[GH-ISSUE #5168] Amazon and Webauthn.io think i'm using an icloud keychain #8253

Open
opened 2026-04-11 01:23:24 -05:00 by GiteaMirror · 21 comments
Owner

Originally created by @Kemeros on GitHub (May 11, 2025).
Original GitHub issue: https://github.com/bitwarden/android/issues/5168

Origin

Native Application (non-browser app)

Web URL or App name

webauthn.io and amazon.ca

Passkey Action

  • Creating new passkey (Registration)
  • Signing in (Authentication)

Build Information

Android 15
BP1A.250505.005
Pixel 9

Additional Information

I registered with Bitwarden as my autofill provider.
Using Firefox Beta 139 and tested with Chrome 136. Same result.

Also strangely, webauthn.io calls on Bitwarden mobile correctly, but Amazon brings up Android's native passkey menu instead of Bitwarden.

Amazon:

Image

Webauthn.io:

Image

Image

Not sure what's wrong.

Issue Tracking Info

  • I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.
Originally created by @Kemeros on GitHub (May 11, 2025). Original GitHub issue: https://github.com/bitwarden/android/issues/5168 ### Origin Native Application (non-browser app) ### Web URL or App name webauthn.io and amazon.ca ### Passkey Action - [x] Creating new passkey (Registration) - [ ] Signing in (Authentication) ### Build Information Android 15 BP1A.250505.005 Pixel 9 ### Additional Information I registered with Bitwarden as my autofill provider. Using Firefox Beta 139 and tested with Chrome 136. Same result. Also strangely, webauthn.io calls on Bitwarden mobile correctly, but Amazon brings up Android's native passkey menu instead of Bitwarden. Amazon: ![Image](https://github.com/user-attachments/assets/11624f77-06bd-412f-8134-d827de15001d) Webauthn.io: ![Image](https://github.com/user-attachments/assets/b348899e-b7f4-4726-9c55-93e5b9381310) ![Image](https://github.com/user-attachments/assets/0dfe1443-22fb-4fdf-8e8c-269abf23c393) Not sure what's wrong. ### Issue Tracking Info - [x] I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.
GiteaMirror added the bug-passkeyapp:password-manager labels 2026-04-11 01:23:24 -05:00
Author
Owner

@S-Kakar commented on GitHub (May 11, 2025):

Thank you for your report! We've added this to our internal board for review.
ID: PM-21479

<!-- gh-comment-id:2869324881 --> @S-Kakar commented on GitHub (May 11, 2025): Thank you for your report! We've added this to our internal board for review. ID: PM-21479
Author
Owner

@SaintPatrck commented on GitHub (May 13, 2025):

@Kemeros what version of Bitwarden are you experiencing this on?

<!-- gh-comment-id:2878096845 --> @SaintPatrck commented on GitHub (May 13, 2025): @Kemeros what version of Bitwarden are you experiencing this on?
Author
Owner

@Kemeros commented on GitHub (May 13, 2025):

@SaintPatrck

Sorry i forgot to include it. Here you go.

Version: 2025.4.0 (20100)
📱 google Pixel 9 Pro 🤖 15@35 📦 prod
🧱 commit: bitwarden/android/release/2025.04-rc19@bee09de972c3870de0d54a0067996be473ec55c7
💻 build source: bitwarden/android/actions/runs/14536896217/attempts/1

<!-- gh-comment-id:2878190910 --> @Kemeros commented on GitHub (May 13, 2025): @SaintPatrck Sorry i forgot to include it. Here you go. Version: 2025.4.0 (20100) 📱 google Pixel 9 Pro 🤖 15@35 📦 prod 🧱 commit: bitwarden/android/release/2025.04-rc19@bee09de972c3870de0d54a0067996be473ec55c7 💻 build source: bitwarden/android/actions/runs/14536896217/attempts/1
Author
Owner

@Kemeros commented on GitHub (Jun 2, 2025):

Same result with the new version.

