[GH-ISSUE #4620] All lesser known browsers can't use passkeys #21402

Closed
opened 2026-04-16 21:52:28 -05:00 by GiteaMirror · 30 comments
Owner

Originally created by @androidacy-user on GitHub (Jan 24, 2025).
Original GitHub issue: https://github.com/bitwarden/android/issues/4620

Steps To Reproduce

  1. Use any non mainstream browser
  2. Be unable to use passkeys since the browser "isn't privileged"

Expected Result

Passkeys work, regardless of Google's or your blessing of the browser.

Actual Result

"Passkey operation failed because browser isn't privileged"

Screenshots or Videos

No response

Additional Context

I shouldn't have to double check if my password manager supports X feature in Y browser before using it. Almost every browser is chromium based, with a handful being Firefox based, so there's no real reason for random browsers to be unable to use passkeys (which wholeheartedly defeats the purpose of having passkeys in the first place!)

Build Version

version 2025.1.0 com.x8bit.bitwarden

What server are you connecting to?

N/A

Self-host Server Version

No response

Environment Details

Pixel running android 15, issue reproducible on any non major browser (i.e., anything besides edge, chrome, Firefox, brave, etc that is either newer or has a smaller user base)

Issue Tracking Info

  • I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.
Originally created by @androidacy-user on GitHub (Jan 24, 2025). Original GitHub issue: https://github.com/bitwarden/android/issues/4620 ### Steps To Reproduce 1. Use any non mainstream browser 2. Be unable to use passkeys since the browser "isn't privileged" ### Expected Result Passkeys work, regardless of Google's or your blessing of the browser. ### Actual Result "Passkey operation failed because browser isn't privileged" ### Screenshots or Videos _No response_ ### Additional Context I shouldn't have to double check if my password manager supports X feature in Y browser before using it. Almost every browser is chromium based, with a handful being Firefox based, so there's no real reason for random browsers to be unable to use passkeys (which wholeheartedly defeats the purpose of having passkeys in the first place!) ### Build Version version 2025.1.0 com.x8bit.bitwarden ### What server are you connecting to? N/A ### Self-host Server Version _No response_ ### Environment Details Pixel running android 15, issue reproducible on any non major browser (i.e., anything besides edge, chrome, Firefox, brave, etc that is either newer or has a smaller user base) ### Issue Tracking Info - [x] I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.
GiteaMirror added the app:password-managerbug labels 2026-04-16 21:52:28 -05:00
Author
Owner

@bitwarden-bot commented on GitHub (Jan 24, 2025):

Thank you for your report! We've added this to our internal board for review.
ID: PM-17493

<!-- gh-comment-id:2611624707 --> @bitwarden-bot commented on GitHub (Jan 24, 2025): Thank you for your report! We've added this to our internal board for review. ID: PM-17493
Author
Owner

@abergs commented on GitHub (Jan 24, 2025):

Thanks @androidacy-user, we are aware of this and we maintain a community list to allow lesser known but vetted browsers: https://github.com/bitwarden/android/blob/main/app/src/main/assets/fido2_privileged_community.json

Once you make a PR, adding a browser there, it would be included in the next release.

We are however looking into improving this even further, is that something you would be interested in?

<!-- gh-comment-id:2611967532 --> @abergs commented on GitHub (Jan 24, 2025): Thanks @androidacy-user, we are aware of this and we maintain a community list to allow lesser known but vetted browsers: https://github.com/bitwarden/android/blob/main/app/src/main/assets/fido2_privileged_community.json Once you make a PR, adding a browser there, it would be included in the next release. We are however looking into improving this even further, is that something you would be interested in?
Author
Owner

@lucasmz-dev commented on GitHub (Jan 25, 2025):

If you list them, I can get them added.

