GitHub Community
Replies: 48 comments 116 replies
-
|
Excited to see this. Tried to enable it on my current account (that currently uses authenticator app). Turned on in browser (Safari Version 17.0 (19616.1.27.111.16) on M1 Mac Studio running 14.0 (23A339)). Turned on passkey as an authenticator (this might have been a mistake but it wasn't too clear whether to use this or not). Logged out. Got an error dialog trying to log back in "Unable to sign in with your passkey. Please sign in with your password." Logged back in the normal way with credentials stored in Safari (which is tricky because Safari is convinced I should be using the passkey) Turned OFF passkey as an authenticator. Logged out. Tried again. Same error. Logged in via password instead… Tried on iPhone and WAS able to log in with Mobile Safari and Passkey. Issue seems limited to Mac Safari for me. |
Beta Was this translation helpful? Give feedback.
-
|
I am quite disappointed. I am experiencing problems as many state in this thread. It is now 7 months later and nothing has changed. What needs to happen to get GitHub to fix this? If they don't intend to support PassKeys, they should remove the illusion that they do. I am running a new Mac with all updated software. I would like to see this work, but I can't see anything that I can do to help this along. Does anyone have any suggestions? |
Beta Was this translation helpful? Give feedback.
-
|
This is also still happening to me, and the for the first time, the dedicated "Sign In With Passkey" button no longer works for me on macOS 14.4.1 and Safari 17.4.1. That also generates the "Unable to sign in with your passkey. Please sign in with your password." error. Now I am forced to sign in with my password, and then it also requires me to sign in with the passkey after that, at which point it works. None of this happens on Safari on iOS, passkeys seem to work perfectly fine there. |
Beta Was this translation helpful? Give feedback.
-
|
Understanding how gh communities work. thank you for sharing |
Beta Was this translation helpful? Give feedback.
-
|
WEEEEEEEEEEE |
Beta Was this translation helpful? Give feedback.
-
|
I have a similar issue as @simX : neither the safari-autofil nor the "sign with passkey" button works. I have to use my password then my 2FA code. |
Beta Was this translation helpful? Give feedback.
-
|
Love this! Is there a way we can remove password from the account and go completely passwordless? |
Beta Was this translation helpful? Give feedback.
-
|
@Firstyear I'd love to grab some more detail on why non-rk is considered the definition of passwordless. If you'll be at one of the upcoming summits such as the passwordless summit or Authenticate would be great to go in depth. |
Beta Was this translation helpful? Give feedback.
-
|
Hey there, I'm Australian so I wont be attending either (I am not comfortable to enter the US due to a preexisting medical issue). I'd be happy to talk more via email though if you want - it's on my profile :) |
Beta Was this translation helpful? Give feedback.
-
|
I, too, would like to be able to disable password authentication. I'm not sure what benefit passkeys provide if someone can still authenticate using less-secure methods. |
Beta Was this translation helpful? Give feedback.
-
|
I agree with @Firstyear.
According to https://www.w3.org/TR/webauthn-2/#sctn-authenticator-taxonomy:
And 'user verification' is:
So I think for example, if you type in your username and then use a 'user-verifying platform authenticator', e.g. fingerprint sensor on your laptop/phone + a security chip, with or without a resident key aka. client-side discoverable credential, it's already considered MFA. Same goes for things like YubiKey Bio and PIN + touch:
I'm not quite sure why in the table 'first-factor roaming authenticator' is defined as having 'client-side credential storage' though. I think whether the authenticator is user verification-capable is more important.
I think @Firstyear meant non-rk is considered one of the forms of passwordless. |
Beta Was this translation helpful? Give feedback.
-
|
The problem here also is that there are a whole bunch of different terms in webauthn that have confusing or overlapping meanings. Passkeys for example, have 4 different definitions, all in use by various production IAM providers, with different behaviours. Passwordless in webauthn actually specifically means non-resident keys as a self contained MFA. RK can exist, but it's opportunistic. It's because in webauth passwordless was the goal for a long time (mainly when security keys were the most common authenticator class), but then passkey hype took over and now everyone wants to force rk's everywhere so the definition fell by the wayside. Passkeys in the "common" definition forces rk's which pretty much excludes security keys.