Version: 2025.5.0 (20269)
📱 google Pixel 9 Pro 🤖 15@35 📦 prod
🧱 commit: bitwarden/android/release/2025.05-rc20@1e665db8aeb92989bdc7e312506cddd4887cde8e
💻 build source: bitwarden/android/actions/runs/15300207138/attempts/1

<!-- gh-comment-id:2931331125 --> @Kemeros commented on GitHub (Jun 2, 2025): Same result with the new version. Version: 2025.5.0 (20269) 📱 google Pixel 9 Pro 🤖 15@35 📦 prod 🧱 commit: bitwarden/android/release/2025.05-rc20@1e665db8aeb92989bdc7e312506cddd4887cde8e 💻 build source: bitwarden/android/actions/runs/15300207138/attempts/1
Author
Owner

@Kemeros commented on GitHub (Jul 2, 2025):

Same thing with new version and latest Firefox beta

Version: 2025.6.1 (20398)
📱 google Pixel 9 Pro 🤖 16@36 📦 prod
🧱 commit: bitwarden/android/release/hotfix-v2025.6.0-bwpm@e8878d321546a846909c70c00cdf8d7071f0ecf0
💻 build source: bitwarden/android/actions/runs/15984517798/attempts/1

<!-- gh-comment-id:3029462518 --> @Kemeros commented on GitHub (Jul 2, 2025): Same thing with new version and latest Firefox beta Version: 2025.6.1 (20398) 📱 google Pixel 9 Pro 🤖 16@36 📦 prod 🧱 commit: bitwarden/android/release/hotfix-v2025.6.0-bwpm@e8878d321546a846909c70c00cdf8d7071f0ecf0 💻 build source: bitwarden/android/actions/runs/15984517798/attempts/1
Author
Owner

@Kemeros commented on GitHub (Jul 8, 2025):

I tried with the web extension on my PC on Amazon.ca:

Image

Bitwarden's web extension gets recognized as "Other" this time.

It's hard to tell if this is a problem with the way websites implement passkeys or if Bitwarden is missing something?

<!-- gh-comment-id:3047017311 --> @Kemeros commented on GitHub (Jul 8, 2025): I tried with the web extension on my PC on Amazon.ca: <img width="2151" height="798" alt="Image" src="https://github.com/user-attachments/assets/97c62241-beeb-48e6-a949-bb8a5dafad7c" /> Bitwarden's web extension gets recognized as "Other" this time. It's hard to tell if this is a problem with the way websites implement passkeys or if Bitwarden is missing something?
Author
Owner

@Kemeros commented on GitHub (Jul 29, 2025):

@SaintPatrck

I noticed something in the following PR:
https://github.com/bitwarden/android/pull/5601

In the video, you register in Webauthn.io with Bitwarden but then authenticate with Google Password Manager.

Am i confusing how all of this work? I thought Bitwarden becomes the provider and should be the one to show up?

<!-- gh-comment-id:3130202518 --> @Kemeros commented on GitHub (Jul 29, 2025): @SaintPatrck I noticed something in the following PR: https://github.com/bitwarden/android/pull/5601 In the video, you register in Webauthn.io with Bitwarden but then authenticate with Google Password Manager. Am i confusing how all of this work? I thought Bitwarden becomes the provider and should be the one to show up?
Author
Owner

@SaintPatrck commented on GitHub (Jul 29, 2025):

Hi @Kemeros

I know it's a bit confusing because the Google Password Manager logo is displayed, but Bitwarden is providing options and performing authentication when those options are selected.

The logo displayed during authentication is controlled by Chrome and we originally reported it to Google as a bug, here: https://issuetracker.google.com/issues/430400730. They informed us of Chrome's design choice and subsequently opened a change request with Chrome on our behalf.

<!-- gh-comment-id:3130498630 --> @SaintPatrck commented on GitHub (Jul 29, 2025): Hi @Kemeros I know it's a bit confusing because the Google Password Manager logo is displayed, but Bitwarden _is_ providing options and performing authentication when those options are selected. The logo displayed during authentication is controlled by Chrome and we originally reported it to Google as a bug, here: https://issuetracker.google.com/issues/430400730. They informed us of Chrome's design choice and subsequently opened a change request with Chrome on our behalf.
Author
Owner

@Kemeros commented on GitHub (Jul 29, 2025):

@SaintPatrck

Forgot to say hi, how rude of me. Hello!

Ah it's a chrome thing i see. Thank you for the clarification. It explains why i see a different menu on firefox.

You saying that made me realize i haven't tried again with chrome with the new versions and... Well... Unlike Firefox where the problems are the same, there are new behaviors in Chrome.

Unlike you i see Bitwarden's logo and not Chrome's (strange). I can register and authenticate on webauthn.io correctly. Also new, webauthn.io shows Bitwarden as the provider instead of iCloud Keychain like Firefox currently. Passkeys.io registers with Bitwarden correctly... But the website gets a timed out error so the passkey exists only in my vault so the authentication fails as the website didn't register me correctly. Same behavior as passkeys.io with Amazon.ca.

