Cant get FIDO2 or U2F working

great rundown.

I assume by “the forums” you mean this forum here :slight_smile: I know it seems obvious but you never know.. could have been trufflehunter forums for all I know.

This forum supports both “security keys” and “passkeys”. The whole industry is kinda fucked on this naming convention thing and nobody has really sorted out a definitive naming convention here.. but generally speaking “security key” nowadays means U2F and “passkey” means FIDO2 resident keys or non-resident keys, but more often than not it’s a resident key they refer to as “passkey”.

For FIDO2, it’s made more difficult by the fact that your user experience (enter a pin or not) depend on both the FIDO2 applet code as well as the relying party requirements. But, that said, generally speaking U2F does not ask for pin because it’s a 2nd factor and just having it is enough security since you must use a username and password as your first factor. When it comes to FIDO2, resident keys and non-resident keys alike will, for our NFC authenticator, always require a PIN even if the relying party does not require one (for whatever reason). Now, an RP could “fall back” to U2F for instance, which our FIDO2 applet supports, and then you will not be asked for a PIN but you will also not have a FIDO2 key generated either. Relying parties that have not implemented FIDO properly (and there are a ton) could have major differences in how their website might implement FIDO vs their mobile app.

For the forum here, did you follow these steps for passkey (FIDO2 passwordless);

You can see Passkeys are called out right on the security page:

However, if you missed that somehow and focused on “Manage Two-Factor Authentication”:

Then you would be taken here;

If you added a “Physical Security Key”, this will use U2F and not request a PIN.

3 Likes