It's because "one definition" of passkeys enforces credential storage in the device (resident keys) which allows the user-id to be stored in the credential. so you don't need a username entry, you just "pick the passkey" and it identifies and authenticates you. It also ties in with certain vendors attempts to lock you in to their synced passkey systems and browser features around username autocomplete (see conditional ui). However, the flip side is that most of these workflows are actually pretty janky and confuse users. "Yes please I'd love to pick up my phone, scan a qr code and wait 30 seconds for it to authenticate me" (btw this workflow is an accessibility nightmare ... ). It also completely alienates and breaks security keys since they have so little rk storage, and now the browsers are pushing their sync ui's in front of security keys to make it extra clicks adding "forced friction". I already know of people who can't use passkeys because a certain cloud provider forces rk and it bricked their keys. Generally the people pushing passkeys as resident keys are making assumptions that you are "all in on chrome+android" or "all in on safari and iphone" or "all in on edge and windows". But none of them account for the reality that people use android + mac with firefox, or other combinations, which means that none of these passkey sync mechanisms will interoperate. For example, my partner (a surgeon) has an iphone, a windows machine, and uses chrome. None of these can sync keys with each other, and so there is no passkey provider that would work except security keys - and we can't use those because rk obsession means we'll fill the devices up in no time. Can you imagine her needing to juggle 4 yubikeys to find which one she needs? She has ~80 accounts in her pw manager, and this is a nightmare. Once passkey hype kicks in, this will be the future for her. Anyway, so passwordless is what we should be pursuing where the keys are opportunistically rk (iphone always makes rk even under discouraged for example). This way you still prompt with a username field. You can use conditional ui to opportunistically allow rk's to complete the username + authentication in one go. And then for users without those rk's such as yubikeys, you allow the username prompt to complete and then do the webauthn challenge with the credential id list set as normal for that user. |
Beta Was this translation helpful? Give feedback.
-
|
Tried to add a Yubikey 5c on Safari and Firefox on macOS, and on Firefox on Linux. Getting 422 with this error: |
Beta Was this translation helpful? Give feedback.
-
|
(Which incidentally why I have been repeatedly warning about rk's being required/preferred rather than discouraged since it can lead to devices filling their extremely limited storage, rather than rk being opportunistic to allow flows ontop of passwordless. ) |
Beta Was this translation helpful? Give feedback.
-
Related to that storage space issue I mentioned, if you've hit max storage on your yubikey then it won't let you create the type of webauthn credential that we'd accept as a passkey. You could check if that's the issue using the yubikey CLI depending on your hardware key version. Edit: what @Firstyear said. |
Beta Was this translation helpful? Give feedback.
-
|
Oh another gotcha. Only CTAP 2.1PRE and 2.1 support credential management. If your key is older (like mine) and is CTAP2.0 only, you CAN NOT list rk's, and you can never delete them. Meaning you're "stuck". You'll see this if ykman errors with |
Beta Was this translation helpful? Give feedback.
-
|
I have same problem, but when I set a PIN for FIDO2. |
Beta Was this translation helpful? Give feedback.
-
|
@xz-dev cos the PIN counts as a 'factor': https://www.w3.org/TR/webauthn-2/#authentication-factor-capability |
Beta Was this translation helpful? Give feedback.
-
|
It seems I cannot setup Windows Hello as a passkey as Windows only allows me to provision a USB key:
though Security Key via Windows Hello works fine. Windows 11 Pro 22H2 (22621.2283) |
Beta Was this translation helpful? Give feedback.
-
|
You need a tpm on machine and a PIN enabled for win hello to work without the security key. |
Beta Was this translation helpful? Give feedback.
-
|
I'm pretty sure I have a TPM and a PIN and the passkey features works elsewhere, for example, Google. |
Beta Was this translation helpful? Give feedback.
-
|
Two possible problems:
|
Beta Was this translation helpful? Give feedback.
-
|
Can confirm that removing the existing security key first works :) |
Beta Was this translation helpful? Give feedback.
-
|
I'm not able to set up a passkey on an Android device. After going through the setup on GitHub, following the push notification steps, and entering my phone PIN, I see "Passkey registration failed." Android 11 I was able to set one up with MacOS + Chrome and Windows 11 + Chrome without issue. I tried setting it up on my device from the Windows computer, but that also resulted in a failed registration. I saw this error in the browser console at that time: |
Beta Was this translation helpful? Give feedback.
-
|
Pixel 7 Pro with Android 13. I am also hitting this error. |
Beta Was this translation helpful? Give feedback.
-
|
I also wasn't able to use passkeys on my Pixel 6 Pro and my new phone with my main Google Account. But it was working with another account, I just setup. What fixed the issue for me now, was to manually disable the Screen Lock setting for my main account (had this manually enabled before) and then starting the passkey registration on e.g GitHub. In the process of creating the passkey, I was the asked to enable screen lock again and the registration went through successfully. Tested the registration with latest Chrome on Android 14. Hope it will fix the issue for others as well. This is the setting to disable first: |
Beta Was this translation helpful? Give feedback.