<!-- gh-comment-id:2614124729 --> @lucasmz-dev commented on GitHub (Jan 25, 2025): If you list them, I can get them added.
Author
Owner

@androidacy-user commented on GitHub (Jan 29, 2025):

then why is a browser in that list not working (quetta)? do you genuinely think it's reasonable for user(s) to have to validate against a list (that is linked nowhere in the app!) before they switch browsers?

or do you think it's pretty reasonable to have my password manager (that I use to make my life easier, not harder) to at least allow me to "trust" a browser, so that my logins "just work", instead? (not even going to mention non whitelisted browsers aren't even detected as browsers, and bitwarden tries to fill logins for the app instead of the website).

idk what the perfect solution is but this is not it

<!-- gh-comment-id:2623149248 --> @androidacy-user commented on GitHub (Jan 29, 2025): then why is a browser in that list not working (quetta)? do you genuinely think it's reasonable for user(s) to have to validate against a list (that is linked nowhere in the app!) before they switch browsers? or do you think it's pretty reasonable to have my password manager (that I use to make my life easier, not harder) to at least allow me to "trust" a browser, so that my logins "just work", instead? (not even going to mention non whitelisted browsers aren't even detected as browsers, and bitwarden tries to fill logins for the app instead of the website). idk what the perfect solution is but this is not it
Author
Owner

@lucasmz-dev commented on GitHub (Jan 29, 2025):

then why is a browser in that list not working (quetta)? do you genuinely think it's reasonable for user(s) to have to validate against a list (that is linked nowhere in the app!) before they switch browsers?

most likely an update with that commit hasn't come out yet
try getting the latest release from github

<!-- gh-comment-id:2623198630 --> @lucasmz-dev commented on GitHub (Jan 29, 2025): > then why is a browser in that list not working (quetta)? do you genuinely think it's reasonable for user(s) to have to validate against a list (that is linked nowhere in the app!) before they switch browsers? most likely an update with that commit hasn't come out yet try getting the latest release from github
Author
Owner

@gabeweb commented on GitHub (Apr 28, 2025):

I'm not sure if all lesser-known Android browsers haven't been recognized by Bitwarden to use passkeys, but it's strange that Firefox Nightly still has problems with Bitwarden

On the other hand, Vivaldi Snapshot (for Android) works very well with Bitwarden when using passkeys.

So, I hope Firefox Nightly will be whitelisted in a future not so far.

<!-- gh-comment-id:2835321222 --> @gabeweb commented on GitHub (Apr 28, 2025): I'm not sure if all lesser-known Android browsers haven't been recognized by Bitwarden to use passkeys, but it's strange that Firefox Nightly still has problems with Bitwarden On the other hand, Vivaldi Snapshot (for Android) works very well with Bitwarden when using passkeys. So, I hope Firefox Nightly will be whitelisted in a future not so far.
Author
Owner

@SaintPatrck commented on GitHub (Apr 28, 2025):

@gabeweb Firefox nightly was whitelisted in #5045. It will be in our next release.

As a more general update, we will be introducing the ability to individually manage trusted browsers in an upcoming release (see #4862 and #4898). This means there will no longer be a need to maintain a "community" privileged app list. When a request is received from an untrusted source, users will be given the option to trust it and continue, or reject the request.

<!-- gh-comment-id:2835916259 --> @SaintPatrck commented on GitHub (Apr 28, 2025): @gabeweb Firefox nightly was whitelisted in #5045. It will be in our next release. As a more general update, we will be introducing the ability to individually manage trusted browsers in an upcoming release (see #4862 and #4898). This means there will no longer be a need to maintain a "community" privileged app list. When a request is received from an untrusted source, users will be given the option to trust it and continue, or reject the request.
Author
Owner

@androidacy-user commented on GitHub (Apr 28, 2025):

@gabeweb Firefox nightly was whitelisted in #5045. It will be in our next release.

As a more general update, we will be introducing the ability to individually manage trusted browsers in an upcoming release (see #4862 and #4898). This means there will no longer be a need to maintain a "community" privileged app list. When a request is received from an untrusted source, users will be given the option to trust it and continue, or reject the request.