So i realize... Firefox is partly a problem... But Bitwarden and/or the websites also don't agree with each other. Only webauthn.io seems more reliable.

I guess passkeys are more bleeding edge than i thought. Will keep trying with new versions. Let me know if you need me to do a test that would help.

Versions of everything during my tests today:

Pixel 9 PRO
Android 16 BP2A.250705.008

Bitwarden Version: 2025.6.1 (20398)

Firefox Beta 142.0b3 (Build #2016104751)

Chrome 138.0.7204.168

<!-- gh-comment-id:3130589040 --> @Kemeros commented on GitHub (Jul 29, 2025): @SaintPatrck Forgot to say hi, how rude of me. Hello! Ah it's a chrome thing i see. Thank you for the clarification. It explains why i see a different menu on firefox. You saying that made me realize i haven't tried again with chrome with the new versions and... Well... Unlike Firefox where the problems are the same, there are new behaviors in Chrome. Unlike you i see Bitwarden's logo and not Chrome's (strange). I can register and authenticate on webauthn.io correctly. Also new, webauthn.io shows Bitwarden as the provider instead of iCloud Keychain like Firefox currently. Passkeys.io registers with Bitwarden correctly... But the website gets a timed out error so the passkey exists only in my vault so the authentication fails as the website didn't register me correctly. Same behavior as passkeys.io with Amazon.ca. So i realize... Firefox is partly a problem... But Bitwarden and/or the websites also don't agree with each other. Only webauthn.io seems more reliable. I guess passkeys are more bleeding edge than i thought. Will keep trying with new versions. Let me know if you need me to do a test that would help. Versions of everything during my tests today: Pixel 9 PRO Android 16 BP2A.250705.008 Bitwarden Version: 2025.6.1 (20398) Firefox Beta 142.0b3 (Build #2016104751) Chrome 138.0.7204.168
Author
Owner

@Kemeros commented on GitHub (Aug 27, 2025):

@SaintPatrck

New behaviors with the latest versions

Now the Bitwarden provider is called for passkeys in all the following scenarios. No more google password manager pop up. Awesome. However, the iCloud keychain is still a thing on Firefox. A few failures on Chrome as well.

Amazon.ca
Firefox = Success but listed as iCloud Keychain ⚠️
Chrome = Error

Image

Webauthn.io
Firefox = Success but listed as iCloud Keychain ⚠️
Chrome = Success and listed as Bitwarden

Passkeys.io
Firefox = Janky but success
Chrome = Error

Image

Versions:
Pixel 9 Pro
Android 16 BP2A.250805.005
Bitwarden 2025.8.0 (20577)
Firefox 143.0b4
Chrome 139.0.7258.143

<!-- gh-comment-id:3226696336 --> @Kemeros commented on GitHub (Aug 27, 2025): @SaintPatrck New behaviors with the latest versions Now the Bitwarden provider is called for passkeys in all the following scenarios. No more google password manager pop up. Awesome. However, the iCloud keychain is still a thing on Firefox. A few failures on Chrome as well. **Amazon.ca** Firefox = Success but listed as iCloud Keychain ⚠️ Chrome = Error ❌ <img width="960" height="1200" alt="Image" src="https://github.com/user-attachments/assets/39227fb5-15b1-4c52-9806-10f15ac27792" /><br> **Webauthn.io** Firefox = Success but listed as iCloud Keychain ⚠️ Chrome = Success and listed as Bitwarden ✅ **Passkeys.io** Firefox = Janky but success Chrome = Error ❌ <img width="959" height="1435" alt="Image" src="https://github.com/user-attachments/assets/36051828-7767-4684-8957-95a4b9e7f728" /><br> **Versions:** Pixel 9 Pro Android 16 BP2A.250805.005 Bitwarden 2025.8.0 (20577) Firefox 143.0b4 Chrome 139.0.7258.143
Author
Owner

@Kemeros commented on GitHub (Nov 24, 2025):

Still listed as iCloud Keychain instead of Bitwarden in Amazon and Webauthn.io

Firefox: 146.0b7 (Build #2016128119)

Bitwarden:
Version: 2025.11.0 (20967)
📱 google Pixel 9 Pro 🤖 16@36 📦 prod
🧱 commit: bitwarden/android/release/2025.10-rc38@6d71f0c5d66a466a20e4636be438609d2703063c
💻 build source: bitwarden/android/actions/runs/19309927902/attempts/1
🦀 SDK: 1.0.0-3436-2a00b727
🌩 Server: 2025.11.0 @ US