-
|
This worked. Thanks! |
Beta Was this translation helpful? Give feedback.
-
|
I tried all of the steps proposed by @amoosbr, but I still get the I'm on Android 10 with a Samsung S9 OneUI (old, I know). |
Beta Was this translation helpful? Give feedback.
-
|
Likewise. Android device stopped working for roaming passkey registration and cannot see why. Tested everything i can think of. |
Beta Was this translation helpful? Give feedback.
-
|
Please help by explaining two things - I have read all the docs and posts but I cannot find an answer. I use a linux (ubuntu 22.04) laptop and edge browser.
Thirdly can someone answer if I don't set up 2FA or a passkey will I still be able to report bugs and contribute to discussions on github projects with a simple password. It is proving so difficult to understand all the unexplained stuff in your 2FA docs that I am thinking that it'll be easier simply to stop using github for my own code. |
Beta Was this translation helpful? Give feedback.
-
If you've been asked to enable 2FA by GitHub, and not by an organization that you belong to, then you won't be able to contribute on GitHub after the deadline if you haven't enabled 2FA. Passkey registration is separate from our 2FA rollout, so you can completely ignore it if you want. You just need to enable 2FA from your user settings. Passkeys are more like an additional benefit on top of 2FA to make your life easier. There are benefits to using passkeys without 2FA too but we're not asking or forcing anyone to do that. If you're still interested in passkeys: The QR code: you would have to scan it with your phone's camera. If your phone has passkey and bluetooth support then you could register a passkey for login. It's similar to the SMS flow that you described except using bluetooth - the benefit is better account security for folks that want it, and additional convenience for 2FA users or folks that don't like managing their passwords. |
Beta Was this translation helpful? Give feedback.
-
|
@hagould You should likely feed this back to the chrome team since the UI referenced by @rogercreagh is part of the browser, and this kind of usability issue will likely come up more often. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks you @hagould that was clear and most helpful (if not quite what I hoped to hear) |
Beta Was this translation helpful? Give feedback.
-
|
Excellent news! May I suggest adding the ability to enable 2FA for specific passkeys? |
Beta Was this translation helpful? Give feedback.
-
|
Indeed. Still, even though it is not the same as keeping passwords and TOTP keys in the same password manager, it is a single vendor. As a side note, it is quite cumbersome to use YubiKey with resident keys for git access on Windows. Because it requires 5+ confirmations for "git push". Because SSH on Windows does not support the ControlMaster option. |
Beta Was this translation helpful? Give feedback.
-
|
Huh, TIL, and I was on the team that added openSSH to Windows... Looking over some older issues from e.g. Would a non-rk registration be easier to use? That's a bit surprising to me, but certainly it's something we want to make a good experience. |
Beta Was this translation helpful? Give feedback.
-
Yes, non-residential keys can be stored in the SSH agent, removing the need to enter a password each time at the cost of less protection compared to residential keys. Non-rk keys should protect against most attacks targeting credentials. And if there was an attack that was able to dump memory from the SSH agent and extract keys, then it could do much more damage than just steal credentials. It seems I should reconsider my usage of rk and switch to non-rk instead. (My paranoid mind does not make my life easier...) |
Beta Was this translation helpful? Give feedback.
-
Isn't it a bit misleading (or a lot misleading) to call it a 'second factor', if it's a single passkey and therefore a single factor? |
Beta Was this translation helpful? Give feedback.
-
|
https://pages.nist.gov/800-63-3/sp800-63b.html#sec5 section 5.1.9 defines multi-factor cryptographic devices. |
Beta Was this translation helpful? Give feedback.
-
|
My small list of suggestions. It would be handy to have the ability to test the passkey directly in your account settings. Ability to add a passkey with a lifespan. Backup passkey(s). A passkey that is not intended for frequent usage and must be opened first, with a specific time period set in the initialization stage and, optionally, a list of users who must be informed. Periodically ask the user to check if he still has access to the passkey and if it is in a working condition by completing the test. If it is not already done. I never used keys for 2FA on GitHub. (pass+TOTP). And saw only messages about 2FA and backup codes. |
Beta Was this translation helpful? Give feedback.
-
You can actually do this today if you go to add a new passkey but auth with one of your existing ones. The other suggestions are interesting, thank you for the feedback! |
Beta Was this translation helpful? Give feedback.
-
This is something we're looking at adding to the existing checkup period! Right now there's a "security checkup" that's pretty useless - "you have security keys" is not a direct call to action. We would like to periodically check second factor freshness and warn on severely out of date factors that look like they're unused. Interestingly we do expire unused GitHub Mobile keys for authentication, which can lead to more lockouts since it kills a possible recovery factor. |
Beta Was this translation helpful? Give feedback.
