Web browsers are freezing when they ask to press a button on the FIDO2 key

[F3llFr0mTh3Sky]

I attempted to try the virtual FIDO2 key of passless with some websites like:
https://www.token2.com/tools/fido2-demo
but it just result in the whole web browser (firefox) freezing when awaiting for the user to press a button on the FIDO2 key.

Am I missing something?

[pando85]

Hello @F3llFr0mTh3Sky ,

To better understand what is happening to you, could you run it with verbose logging and share the logs here?

[F3llFr0mTh3Sky]

@pando85
Here's the logs you requested:

passless-logs.txt

Note that by saying the web browser is freezing, I mean that clicking on the "cancel" button doesn't even works.

[F3llFr0mTh3Sky]

Oh and I'm using Passless on Gentoo, and so I had to write the ebuild myself (partly auto-generated by pycargoebuild).

If you'd like, I could share you that ebuild.

[pando85]

It seems that it failed to decrypt the credential.

How are you protecting your GPG key? It must ask you for your password if you have one configured.

[F3llFr0mTh3Sky]

Oh yeah, that. I configured a password yes, but I'm not sure if the password pop up is configured correctly.

On my previous PC it was working well with git repositories but right now it doesn't seems to work for qtpass and so probably neither for pass too.

I'll have to figure this out.

And I'll let you know if I manage to change anything on my end.

[pando85]

Oh, then that should be. If the passkey cannot be decrypted, then the browser keeps waiting. Probably we can handle it in a better way here, I will check.

I also notice that you are not running the latest version. It is not very relevant, but I recommend updating it.

[pando85]

I found the same problem in my Wayland environment. For fixing it I had to configure the gpg agent to use a Wayland compatible pinentry program:

cat ~/.gnupg/gpg-agent.conf
pinentry-program /usr/bin/pinentry-qt

Another thing that I notice is that my browser doesn't freeze; it just fails.

[F3llFr0mTh3Sky]

All of those pinentry programs should work for me on Xorg / XFCE:
tux ~ #
eselect pinentry list
Available pinentry binary implementations:
[1] pinentry-gnome3
[2] pinentry-qt6
[3] pinentry-curses *
[4] pinentry-tty

Yet, so far, I only managed to make them work with the gpg command.

As I told you, I don't know if it works with pass or qtpass yet.

[F3llFr0mTh3Sky]

Actually now it works:

So it should work too with passless.

[F3llFr0mTh3Sky]

As you can see in those logs, the pass database got decrypted correctly, but the browser is still freezing.

passless_logs2.txt

Not sure what is going on, the web browser is just still waiting for me to "press the FIDO2 key button".

[pando85]

After decrypting the credential you have to see a notification in your desktop and you must accept it to login it.

It seems that you have xfce notify daemon installed, I didn't test it but in theory it should work. Can you see the notification? Could you check that your desktop notifications are working correctly?

Another option is to change the configuration to skip user verification and user presence but I don't recommend that.

[pando85]

Also, that explains why your browser is frozen, it is because passless is waiting for user confirmation. I could add a timeout there, probably a configurable one.

[F3llFr0mTh3Sky]

It seems that you have xfce notify daemon installed, I didn't test it but in theory it should work. Can you see the notification? Could you check that your desktop notifications are working correctly?

I guess I should see it when the XFCE notify daemon is not in silent mode.
I put it in that mode because it is so annoying when Thunderbird or other applications using it are open.

So just for testing I disabled the silent mode, and I don't see the notification either (or I missed the notification, but it's very unlikely).

tbh, I think it would be better to have your own pop up gui than relying on this.

[pando85]

Oh, then that's it. I think this should be handled at that level. You'll probably want to handle notifications at the application level and keep it clean. Disabling them is an option, too.

I don't know if we could extend the user verification or user presence to other mechanisms in a configurable way.