github-starred/android
2
0
Fork 0
mirror of https://github.com/bitwarden/android.git synced 2026-03-14 22:25:22 -05:00
Code Issues 144 Packages Projects Releases 116 Wiki Activity

[PR #662] [CLOSED] WIP: Implement U2F TwoFactor Authorization (on Android) #2542

New Issue
Closed
opened 2025-11-26 23:20:48 -06:00 by GiteaMirror · 0 comments
GiteaMirror commented 2025-11-26 23:20:48 -06:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/bitwarden/android/pull/662
Author: @mastacheata
Created: 11/30/2019
Status: ❌ Closed

Base: master ← Head: master

📄 Description

NOTE: This is a work in progress, just opened the pull request in order to properly share the idea and ask for help,

I started working on FIDO-U2F 2nd Factor stuff yesterday, but only got to a point where it will immediately return from the intent without even trying to ask for a token. Instead I get an ErrorResponse with ERROR_OTHER as the Response Code.

I've so far identified 2 possible causes, but am not sure about that as there is no more information in the error than "Other".

Cause 1 woud be that I have the appId wrong. I tried to get that from the challenge issued by the Bitwarden server, but that might be a mistake as a JSON URL is not actually an appId. Instead I should probably pick one of the IDs from that JSON file (in this case, the Android App identifier).
If that is the case, should I just hardcode the ID, grab the one from the remote JSON or is there a way for the Android part of the app to know it's own ID?

The other thing that might be wrong is how I deserialize and then convert to the requested byte array for the keys from a string. In the debugger the string representation of the keys list changes multiple times between the string from the JSON response, the byte array and the "RegisteredKeys" object.

In the end I somehow need to retry the login with the signed challenge / the response from the U2F key. I have no idea how to do that, All the other 2-factor challenges work without sending a challenge to the 3rd party and are either time or account based as it seems.

I guess I'll figure that out as soon as I got the correct signed challenge / the response from the U2F token.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/bitwarden/android/pull/662 **Author:** [@mastacheata](https://github.com/mastacheata) **Created:** 11/30/2019 **Status:** ❌ Closed **Base:** `master` ← **Head:** `master` --- ### 📄 Description NOTE: This is a work in progress, just opened the pull request in order to properly share the idea and ask for help, I started working on FIDO-U2F 2nd Factor stuff yesterday, but only got to a point where it will immediately return from the intent without even trying to ask for a token. Instead I get an ErrorResponse with ERROR_OTHER as the Response Code. I've so far identified 2 possible causes, but am not sure about that as there is no more information in the error than "Other". Cause 1 woud be that I have the appId wrong. I tried to get that from the challenge issued by the Bitwarden server, but that might be a mistake as a JSON URL is not actually an appId. Instead I should probably pick one of the IDs from that JSON file (in this case, the Android App identifier). If that is the case, should I just hardcode the ID, grab the one from the remote JSON or is there a way for the Android part of the app to know it's own ID? The other thing that might be wrong is how I deserialize and then convert to the requested byte array for the keys from a string. In the debugger the string representation of the keys list changes multiple times between the string from the JSON response, the byte array and the "RegisteredKeys" object. In the end I somehow need to retry the login with the signed challenge / the response from the U2F key. I have no idea how to do that, All the other 2-factor challenges work without sending a challenge to the 3rd party and are either time or account based as it seems. I guess I'll figure that out as soon as I got the correct signed challenge / the response from the U2F token. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2025-11-26 23:20:48 -06:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
app:authenticator
app:password-manager
bug
bug-passkey
customer-support
duplicate
enhancement
good first issue
help wanted
needs-reply
needs-response
pull-request
Mirrored from GitHub Pull Request
 question
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/android#2542
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?