Security Keys don't work/will be detected from Brave

[EinfachNurBaum]

Description

If Websites like Google asks for security key, Brvae can not detect it. It works fine on Firefox. The Nitrokey and Yubikey does not work. I tried USB-A and USB-C port

Expected result:

It should detect my security keys.

Brave version (brave://version info)

1.58.131 Chromium: 117.0.5938.92 (Offizieller Build) unknown (64-Bit)

Miscellaneous Information:

Betriebssystem (OS)| Linux
JavaScript | V8 11.7.439.16
User-Agent | Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Befehlszeile | /app/brave/brave --disable-features=WebAssemblyTrapHandler,DesktopPWAsRunOnOsLogin --no-default-
browser-check --disable-domain-reliability --enable-dom-distiller --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --sync-url=https://sync-v2.brave.com/v2 --lso-url=https://no-thanks.invalid --variations-server-url=https://variations.brave.com/seed --variations-insecure-server-url=https://variations.brave.com/seed --disable-features=DesktopPWAsRunOnOsLogin,WebAssemblyTrapHandler --flag-switches-begin --flag-switches-end --component-updater=url-source=https://go-updater

[rebron]

cc: @fmarier

[GoLD-ReaVeR]

Confirming I got the same issue here trying to log in to azure. The key's strings seem to be completely ignored and instead the enter button pushed by the key is being sent to the UI triggering the "Use different method" option bringing me back where I started.

[samuel-lucas6]

If you go to Try WebAuthn on https://demo.yubico.com/, do you get the following?

The operation either timed out or was not allowed. See: https://www.w3.org/TR/webauthn-2/#sctn-privacy-considerations-client.

Just received my YubiKey, and it's not working in Brave with this error but works in Microsoft Edge. #34441 is related. I've tried adjusting my settings and creating a new profile, but neither fixed the problem.

[samuel-lucas6]

I've tested my YubiKey on macOS with the latest/same version of Brave and it works, but I still can't get it to work on Windows.

[joelgriffiths]

Believe it or not, this thread is one of the top results on Google. I'm having the same symptoms. Works with Chrome, but not Brave. I'm running on Windows. Haven't checked my back or my Linux machine yet.

Edit: Confirmed to work with Mac. Don't have an adapter for my Linux box right now.

[fmarier]

Can anybody share the URLs of the websites where your YubiKeys don't work? That way we could try to reproduce on Windows. We're not aware of general problems with security keys, so we'd need to investigate further.

Also, it would be useful to know which YubiKey model you have.

[joelgriffiths]

The Yukico.com verification website.

https://www.yubico.com/genuine/

Bought two "Yubico - YubiKey 5C NFC", and neither work.

https://www.amazon.com/dp/B08DHL1YDL?psc=1&ref=ppx_yo2ov_dt_b_product_details

[joelgriffiths]

Also, I was able to confirm it works with Linux as well. Just not Windows.

[samuel-lucas6]

@fmarier

Can anybody share the URLs of the websites where your YubiKeys don't work? That way we could try to reproduce on Windows. We're not aware of general problems with security keys, so we'd need to investigate further.

https://demo.yubico.com/ (WebAuthn)
https://www.yubico.com/genuine/

The only account I tested trying to set up was GitHub (Settings, Password and authentication, Security keys), and it gave a Security key registration failed. error.

Also, it would be useful to know which YubiKey model you have.

The YubiKey 5 NFC. Sorry for not mentioning that.

I should also probably mention that I'm on Windows 11 (Version 10.0.22621 Build 22621).

[joelgriffiths]

Doesn't work with this one either. Same error. Chrome and Firefox are fine. I've disabled all extensions and rebooted. Shields are down. No love.

https://www.amazon.com/dp/B0BVNPWPCN?psc=1&ref=ppx_yo2ov_dt_b_product_details

[localh0st]

Attempting to register the YubiKey 5 NFC at the demo site: https://demo.yubico.com/webauthn-technical/registration

A browser dialog pops up with "Create a Passkey". Selecting "Windows Hello or External Security Key" results in the following error:

The operation either timed out or was not allowed. See: https://www.w3.org/TR/webauthn-2/#sctn-privacy-considerations-client.

In other browsers, including Chrome, the same selection leads to a Windows dialog that allows registration of the key. Perhaps Windows is blocking Brave from accessing Windows Security Center?

Running Brave v1.64.109, Windows 11 Pro 22H2 Build 22621.2428

[samuel-lucas6]

A browser dialog pops up with "Create a Passkey". Selecting "Windows Hello or External Security Key" results in the following error

Interestingly, I don't even get a dialog pop up.

[fmarier]

It looks like this may affect only version 1.64 on Windows. Can anybody confirm whether or not this works for them on Brave Beta (1.65) or later?

[MadhaviSeelam]

Able to reproduce the issue in 1.64.109 Chromium: 123.0.6312.58 with the site https://www.yubico.com/genuine/. But works just fine 1.65.93 Chromium: 123.0.6312.58

1.64.109	1.65.93

[localh0st]

Confirmed, @fmarier.

https://demo.yubico.com/webauthn-technical/registration does work properly with Brave (Beta) Version 1.65.89 Chromium: 123.0.6312.58

[joelgriffiths]

Yes. I was able to get it to work with Lastpass as well when using Beta.

[samuel-lucas6]

@fmarier Can also confirm that both links I listed work with Brave Beta 1.65.

[EthanHeilman]

@samuel-lucas6 I can confirm that it is broken on 1.64.109 and that it is fixed in 1.66.39

See my compatibility matrix here:
#37023

[EthanHeilman]

Given that this appears to be fixed in the nightly build, do we know why it broke? What change caused this bug?

[fmarier]

Given that this appears to be fixed in the nightly build, do we know why it broke? What change caused this bug?

Not yet, we're still trying to figure it out because the changes we've looked at so far (between a version known to be broken and one known to work) haven't turned up anything obvious.