Backport PassKeys support to 2.7.7

[droidmonkey]

Collection of browser PR's that fix various bugs and add support for PassKeys.

Testing strategy

Tested with latest released version of browser extension and snapshot build of this PR.

Type of change

• ✅ New feature (change that adds functionality)

[brianjmurrell]

Missing closing > on XML tag.

[brianjmurrell]

Not sure if I should open a new issue on this PR given that it has not landed to the release branch yet, so for the moment I will just report my findings here. I am happy to open a new issue if that is prefered.

So I built this PR on Linux and am using the KeePassXC-Browser extension currently available in the Chrome Web Store.

I am able to create a use a passkey with github.com but bestbuy.com tells me _ The browser or operating system you're using doesn't support passkeys_. I am able to create a passkey on bestbuy.com using BitWarden though, so it seems that bestbuy.com is functional for passkeys in general.

For my Google account, when I try to create a passkey the page has a warning:

Like bestbuy.com creating passkeys in my Google account works with BitWarden.

[varjolintu]

@brianjmurrell Strange. Google was one of the things I tested. What browser are you using?

[brianjmurrell]

@brianjmurrell Strange. Google was one of the things I tested. What browser are you using?

Chrome 120.0.6099.129 (Official Build) (64-bit)

[varjolintu]

@brianjmurrell Strange. Google was one of the things I tested. What browser are you using?

Chrome 120.0.6099.129 (Official Build) (64-bit)

I just tested this with Debian Bookworm, and it created the Passkey normally. Google complains that user should use Windows or macOS (Linux is not officially supported?), but when I tried to create a Passkey, I selected "Use another device" and it immediately prompted KeePassXC for the Passkey creation. After that logging in with the Passkey also worked normally.

For the Bestbuy, I'm not sure how I can create an account as a non-US resident.

[droidmonkey]

I can test best buy. I hope I don't end up buying a new tv....

[brianjmurrell]

I just tested this with Debian Bookworm, and it created the Passkey normally. Google complains that user should use Windows or macOS (Linux is not officially supported?), but when I tried to create a Passkey, I selected "Use another device" and it immediately prompted KeePassXC for the Passkey creation. After that logging in with the Passkey also worked normally.

I was also able to get a GH passkey created. I thought I had come back here and updated as such, but it seems not.

For the Bestbuy, I'm not sure how I can create an account as a non-US resident.

I'm not a US resident either. I don't recall there being anything about creating an account there that required any evidence of US residency. It did ask for a phone number but I put in a fake and it was not required to be validated or any such thing to create the account.

[varjolintu]

I'm not a US resident either. I don't recall there being anything about creating an account there that required any evidence of US residency. It did ask for a phone number but I put in a fake and it was not required to be validated or any such thing to create the account.

I still could no create an account. This is why I'm complaining.

EDIT: I tested GitHub also, and there were no problems logging in with a Passkey created months ago. I also tried creating a new Passkey for login and it also worked directly without any errors.

[brianjmurrell]

I still could no create an account.

Could you expand on what is stopping you? It was a very straightforward process here.

[brianjmurrell]

I don't seem to be able to create a passkey with KeePassXC[-Browser] on https://www.passkeys.io/ either. I create and log into an account there (using a passkey from my phone) and then try to create a new passkey there:

So then click the circled button. But I am prompted by the browser instead of KeePassXC[-Browser]:

[droidmonkey]

You are likely running into the "resident key" issue. We made a mistake in interpreting the documentation. However, that was removed from this PR.

Are you building the latest head of this PR? Recommend doing a git reset --hard onto the current remote head after a fetch.

[brianjmurrell]

You are likely running into the "resident key" issue. We made a mistake in interpreting the documentation. However, that was removed from this PR.

Are you building the latest head of this PR?

I believe I am. I am building 6363b61 (plus b65d0a8 of course, which I patch onto 6363b61 at the moment -- since I already have the tarball for 6363b61 present locally).

[spinnau]

Thank you for that amazing work. I have created a build from this PR and tested it with Chromium and Firefox on some websites (see list below).

System: Arch Linux

KeePassXC - Version 2.7.7-snapshot
Build-Typ: Snapshot
Revision: b65d0a8

KeePassXC-Browser-Version: 1.8.11

Chromium 121.0.6167.85

• passkeys.io
  • create passkey
  • login with passkey
• google.com
  • create passkey
  • login with passkey
• github.com
  • create passkey
  • login with passkey

Firefox 122.0

• passkeys.io
  • create passkey
  • login with passkey
• google.com
  • create passkey
  • login with passkey
• github.com
  • create passkey
  • login with passkey

Observations (in both browsers)

• passkeys.io: Creation and login works quite nice as it should.

• google.com: On trying to create a new passkey, the website states, that on this device no passkey can be created. But after clicking the button to use another device the Keepassxc dialog shows up and a passkey can be created. The login is a little inconvinient as you have to type in the mail address first, then click on next and then choose other options and select passkey. After that the Keepassxc dialog shows up and allows login with passkey.

• github.com: When trying to create a new passkey the website states that my device supports passkeys and the creation of a new passkey works fine. Login also works fine, on login page you just have to select "sign in with a passkey" which brings up the Keepassxc dialog and allows login with passkey.

[droidmonkey]

Awesome thanks for testing. @phoerious good to merge? I have a couple more fixes to throw into 2.7.7 this weekend.

[spinnau]

On bestbuy.com it doesn't work for me in Chromium and Firefox. Trying to setup a new passkey in account settings gives the following error message:

[brianjmurrell]

Am I correct in assessing that:

droidmonkey force-pushed the backport/passkeys branch from b65d0a8 to d04ce6e

has nothing significant enough over b65d0a8 to warrant rebuilding to update to d04ce6e?

Is there anything anyone (i.e. I) can do to help diagnose the problem with bestbuy.com? Are they likely to be an outlier in not working with KeePassCX[-Browser] or are we going to see more sites with the same kind of problem?

homedepot.com seems to be another site where I am able to create a passkey on my Android phone but there is no acknowledgement at all of being able to create passkeys using KeePassXC built from this PR.

[varjolintu]

Is there anything anyone (i.e. I) can do to help diagnose the problem with bestbuy.com? Are they likely to be an outlier in not working with KeePassCX[-Browser] or are we going to see more sites with the same kind of problem?

You could enable Debug Logging in the extension settings and paste the console log messages after the error happens. You could also create a new issue to https://github.com/keepassxreboot/keepassxc-browser/issues.

Btw, have you tried the current extension develop branch? keepassxreboot/keepassxc-browser#2082 could be something that affects this. Although I'm releasing a new version soon, it will take some time to be updated to the extension stores.

[droidmonkey]

I think the BestBuy website is just plain broken, it is throwing errors for me when I try to login, change my password, and after registering a passkey:

When I go to sign in with the passkey, the dialog shows up just fine but it sits there and does nothing.

I have no issues with passkey.io

NOTE: This is with the latest Edge Browser and KeePassXC-Browser extension.