "***",
    "id": "*********",
    "name": "***"
  }
}
[Debug keepassxc-browser.js:924] KeePassXC-Browser - Passkey response global.js:139:13
{
  "authenticatorAttachment": "platform",
  "id": "T4fT57DS64Zrmd3zIf9Uwrp7kC_WSJv__tSm3Khh_5E",
  "response": {
    "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YVi0Smc0Ix4O3MOLxlztr8IMh2SVIwlsN49QZN5JyOMzelnFAAAAAP2xQbJdhEQ-ijVGmMIFpQIAIE-H0-ew0uuGa5nd8yH_VMK6e5Av1kib__7UptyoYf-RpQECAyYgASFYIMOCNjTqiZpgciYoXnDglxfkd31WzA6iDgOLfjKvwvIvIlgg2EGDUEpHNx-N47REK5H0nE86KWUsH41cPyVvDvtF4QehaWNyZWRQcm9wc6Ficmv1",
    "authenticatorData": "Smc0Ix4O3MOLxlztr8IMh2SVIwlsN49QZN5JyOMzelmFAAAAAKFpY3JlZFByb3BzoWJya_U",
    "clientDataJSON": "eyJjaGFsbGVuZ2UiOiI2UVZCaG1zMUoxemh3V1N2c0RoWURBTzBkc0w3cjJrUkh1bjJfeE0tajlVIiwiY3Jvc3NPcmlnaW4iOmZhbHNlLCJvcmlnaW4iOiJodHRwczovL3d3dy5keW5hZG90LmNvbSIsInR5cGUiOiJ3ZWJhdXRobi5jcmVhdGUifQ",
    "clientExtensionResults": {
      "credProps": {
        "rk": true
      }
    },
    "publicKeyAlgorithm": -7
  },
  "type": "public-key"
}
Uncaught (in promise) SyntaxError: JSON.parse: unexpected end of data at line 1 column 1 of the JSON data

uselessgithub · 2024-12-29T00:01:24Z

For Microsoft, on https://account.live.com/ :

on Windows 10, I couldn't create a passkey using KeePassXC (it always shows the default system popup to create it instead of the KeePassXC popup). Tried on Firefox and Edge (with their corresponding KeePassXC-browser extensions).
on Windows 11, I was able to create a passkey using KeePassXC (on Firefox with its KeePassXC-browser addon)

Kariton · 2025-01-03T17:20:44Z

Browser	Passkey Action	URL	Website error	KeepassXC error	Notes
Vivaldi	create	https://account.idm.telekom.com/account-manager/security/passkeys	To add a new passkey, please log in with a device that supports passkeys.	[none]	[none]

alensiljak · 2025-01-11T00:36:34Z

Yahoo implementation of Passkeys does not seem to trigger the extension the first time. It is getting forwarded to the system dialog. Cancelling the first try and clicking Try Again triggers the KeepassXC dialog.

Browser	Passkey Action	URL	Website error	KeepassXC error	Notes
Firefox	use	https://login.yahoo.com/	[nothing obvious]	[n/a]	works the second time around

varjolintu · 2025-01-11T07:12:33Z

@Kariton Is there some kind of list in their site that shows what devices or browsers are supported? I couldn't find any information.

alensiljak · 2025-01-13T20:10:29Z

A NextCloud instance also does not seem to be able to log in.
Registering a key works fine but the key is not found when trying to "log in with a device".

URL: https://siljak.next-cloud.org/index.php/login
Error: No logins found.

No JS errors:

varjolintu · 2025-01-13T20:13:34Z

@alensiljak If you enable debugging in the extension, can you see what RP ID is used for authentication? Does that match with the RP ID in the saved passkey entry (KPEX_PASSKEY_RELYING_PARTY attribute)?

BionicBison05 · 2025-01-13T20:18:43Z

@alensiljak There also appears to be a Nextcloud bug affecting all passwordless login. Maybe try the workaround listed in that issue as well?

varjolintu · 2025-01-13T20:24:26Z

@alensiljak What happens if you write the correct username manually and try to authenticate?

EDIT: To not spam this thread, I'd suggest creating a separate issue that we can link as a subissue.

