Firefox Pico keys error #129
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Devices for test:
Sites for testing:
Testing browsers:
Device 1:
Device 2:
Errors:
P.S. I can register the key in (for example) github in chromium and login with passkey in firefox, but i cannot use it for (for example) add email in gh. But if i setup
security.webauthn.ctap2 = falseinabout:configi can add email and cannot login.Same here.
I have some troubles with Firefox in two diffrent environments with my pico2.
Raspberry pi pico2 (RP2350). Firmware: development-37d7d7f
Tested environments:
On env 1 I was able to use my pico only for authentication after registration my key using chrome.
Key registration was not completed successfully.
On env 2 FF throws the same error, that @TheMaxMur has mentioned. (UPD) After disabling app armor profile for FF I was able to authenticate on GH using already registered key. Key registration still throws the same error.
On env 3 authentication completed successfully. Didn't have time test the Key registration.
I have exactly the same problems on waveshare rp2350 one, doesn't work on Librewolf and Firefox, but works fine on Chromium and Google Chrome.
Firmware version https://github.com/polhenarejos/pico-fido/releases/tag/v6.4-eddsa1
i flash devlopment
fef46dc3 site on firefox both Success, but vaultwarden webauth can not select pico key deviceU can temporary disable vaultwarden window for register passkey in settings
@polhenarejos any ideas or recommendations?
I don't know what to say. I tested many times FF in macOS and Windows 11 and works all times with nothing special. I don't know what is different from flipper.
Could you advise something on how can we debug the firefox-usb connection?
find
RUST_LOG=authenticator=debug firefoxI found this site, that makes some compatibility tests
Here is my results for chrome:
And for Firefox:
This is linux environment, KDE Neon 6.1.
Win11 Firefox 131.0.3
Waveshare RP2350 One Fireware fef46dc
same hardware and fireware chrome 134.0.6998.119
What is strange to me is this line:
I debugged in Ubuntu and this offset corresponds to the end of the response, so I guess it seems it doesn't like trailing 0s. If I do not trail with 0 then nothing works (it breaks the specs).
Is such behavior related to https://github.com/mozilla/authenticator-rs?
Could we help with something?
Not sure, I'm trying to find the string "trailing data at offset" but doesn't appear in authenticator-rs. Perhaps it's more related with FF and what is returned by authenticator-rs. I'd need to find where this error is raised.
I found this in authenticator-rs repo, and try found call this in repo. I think the problem in somewhere near in the function call
from_slice.Yes, it's from the deserializer but it belongs to serde repo, and "Trailing data at offset" doesn't appear there.
I found this in repo. And try found call this. The offset comes from here.
@polhenarejos what do you think? How to fix this issue?
I don't know where this trailing data comes from, not from Pico Keys, for sure. Strangely, FF is not working in Linux only; in macOS and Windows works well, so it makes difficultier spotting the bug.
I think this is due to the fact that windows/macos uses the OS API to handle the security key
There is no such API on Linux, so authenticator-rs is used
I have started an issue in the authenticator-rs repository mozilla/authenticator-rs#346, can you help us with it? Maybe something will come to light.
We tested Firefox (136.0.2) together with YubiKey 5C (Firmware version: 5.7.1). Firefox did not generate any errors.
Can you do the same and intercept the usb port with Wireshark and upload the pcap?
Yes, we could, I'll update this comment a bit later today.
Thanks for your responsiveness!!!
@polhenarejos , first of all, our man, who has a yubikey is not getting online, so pcap will be here a bit later.
After all, we didn't do nothing :))
We tried to play with authenticator-rs itself and with the Pico-Fido firmware. We found, that after commenting out this two lines and changing the values (5 : 4 -> 4 : 3) in this line firefox get's in work. Authentication works everythere, on all sites. There is only one exception, in the https://webauthn.bin.coffee/. It still throws error, but this time it is diffrent. Credentials registration works showing this in it's output:
And here is output from assertion step:
Also, we used debug mode in the authenticator-rs and tried to display all available information from authentication process. We found, that before applying changes mentioned earlier to the pico-fido, pico returns this value:
After applying the changes, pico is returning this value:
(It seems, that there is only 2 last bytes gets removed)
On authenticator-rs side error seems to come from this line.
Note, that in chrome on linux https://webauthn.bin.coffee/ works well with both pico-fido firmware versions: originals from development branch and with development branch with our modifications.
If it is necessary, we could sniff usb from ours pico boards... Still waiting for response from our guy with yubikey...
Again, thanks for your awesome work!
Awesome debug work.
Then it seems it does not support epAtt return parameter. I’ll push a fix to return it only when EA is supported.
Btw, we research mention "epAtt" in authenticator-rs and find this in mozilla/authenticator-rs#339.
So, mozilla knows about the bug, and has had a fix for it for like a year now, but it still hasn't merged.