Highly appreciated :)

I think that will resolve the issue for both sides. I'm not sure if it's implemented in the current PRs but a checkbox to remember the choice would be even more appreciated!

<!-- gh-comment-id:2836143111 --> @androidacy-user commented on GitHub (Apr 28, 2025): > @gabeweb Firefox nightly was whitelisted in #5045. It will be in our next release. > > As a more general update, we will be introducing the ability to individually manage trusted browsers in an upcoming release (see #4862 and #4898). This means there will no longer be a need to maintain a "community" privileged app list. When a request is received from an untrusted source, users will be given the option to trust it and continue, or reject the request. Highly appreciated :) I think that will resolve the issue for both sides. I'm not sure if it's implemented in the current PRs but a checkbox to remember the choice would be even more appreciated!
Author
Owner

@SaintPatrck commented on GitHub (Apr 28, 2025):

The linked PR's will remember the privileged app if you chose to trust it. There are also screens in Settings that will allow you to view and remove applications you've previously chosen to trust. The community list we maintain and the Google list will be continue to be read-only.

<!-- gh-comment-id:2836319399 --> @SaintPatrck commented on GitHub (Apr 28, 2025): The linked PR's will remember the privileged app if you chose to trust it. There are also screens in Settings that will allow you to view and remove applications you've previously chosen to trust. The community list we maintain and the Google list will be continue to be read-only.
Author
Owner

@gabeweb commented on GitHub (Apr 28, 2025):

@gabeweb Firefox nightly was whitelisted in #5045. It will be in our next release.

As a more general update, we will be introducing the ability to individually manage trusted browsers in an upcoming release (see #4862 and #4898). This means there will no longer be a need to maintain a "community" privileged app list. When a request is received from an untrusted source, users will be given the option to trust it and continue, or reject the request.

Thank you for the reply and the good news! 🙌🏻

<!-- gh-comment-id:2836419060 --> @gabeweb commented on GitHub (Apr 28, 2025): > [@gabeweb](https://github.com/gabeweb) Firefox nightly was whitelisted in [#5045](https://github.com/bitwarden/android/pull/5045). It will be in our next release. > > As a more general update, we will be introducing the ability to individually manage trusted browsers in an upcoming release (see [#4862](https://github.com/bitwarden/android/pull/4862) and [#4898](https://github.com/bitwarden/android/pull/4898)). This means there will no longer be a need to maintain a "community" privileged app list. When a request is received from an untrusted source, users will be given the option to trust it and continue, or reject the request. Thank you for the reply and the good news! 🙌🏻
Author
Owner

@Wizardling commented on GitHub (May 28, 2025):

For me on Android, Bitwarden isn't recognised by github.com in Firefox beta, as having passkey support. It used to work. But no longer does. Honestly passkeys are a bad joke, at this point - more trouble than they're worth thanks to absurdly random support.

<!-- gh-comment-id:2916350405 --> @Wizardling commented on GitHub (May 28, 2025): For me on Android, Bitwarden isn't recognised by github.com in Firefox beta, as having passkey support. It used to work. But no longer does. Honestly passkeys are a bad joke, at this point - more trouble than they're worth thanks to absurdly random support.
Author
Owner

@maz-saify commented on GitHub (Aug 14, 2025):

I can confirm I am facing the same issue in Firefox Nightly. When passkeys are prompted, it shows Android's native popup instead of Bitwarden's popup.

<!-- gh-comment-id:3186761616 --> @maz-saify commented on GitHub (Aug 14, 2025): I can confirm I am facing the same issue in Firefox Nightly. When passkeys are prompted, it shows Android's native popup instead of Bitwarden's popup.
Author
Owner

@lucasmz-dev commented on GitHub (Aug 14, 2025):

@maz-saify what do you mean by that? Android doesn't support passkeys just raw. I assume you're talking about Google Play Services'.