<!-- gh-comment-id:3572116724 --> @Kemeros commented on GitHub (Nov 24, 2025): Still listed as iCloud Keychain instead of Bitwarden in Amazon and Webauthn.io Firefox: 146.0b7 (Build #2016128119) Bitwarden: Version: 2025.11.0 (20967) 📱 google Pixel 9 Pro 🤖 16@36 📦 prod 🧱 commit: bitwarden/android/release/2025.10-rc38@6d71f0c5d66a466a20e4636be438609d2703063c 💻 build source: bitwarden/android/actions/runs/19309927902/attempts/1 🦀 SDK: 1.0.0-3436-2a00b727 🌩 Server: 2025.11.0 @ US
Author
Owner

@Kemeros commented on GitHub (Dec 9, 2025):

Version: 2025.11.1 (20994)
📱 google Pixel 9 Pro 🤖 16@36 📦 prod
🧱 commit: bitwarden/android/release/2025.11-rc39@63c4e1fe9314d2b2f2c0989b5bb8c265b3cbc57e
💻 build source: bitwarden/android/actions/runs/19583271293/attempts/2
🦀 SDK: 1.0.0-3436-2a00b727
🌩 Server: 2025.11.1 @ US

Still iCloud Keychain

Btw. Any chance you could remove the "Bitwarden 2025-26" license at the top of the version string when we copy the version from the app? It's superfluous no?

<!-- gh-comment-id:3634766725 --> @Kemeros commented on GitHub (Dec 9, 2025): Version: 2025.11.1 (20994) 📱 google Pixel 9 Pro 🤖 16@36 📦 prod 🧱 commit: bitwarden/android/release/2025.11-rc39@63c4e1fe9314d2b2f2c0989b5bb8c265b3cbc57e 💻 build source: bitwarden/android/actions/runs/19583271293/attempts/2 🦀 SDK: 1.0.0-3436-2a00b727 🌩 Server: 2025.11.1 @ US Still iCloud Keychain Btw. Any chance you could remove the "Bitwarden 2025-26" license at the top of the version string when we copy the version from the app? It's superfluous no?
Author
Owner

@pamperer562580892423 commented on GitHub (Dec 10, 2025):

I now was curious about this... and I get the same result with Firefox on webauthn.io. What I found also interesting: it says "of unknown discoverability":

Screenshot_20251210-023543~2.png

© Bitwarden Inc. 2015-2025

Version: 2025.11.1 (20994)
📱 Fairphone FP5 🤖 15@35 📦 prod
🧱 commit: bitwarden/android/release/2025.11-rc39@63c4e1fe9314d2b2f2c0989b5bb8c265b3cbc57e
💻 build source: bitwarden/android/actions/runs/19583271293/attempts/2
🦀 SDK: 1.0.0-3436-2a00b727
🌩 Server: 2025.11.1 @ EU

<!-- gh-comment-id:3634990472 --> @pamperer562580892423 commented on GitHub (Dec 10, 2025): I now was curious about this... and I get the same result with Firefox on webauthn.io. What I found also interesting: it says "of unknown discoverability": ![Screenshot_20251210-023543~2.png](https://github.com/user-attachments/assets/c40d62fc-b077-4066-ab35-082e7c62cee8) © Bitwarden Inc. 2015-2025 Version: 2025.11.1 (20994) 📱 Fairphone FP5 🤖 15@35 📦 prod 🧱 commit: bitwarden/android/release/2025.11-rc39@63c4e1fe9314d2b2f2c0989b5bb8c265b3cbc57e 💻 build source: bitwarden/android/actions/runs/19583271293/attempts/2 🦀 SDK: 1.0.0-3436-2a00b727 🌩 Server: 2025.11.1 @ EU
Author
Owner

@Kemeros commented on GitHub (Dec 10, 2025):

I now was curious about this... and I get the same result with Firefox on webauthn.io. What I found also interesting: it says "of unknown discoverability":

Oh you're right. It changed from Synced Passkey to unkown discoverability.

Not sure why that translate to iCloud Keychain instead unknown or something like that.

<!-- gh-comment-id:3635120574 --> @Kemeros commented on GitHub (Dec 10, 2025): > I now was curious about this... and I get the same result with Firefox on webauthn.io. What I found also interesting: it says "of unknown discoverability": Oh you're right. It changed from Synced Passkey to unkown discoverability. Not sure why that translate to iCloud Keychain instead unknown or something like that.
Author
Owner

@pamperer562580892423 commented on GitHub (Dec 10, 2025):

Not sure why that translate to iCloud Keychain instead unknown or something like that.