Kariton · 2025-01-16T17:42:00Z

@varjolintu i was unable to find any information about that.

t4moxjc7 added the bug label Mar 10, 2024

t4moxjc7 changed the title ~~Passkeys not working on certain sites~~ Creating passkeys not working on certain sites Mar 10, 2024

t4moxjc7 changed the title ~~Creating passkeys not working on certain sites~~ Passkeys not working on certain sites Mar 10, 2024

varjolintu added the feature: Passkeys label Mar 10, 2024

varjolintu self-assigned this Mar 10, 2024

droidmonkey pinned this issue Mar 10, 2024

t4moxjc7 mentioned this issue Mar 10, 2024

Feature request: security key emulation #10373

Closed

luzat mentioned this issue Mar 11, 2024

Support authenticator requests other than internal #10382

Closed

keepassxreboot deleted a comment from darkdragon-001 Aug 18, 2024

keepassxreboot deleted a comment from varjolintu Aug 18, 2024

keepassxreboot deleted a comment from darkdragon-001 Aug 18, 2024

varjolintu mentioned this issue Aug 19, 2024

Passkey not registering keepassxreboot/keepassxc-browser#2317

Closed

varjolintu mentioned this issue Sep 27, 2024

Can't create a passkey on Twitter keepassxreboot/keepassxc-browser#2349

Closed

raywdude mentioned this issue Oct 12, 2024

Cannot create Passkey on PayPal Mobile Android App (or use existing passkey) through Bitwarden ("asset links" error) bitwarden/mobile#3419

Closed

1 task

droidmonkey mentioned this issue Nov 5, 2024

Libby App Passkey Creation #11439

Closed

keepassxreboot deleted a comment from 1nj0k Nov 9, 2024

phoerious removed the bug label Nov 22, 2024

alensiljak mentioned this issue Jan 13, 2025

NextCloud Passkey Issue #11659

Closed

1 task

Passkeys not working on certain sites #10374

Passkeys not working on certain sites #10374

Comments

t4moxjc7 commented Mar 10, 2024 • edited by varjolintu Loading

Not working

Restrictions

Instructions

varjolintu commented Mar 10, 2024 • edited Loading

varjolintu commented Mar 10, 2024

t4moxjc7 commented Mar 10, 2024

varjolintu commented Mar 10, 2024 • edited Loading

droidmonkey commented Mar 10, 2024

varjolintu commented Mar 11, 2024

klixx23 commented Mar 11, 2024

traviss64 commented Mar 11, 2024 • edited Loading

luzat commented Mar 11, 2024 • edited Loading

varjolintu commented Mar 11, 2024

varjolintu commented Mar 11, 2024 • edited Loading

varjolintu commented Mar 11, 2024

t4moxjc7 commented Mar 11, 2024 • edited Loading

varjolintu commented Mar 12, 2024 • edited Loading

varjolintu commented Mar 12, 2024

varjolintu commented Mar 12, 2024 • edited Loading

varjolintu commented Mar 12, 2024

t4moxjc7 commented Mar 12, 2024

varjolintu commented Mar 12, 2024 • edited Loading

Ollipop030 commented Mar 13, 2024

CrendKing commented Mar 13, 2024 • edited Loading

varjolintu commented Mar 13, 2024

varjolintu commented Jun 27, 2024

wichtounet commented Jun 27, 2024

varjolintu commented Jun 27, 2024

wichtounet commented Jun 28, 2024

uprprc777 commented Aug 21, 2024

PAStheLoD commented Oct 2, 2024

varjolintu commented Nov 9, 2024

qrhfz commented Nov 10, 2024

varjolintu commented Nov 10, 2024

qrhfz commented Nov 13, 2024

uselessgithub commented Dec 29, 2024

Kariton commented Jan 3, 2025

alensiljak commented Jan 11, 2025

varjolintu commented Jan 11, 2025

alensiljak commented Jan 13, 2025 • edited Loading

varjolintu commented Jan 13, 2025

BionicBison05 commented Jan 13, 2025

varjolintu commented Jan 13, 2025 • edited Loading

Kariton commented Jan 16, 2025

t4moxjc7 commented Mar 10, 2024 •

edited by varjolintu

Loading

varjolintu commented Mar 10, 2024 •

edited

Loading

varjolintu commented Mar 10, 2024 •

edited

Loading

traviss64 commented Mar 11, 2024 •

edited

Loading

luzat commented Mar 11, 2024 •

edited

Loading

varjolintu commented Mar 11, 2024 •

edited

Loading

t4moxjc7 commented Mar 11, 2024 •

edited

Loading

varjolintu commented Mar 12, 2024 •

edited

Loading

varjolintu commented Mar 12, 2024 •

edited

Loading

varjolintu commented Mar 12, 2024 •

edited

Loading

CrendKing commented Mar 13, 2024 •

edited

Loading

alensiljak commented Jan 13, 2025 •

edited

Loading

varjolintu commented Jan 13, 2025 •

edited

Loading