-
|
Will it be possible to disable TOTP in the future? |
Beta Was this translation helpful? Give feedback.
-
|
My comment is not a problem report, just a question^^ |
Beta Was this translation helpful? Give feedback.
-
|
The next step will be to allow users to essentially disable/delete their passwords, but we haven't gotten there yet. Today you still need 2FA to keep your account secure with passkeys. |
Beta Was this translation helpful? Give feedback.
-
|
@hpsin is it still not possible to disable TOTP while having backup codes? |
Beta Was this translation helpful? Give feedback.
-
|
@hagould could you answer my question here? If it's not possible is there any ETA? |
Beta Was this translation helpful? Give feedback.
-
|
It's not possible today - we may allow this in the future but there is no ETA for it. |
Beta Was this translation helpful? Give feedback.
This comment was marked as off-topic.
This comment was marked as off-topic.
-
|
I got a popup from Github today demanding an SMS authentication. I have 2FA set up with a Yubikey, a backup Yubikey, and a list of TOTP passwords. But there was no option to use the Yubikey. It insisted on SMS. My first reaction was to think this was some kind of phishing message. If you've set up 2FA with a Yubikey, you should never be forced to use SMS. |
Beta Was this translation helpful? Give feedback.
-
|
We want to get there, but today we only accept an authenticator app or SMS number for your "primary factor" for 2FA. To reduce lockouts we've starting asking folks to authenticate with that factor (for you, SMS) a month after enrolling to make sure that it was successfully configured and to reduce account lockouts. If you'd gone with an authenticator app you would've had to prove you still had access to it in the same way. We're are working towards allowing folks to enroll with just a webauthn credential, we'll likely have some requirements that we're still working out. |
Beta Was this translation helpful? Give feedback.
-
|
I was able to setup and login while the beta was active but it seems there has been a recent change in the way webauthn is requesting the device on android chrome. If I tap sign in with a passkey I just get a window saying "there aren't any passkeys for github.com on this device", where as other sites are prompting for the type of passkey to use, NFC or USB. Works fine on all other platforms but now I have to use a computer to complain about free software. |
Beta Was this translation helpful? Give feedback.
-
|
We haven't changed anything about the request, so that's not a good sign. If you open Chrome, and navigate to the password manager, and locate github.com in the list, there should be a passkey listed at the bottom of that entry. Do you see that?
|
Beta Was this translation helpful? Give feedback.
-
|
Fwiw, I suspect I was in this category. I eventually deleted my things and started fresh. (This is a while ago, I'm here now because of another nudge.) Note that the flows at the time didn't lead me to this discussions/the previous beta discussion. |
Beta Was this translation helpful? Give feedback.
-
|
Today, not only did Github ask for SMS authentication again, and, as before, would not accept my Yubikey, it offered to redisplay my TOTP keys! Those are last-ditch credentials that were supposed to be sent once only! I printed them and put the printout in a safe deposit box. Now you're exposing them to anybody who can divert or steal my cell phone. This is really sloppy. Need to get Schneier on Security to review Github's 2FA system. |
Beta Was this translation helpful? Give feedback.
-
|
As written above, this is a verification step to ensure you've saved them properly. If you can't pass, we register new credentials. Yes, this does result in an opportunity where someone who has stolen your session (or your password and SMS) can re-register your 2FA credentials. That's also true of anyone who has stolen your password and SMS in general. You are not required to register SMS, and if you do not want to use it, please do not register it. |
Beta Was this translation helpful? Give feedback.
-
|
I had an issue when registering 1password as a passkey on Ubuntu 22.04 with Firefox 119.0 (64-bit). |
Beta Was this translation helpful? Give feedback.
-
|
Oh, interesting, thank you! When we show the upgrade prompt we flag the presumed upgrading key for deletion on the next registration. We have to clear that when the upgrade is rejected. Cc @hagould |
Beta Was this translation helpful? Give feedback.
-
|
@Logiar This has been fixed for a bit! Let us know if you're having any other issues. |
Beta Was this translation helpful? Give feedback.
-
|
Are you planning on using passkeys for git too, i.e. to allow it instead of SSH keys? |
Beta Was this translation helpful? Give feedback.
-
|
Correct me if I am wrong. Behind the scenes, aren't Passkeys and SSH keys works the same way. By using public and private key for authentication. |
Beta Was this translation helpful? Give feedback.
-
|
لقد قمت أيضًا بتعطيل أدوات حظر المحتوى والإضافات لمعرفة ما إذا كان ذلك سيحدث فرقًا. ندى. |
Beta Was this translation helpful? Give feedback.