I would guess that has more to do with the AAGUID - it's either being just zeros... or those zeros translate to something like "unknown/unreadable AAGUID"?!

<!-- gh-comment-id:3635145452 --> @pamperer562580892423 commented on GitHub (Dec 10, 2025): > Not sure why that translate to iCloud Keychain instead unknown or something like that. I would guess that has more to do with the AAGUID - it's either being just zeros... or those zeros translate to something like "unknown/unreadable AAGUID"?!
Author
Owner

@Kemeros commented on GitHub (Dec 10, 2025):

I guess so. Seems to get the right AAGUID with Chrome but not Firefox.

<!-- gh-comment-id:3635378116 --> @Kemeros commented on GitHub (Dec 10, 2025): I guess so. Seems to get the right AAGUID with Chrome but not Firefox.
Author
Owner

@Kemeros commented on GitHub (Dec 10, 2025):

Some people had a similar problem with Windows 11(Not sure it was with Bitwarden but still)

https://www.reddit.com/r/webauthn/comments/1g15k5x/how_to_get_the_correct_aaguid_from_windows_11/

Using Direct Attestaion does not fix it for me in Firefox on Android

<!-- gh-comment-id:3639423748 --> @Kemeros commented on GitHub (Dec 10, 2025): Some people had a similar problem with Windows 11(Not sure it was with Bitwarden but still) https://www.reddit.com/r/webauthn/comments/1g15k5x/how_to_get_the_correct_aaguid_from_windows_11/ Using Direct Attestaion does not fix it for me in Firefox on Android
Author
Owner

@Kemeros commented on GitHub (Dec 12, 2025):

There is a year old bugzilla ticket that seems to be the same issue. The person is using google password mamager with Firefox on MacOS.

https://bugzilla.mozilla.org/show_bug.cgi?id=1935842

I added comments and a screenshot to the ticket.

It might be a Firefox problem after all.

<!-- gh-comment-id:3646641144 --> @Kemeros commented on GitHub (Dec 12, 2025): There is a year old bugzilla ticket that seems to be the same issue. The person is using google password mamager with Firefox on MacOS. https://bugzilla.mozilla.org/show_bug.cgi?id=1935842 I added comments and a screenshot to the ticket. It might be a Firefox problem after all.
Author
Owner

@Kemeros commented on GitHub (Mar 28, 2026):

@SaintPatrck

Almost a year later, this is still an issue on Android with the latest Firefox and Bitwarden clients.

Any chance you guys can coordonate with Mozilla to fix this?

I love passkeys but bugs like this make them look like a feature still in beta stage and unreliable.

<!-- gh-comment-id:4148122499 --> @Kemeros commented on GitHub (Mar 28, 2026): @SaintPatrck Almost a year later, this is still an issue on Android with the latest Firefox and Bitwarden clients. Any chance you guys can coordonate with Mozilla to fix this? I love passkeys but bugs like this make them look like a feature still in beta stage and unreliable.
Author
Owner

@abergs commented on GitHub (Apr 7, 2026):

@Kemeros I agree that these kind of quirks are very annoying. Thanks for being persistent.

I do believe it's a firefox issue and that unfortunately not something we're able to fix. The only final confirmation on that suspication would be to verify that google password manager runs into the same problem when used from firefox.

<!-- gh-comment-id:4197581710 --> @abergs commented on GitHub (Apr 7, 2026): @Kemeros I agree that these kind of quirks are very annoying. Thanks for being persistent. I do believe it's a firefox issue and that unfortunately not something we're able to fix. The only final confirmation on that suspication would be to verify that google password manager runs into the same problem when used from firefox.
Author
Owner

@Kemeros commented on GitHub (Apr 7, 2026):

@abergs

Good test idea. You are correct. With google password manager i get the same:

Image

Do you guys have any contacts at Mozilla? The bugzilla ticket mentioned higher has no engement. It's over a year old. Tagging people or requesting info triggered a classification change and... That's it.

<!-- gh-comment-id:4198504298 --> @Kemeros commented on GitHub (Apr 7, 2026): @abergs Good test idea. You are correct. With google password manager i get the same: <img width="949" height="1090" alt="Image" src="https://github.com/user-attachments/assets/9407863f-73d1-45ed-8731-1d0cb804ec21" /> Do you guys have any contacts at Mozilla? The bugzilla ticket mentioned higher has no engement. It's over a year old. Tagging people or requesting info triggered a classification change and... That's it.
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/android#8253