<!-- gh-comment-id:3187054366 --> @lucasmz-dev commented on GitHub (Aug 14, 2025): @maz-saify what do you mean by that? Android doesn't support passkeys just raw. I assume you're talking about Google Play Services'.
Author
Owner

@maz-saify commented on GitHub (Aug 14, 2025):

@lucasmz-dev Instead of bitwarden's UI, I get native android passkey prompt. See screenshot.

Image

instead of

Image

<!-- gh-comment-id:3187445697 --> @maz-saify commented on GitHub (Aug 14, 2025): @lucasmz-dev Instead of bitwarden's UI, I get native android passkey prompt. See screenshot. ![Image](https://github.com/user-attachments/assets/223f9e59-0c40-4d53-8b3d-0ecd818d62df) instead of ![Image](https://github.com/user-attachments/assets/489ec599-78fc-42ee-a8d9-fe48b5ea2b0b)
Author
Owner

@holocronweaver commented on GitHub (Sep 1, 2025):

I have the same issue as @maz-saify on Firefox 142.0.1. Bitwarden never shows up as a choice for passkeys, instead I get the same Google passkey service. Bitwarden is set as my autofill service, so not sure why Google is showing up at all.

Attaching flight logs while trying to log into Amazon using passkey in case they help.

bitwarden_flight_recorder7781933128550132317.zip

Version: 2025.8.0 (20577)
📱 google Pixel 8 Pro 🤖 16@36 📦 prod
🧱 commit: bitwarden/android/release/2025.8-rc32@1c525b9dfc588105e1fd8f3ad2d4196803c19cd7
💻 build source: bitwarden/android/actions/runs/16834718954/attempts/1
🦀 SDK: 1.0.0-2450-9fe3aeda
🌩 Server: 2025.7.1 @ US

<!-- gh-comment-id:3242253003 --> @holocronweaver commented on GitHub (Sep 1, 2025): I have the same issue as @maz-saify on Firefox 142.0.1. Bitwarden never shows up as a choice for passkeys, instead I get the same Google passkey service. Bitwarden is set as my autofill service, so not sure why Google is showing up at all. Attaching flight logs while trying to log into Amazon using passkey in case they help. [bitwarden_flight_recorder7781933128550132317.zip](https://github.com/user-attachments/files/22078535/bitwarden_flight_recorder7781933128550132317.zip) Version: 2025.8.0 (20577) 📱 google Pixel 8 Pro 🤖 16@36 📦 prod 🧱 commit: bitwarden/android/release/2025.8-rc32@1c525b9dfc588105e1fd8f3ad2d4196803c19cd7 💻 build source: bitwarden/android/actions/runs/16834718954/attempts/1 🦀 SDK: 1.0.0-2450-9fe3aeda 🌩 Server: 2025.7.1 @ US
Author
Owner

@holocronweaver commented on GitHub (Sep 1, 2025):

I was able to solve the issue by resetting Bitwarden as the default autofill provider.

I did this by going into: settings - passwords, passkeys and accounts - preferred service - change - select Bitwarden (even though it was already selected) - accept the change prompt - done!

I noticed that google autofill was still disabled entirely, even as a secondary source. Maybe this is a bug introduced by a recent Android update or Bitwarden update?

Either way there is still a bug here related to autofill preferred service not being respected, just not sure whether Android, Bitwarden or Google autofill is to blame.

<!-- gh-comment-id:3242711841 --> @holocronweaver commented on GitHub (Sep 1, 2025): I was able to solve the issue by resetting Bitwarden as the default autofill provider. I did this by going into: settings - passwords, passkeys and accounts - preferred service - change - select Bitwarden (even though it was already selected) - accept the change prompt - done! I noticed that google autofill was still disabled entirely, even as a secondary source. Maybe this is a bug introduced by a recent Android update or Bitwarden update? Either way there is still a bug here related to autofill preferred service not being respected, just not sure whether Android, Bitwarden or Google autofill is to blame.
Author
Owner

@Kimiblock commented on GitHub (Sep 12, 2025):

I still can't use Cromite to sign in to google.com using passkey. Though Fennec works.