-
|
The GitHub interface allows you register multiple passkeys in iCloud Keychain, but if you delete the last passkey from the GitHub page then you are not able to login with passkeys anymore, even though the GitHub page displays the previously registered passkeys. |
Beta Was this translation helpful? Give feedback.
-
|
Google allows me to create a passkey in my account settings. This is painless and my password manager, which works inside a Firefox browser extension, easily stores and uses it. However with Github on Firefox Linux, I don't know how to use it and a small message tells me to "touch my passkey" (whatever this means). I actually do not want to install and use an extra program for just managing and creating passkeys (and the reasons are obvious). Is there something like Google's "create passkey" feature on Github or any plans for it? |
Beta Was this translation helpful? Give feedback.
-
|
Beta Was this translation helpful? Give feedback.
-
|
It seems Android (I'm using Android 13. Are these updates part of the 'Google Play system update'?) now requires discoverable/resident keys? I used to be able to log into GitHub and other services by plugging in my YubiKey and using it only as the second factor. Now it just asks me to set up a PIN. If I refuse, the login fails. Not sure about NFC. That has been broken for a long time. |
Beta Was this translation helpful? Give feedback.
-
|
This is a known and intentional issues with android to exclude other devices kanidm/webauthn-rs#365 (comment) |
Beta Was this translation helpful? Give feedback.
-
|
@hpsin could you possibly unpin https://github.com/orgs/community/discussions/54450? It's confusingly listed before this one. Anyone searching would still find items in it, but as you've pinned this item, it seems more useful to have it listed prominently. |
Beta Was this translation helpful? Give feedback.
-
|
0xB9932F2E574A62A7F638F6E0E561179cAC186c43 |
Beta Was this translation helpful? Give feedback.
-
|
0x03f2d7329cb226c759852c7c27d335211d30e836 |
Beta Was this translation helpful? Give feedback.
This comment was marked as off-topic.
This comment was marked as off-topic.
-
|
YubiKey 5 doesn't work, tried both on Windows with Firefox and Chromium and on Android. I have already setup the PIN.
|
Beta Was this translation helpful? Give feedback.
-
|
Hmm, it appears you cannot set the same YubiKey as both security key and passkey. What's the reasoning behind this limitation? |
Beta Was this translation helpful? Give feedback.
-
|
Great to hear that passkeys have moved to general availability! Here's a summary of the known issues and troubleshooting steps, as well as a guide on filing a report: Known Issues
Filing a ReportWhen encountering a bug or undesirable behavior, please provide the following details:
Useful LinksFeel free to reach out if you have any questions or need further assistance! |
Beta Was this translation helpful? Give feedback.
-
|
Unable to register passkey on Pixel 7 Pro
On-device encryption and Screen Lock enabled, tried logout and login github.com after click |
Beta Was this translation helpful? Give feedback.
-
|
This is a bug in both android and github. Github sends options that only allows a "google passkey stored in google password manager" to work, you can't use screen unlock. And android is broken because it only triggers the screen unlock if you specific options that most of the passkey-boosters don't want you to use. |
Beta Was this translation helpful? Give feedback.
-
|
Just added Passkey through Firefox and then used it in Chrome |
Beta Was this translation helpful? Give feedback.
-
|
It does not work for me. Passkey registration failed. |
Beta Was this translation helpful? Give feedback.
-
|
When using a Passkey to log in, the two-step verification process is typically bypassed. Wouldn’t it be beneficial to have an option to log in with a Passkey and then perform a second verification step using a hardware security key like YubiKey? This could add an extra layer of security for sensitive operations. |
Beta Was this translation helpful? Give feedback.
-
|
If you (wrongly) insist that a pin-code must be added on Yubikeys used with Firefox, then at least the error message must say so, instead of a generic failure message! |
Beta Was this translation helpful? Give feedback.
and others
-
We've taken passkeys from a public beta to general availability, with all users able to set up and use a passkey.
This discussion is to track known ecosystem issues and get your feedback about passkeys. Previous feedback from the beta can be found here.
Known issues
Passkey registration failed. This cannot be used as a passkey. This is because Firefox doesn't support setting up the PIN for a hardware key. If you encounter this issue, you have to set up the PIN yourself, using an app like Yubico Authenticator to manage the key directly, before trying again.Filing a report
If you've encountered a bug or undesirable behavior with how GitHub interacts with your device's passkey support , it's really helpful to know your operating system and browser version, I.e. Mac OS Ventura 13.5.2, Google Chrome 117.0.5938.62.
You can learn more about passkeys at these useful links:
Beta Was this translation helpful? Give feedback.
All reactions