Skip to content

All lesser known browsers can't use passkeys #4620

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
1 task done
androidacy-user opened this issue Jan 24, 2025 · 10 comments · May be fixed by #4862 or #4898
Open
1 task done

All lesser known browsers can't use passkeys #4620

androidacy-user opened this issue Jan 24, 2025 · 10 comments · May be fixed by #4862 or #4898

Comments

@androidacy-user
Copy link

Steps To Reproduce

  1. Use any non mainstream browser
  2. Be unable to use passkeys since the browser "isn't privileged"

Expected Result

Passkeys work, regardless of Google's or your blessing of the browser.

Actual Result

"Passkey operation failed because browser isn't privileged"

Screenshots or Videos

No response

Additional Context

I shouldn't have to double check if my password manager supports X feature in Y browser before using it. Almost every browser is chromium based, with a handful being Firefox based, so there's no real reason for random browsers to be unable to use passkeys (which wholeheartedly defeats the purpose of having passkeys in the first place!)

Build Version

version 2025.1.0 com.x8bit.bitwarden

What server are you connecting to?

N/A

Self-host Server Version

No response

Environment Details

Pixel running android 15, issue reproducible on any non major browser (i.e., anything besides edge, chrome, Firefox, brave, etc that is either newer or has a smaller user base)

Issue Tracking Info

  • I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.
@bitwarden-bot
Copy link

Thank you for your report! We've added this to our internal board for review.
ID: PM-17493

@abergs
Copy link
Member

abergs commented Jan 24, 2025

Thanks @androidacy-user, we are aware of this and we maintain a community list to allow lesser known but vetted browsers: https://github.com/bitwarden/android/blob/main/app/src/main/assets/fido2_privileged_community.json

Once you make a PR, adding a browser there, it would be included in the next release.

We are however looking into improving this even further, is that something you would be interested in?

@lucasmz-dev
Copy link
Contributor

If you list them, I can get them added.

@androidacy-user
Copy link
Author

then why is a browser in that list not working (quetta)? do you genuinely think it's reasonable for user(s) to have to validate against a list (that is linked nowhere in the app!) before they switch browsers?

or do you think it's pretty reasonable to have my password manager (that I use to make my life easier, not harder) to at least allow me to "trust" a browser, so that my logins "just work", instead? (not even going to mention non whitelisted browsers aren't even detected as browsers, and bitwarden tries to fill logins for the app instead of the website).

idk what the perfect solution is but this is not it

@lucasmz-dev
Copy link
Contributor

then why is a browser in that list not working (quetta)? do you genuinely think it's reasonable for user(s) to have to validate against a list (that is linked nowhere in the app!) before they switch browsers?

most likely an update with that commit hasn't come out yet
try getting the latest release from github

@gabeweb
Copy link

gabeweb commented Apr 28, 2025

I'm not sure if all lesser-known Android browsers haven't been recognized by Bitwarden to use passkeys, but it's strange that Firefox Nightly still has problems with Bitwarden

On the other hand, Vivaldi Snapshot (for Android) works very well with Bitwarden when using passkeys.

So, I hope Firefox Nightly will be whitelisted in a future not so far.

@SaintPatrck
Copy link
Contributor

@gabeweb Firefox nightly was whitelisted in #5045. It will be in our next release.

As a more general update, we will be introducing the ability to individually manage trusted browsers in an upcoming release (see #4862 and #4898). This means there will no longer be a need to maintain a "community" privileged app list. When a request is received from an untrusted source, users will be given the option to trust it and continue, or reject the request.

@androidacy-user
Copy link
Author

@gabeweb Firefox nightly was whitelisted in #5045. It will be in our next release.

As a more general update, we will be introducing the ability to individually manage trusted browsers in an upcoming release (see #4862 and #4898). This means there will no longer be a need to maintain a "community" privileged app list. When a request is received from an untrusted source, users will be given the option to trust it and continue, or reject the request.

Highly appreciated :)

I think that will resolve the issue for both sides. I'm not sure if it's implemented in the current PRs but a checkbox to remember the choice would be even more appreciated!

@SaintPatrck
Copy link
Contributor

The linked PR's will remember the privileged app if you chose to trust it. There are also screens in Settings that will allow you to view and remove applications you've previously chosen to trust. The community list we maintain and the Google list will be continue to be read-only.

@gabeweb
Copy link

gabeweb commented Apr 28, 2025

@gabeweb Firefox nightly was whitelisted in #5045. It will be in our next release.

As a more general update, we will be introducing the ability to individually manage trusted browsers in an upcoming release (see #4862 and #4898). This means there will no longer be a need to maintain a "community" privileged app list. When a request is received from an untrusted source, users will be given the option to trust it and continue, or reject the request.

Thank you for the reply and the good news! 🙌🏻

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
7 participants