<!-- gh-comment-id:3285373171 --> @Kimiblock commented on GitHub (Sep 12, 2025): I still can't use Cromite to sign in to google.com using passkey. Though Fennec works.
Author
Owner

@lucasmz-dev commented on GitHub (Sep 12, 2025):

@Kimiblock that one is a bug in Cromite. It doesn't ship the proprietary libs required for it to work, and doesn't ship microG's either (unlike Fennec)

<!-- gh-comment-id:3285860520 --> @lucasmz-dev commented on GitHub (Sep 12, 2025): @Kimiblock that one is a bug in Cromite. It doesn't ship the proprietary libs required for it to work, and doesn't ship microG's either (unlike Fennec)
Author
Owner

@Flat commented on GitHub (Sep 16, 2025):

@gabeweb Firefox nightly was whitelisted in #5045. It will be in our next release.

As a more general update, we will be introducing the ability to individually manage trusted browsers in an upcoming release (see #4862 and #4898). This means there will no longer be a need to maintain a "community" privileged app list. When a request is received from an untrusted source, users will be given the option to trust it and continue, or reject the request.

As both of these were closed without merge, is there still a plan to enable users to trust browsers?

<!-- gh-comment-id:3294494755 --> @Flat commented on GitHub (Sep 16, 2025): > [@gabeweb](https://github.com/gabeweb) Firefox nightly was whitelisted in [#5045](https://github.com/bitwarden/android/pull/5045). It will be in our next release. > > As a more general update, we will be introducing the ability to individually manage trusted browsers in an upcoming release (see [#4862](https://github.com/bitwarden/android/pull/4862) and [#4898](https://github.com/bitwarden/android/pull/4898)). This means there will no longer be a need to maintain a "community" privileged app list. When a request is received from an untrusted source, users will be given the option to trust it and continue, or reject the request. As both of these were closed without merge, is there still a plan to enable users to trust browsers?
Author
Owner

@SaintPatrck commented on GitHub (Sep 16, 2025):

Hi @Flat,

Privileged app management was completed in different PR's. It was release and enabled in 2025.7.0. This ticket must have been overlooked.

Under Settings > Autofill you should see "Privileged apps" below "Passkey management" once Autofill is enabled. From there you can view trusted apps and by whom they are trusted. Additionally, when an untrusted browser initiates a passkey operation you will be prompted to trust the browser or cancel the operation.

<!-- gh-comment-id:3298806031 --> @SaintPatrck commented on GitHub (Sep 16, 2025): Hi @Flat, Privileged app management was completed in different PR's. It was release and enabled in 2025.7.0. This ticket must have been overlooked. Under Settings > Autofill you should see "Privileged apps" below "Passkey management" once Autofill is enabled. From there you can view trusted apps and by whom they are trusted. Additionally, when an untrusted browser initiates a passkey operation you will be prompted to trust the browser or cancel the operation.
Author
Owner

@Flat commented on GitHub (Sep 16, 2025):

Thank you for the info. I had Bitwarden beta installed that had not received any updates since November 2024 apparently.

<!-- gh-comment-id:3298893977 --> @Flat commented on GitHub (Sep 16, 2025): Thank you for the info. I had Bitwarden beta installed that had not received any updates since November 2024 apparently.
Author
Owner

@Kimiblock commented on GitHub (Sep 17, 2025):

@lucasmz-dev Thanks for the info

<!-- gh-comment-id:3300719267 --> @Kimiblock commented on GitHub (Sep 17, 2025): @lucasmz-dev Thanks for the info
Author
Owner

@abergs commented on GitHub (Sep 17, 2025):

I think we can go ahead and close this issue thanks to @SaintPatrck. Reopen if I'm wrong.

<!-- gh-comment-id:3301625889 --> @abergs commented on GitHub (Sep 17, 2025): I think we can go ahead and close this issue [thanks to](https://github.com/bitwarden/android/issues/4620#issuecomment-3298806031) @SaintPatrck. Reopen if I'm wrong.
Author
Owner

@belatedly commented on GitHub (Sep 29, 2025):

I am on the newest version of the Bitwarden Android app using the newest version of Waterfox and I am getting the same "Passkey operation failed because browser isn't privileged" error. I found this issue by searching DDG for that error message. Is the new setting not in the play store version of the app yet?

<!-- gh-comment-id:3346697751 --> @belatedly commented on GitHub (Sep 29, 2025): I am on the newest version of the Bitwarden Android app using the newest version of Waterfox and I am getting the same "Passkey operation failed because browser isn't privileged" error. I found this issue by searching DDG for that error message. Is the new setting not in the play store version of the app yet?
Author
Owner

@Flat commented on GitHub (Sep 29, 2025):

It is in the Play Store version, you may want to double check to make sure you do not have the beta version installed which is no longer receiving updates. That was the issue that I had.

<!-- gh-comment-id:3346713830 --> @Flat commented on GitHub (Sep 29, 2025): It is in the Play Store version, you may want to double check to make sure you do not have the beta version installed which is no longer receiving updates. That was the issue that I had.
Author
Owner

@belatedly commented on GitHub (Sep 29, 2025):

I am not on the beta app, it's the standard app with a September update. I am using Bitwarden self-hosted, is there a specific version required on that end? I uninstalled and reinstalled the app and still don't have the option

<!-- gh-comment-id:3346738503 --> @belatedly commented on GitHub (Sep 29, 2025): I am not on the beta app, it's the standard app with a September update. I am using Bitwarden self-hosted, is there a specific version required on that end? I uninstalled and reinstalled the app and still don't have the option
Author
Owner

@Flat commented on GitHub (Sep 29, 2025):

That is the same version I am on. It should be under Settings->Autofill->Privileged Apps, right under Passkey Management

<!-- gh-comment-id:3346830419 --> @Flat commented on GitHub (Sep 29, 2025): That is the same version I am on. It should be under Settings->Autofill->Privileged Apps, right under Passkey Management
Author
Owner

@belatedly commented on GitHub (Sep 29, 2025):

Image Image Image

<!-- gh-comment-id:3346882791 --> @belatedly commented on GitHub (Sep 29, 2025): ![Image](https://github.com/user-attachments/assets/1852fdbc-e18a-4234-b15f-6b9fd0f0a227) ![Image](https://github.com/user-attachments/assets/2bb7318b-d02a-4fc3-a85d-b91621b1e689) ![Image](https://github.com/user-attachments/assets/7bd306dc-672b-4895-8e05-53b573f85ae0)
Author
Owner

@SaintPatrck commented on GitHub (Sep 29, 2025):

Hi @belatedly,

When self-hosting, features that are controlled by server-side feature flags (such as this one) are not available until the flag has been removed. In the case of privileged app management, it was removed in #5914 meaning the functionality will be available for self-hosted users in an upcoming release.

<!-- gh-comment-id:3346989305 --> @SaintPatrck commented on GitHub (Sep 29, 2025): Hi @belatedly, When self-hosting, features that are controlled by server-side feature flags (such as this one) are not available until the flag has been removed. In the case of privileged app management, it was removed in #5914 meaning the functionality will be available for self-hosted users in an upcoming release.
Author
Owner

@belatedly commented on GitHub (Sep 29, 2025):

Thank you for confirming!

<!-- gh-comment-id:3347228650 --> @belatedly commented on GitHub (Sep 29, 2025): Thank you for confirming!
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/android#21402