Support for U2F / Fido2 / webauthn?

[flipsa]

Hey there,

I use LineageOS for MicroG on my NFC enabled phone and recently bought a Yubikey 5 NFC. While the phone does detect the Yubikey via NFC or UCB-OTG, there seems to be no support for U2F/ Fido2 / webauthn. I used the Yubico U2F demo site to test it.

If I understand correctly, this functionality is provided on stock Android with the usual Google Apps through the Google play services library, which then exposes it via an API to the mobile browser. On my device, depending on the browser I either get "The user agent does not support public key credentials" (Jelly), or I get a timeout while trying (Chrome, Firefox, Brave).

On a non LineageOS / non-microg device with the Chrome browser, the Yubico demo site works fine.

The browsers (except Jelly) all have support for U2F if I am not mistaken, so that is not the reason I think...

Are there any plans to incorporate this in MicroG? I could not find any info on it, so I'm asking here.

Thanks for any leads - and of course for MicroG in general, I appreciate it very much!

• Oneplus 6 (Enchilada)
• LineageOS 16 for MicroG (official build from last week)
• tried with the following browsers: Jelly, Chrome, Firefox, Brave

[afgks]

Same question here.

[gtbuchanan]

Here's a Chromium ticket confirming this is handled by Google Play Services. I just wanted to throw in that the PIN implementation is especially important to me.

[bintzandt]

Hi everyone, I was wondering if anybody is currently working on this issue?

[Sami32]

It seem that this issue should affect CalyxOS, /e/ OS and some others as well.
So Apps requiring a high security level like banking or trading have to rely on weaker biometrics or 2FA at best :(

I guess that now with more workers doing their job from home their enterprise will ask for some security level using keys like Yubikey, OnlyKey...

[jr64]

I'm very interested in this feature as well. At least support for simple Registration/Sign-In could probably be implemented fairly easily using https://github.com/cotechde/hwsecurity.

I've considered trying that route but I'm unsure regarding the licenses. This project is Apache 2.0 licensed, hwsecurity is GPLv3. From my (admittedly very limited) understanding of Open Source license compatibility, this means we can't even link against that library. Is that correct? Can anyone with more knowledge on that subject confirm/deny before I waste time on an unusable implementation?

[ssaavedra]

You should not link to that directly or this project would need to switch to GPLv3. However, you could expose an API at this project level that could be implemented in a separate app, like what is done with location providers. This way the supposed hwsecurity "mfa-provider" (or whatever we call it) itself could be a GPLv3 app, keeping microG on the other side of the API, and no licensing issues.

[jr64]

Yeah, that's what I thought, thank you for confirming. While not ideal for the end user, I guess this is still the most viable solution.

I currently don't have a phone that is suitable for microG but I do plan on getting one. I'll give this a go if I can manage to find the time.

[dschuermann]

Just a small note from us, the devs of the Hardware Security SDK at https://github.com/cotechde/hwsecurity: Currently, the SDK is dual-licensed under the GPLv3 and a proprietary license. This allows us to have a business model by selling the SDK under the proprietary license that allows our customers to include it in their closed-source software.

Our business no longer works when we would license the SDK under Apache v2 since the Apache license allows the inclusion in closed-source apps.

That said, feel free to build one GPLv3 app with the SDK that exposes the API via AIDL and the call it from microG.

[nsp-devel]

+1 here, from someone using FIDO2/WebAuthN in production at day job, and having implemented FIDO2 server-side protocol in PHP.

Having support either in MicroG or the OS build would be great. Noting from the Chromium ticket referenced above, this is nothing that would /have to/ live in MicroG but could go all the way down to AOSP. Sad that there's no resource in AOSP for this to happen.

I guess an app+linking to HWSecurity code is the easiest way forward short-term.

[samsapti]

I just want to point out, that there's another issue regarding FIDO implementation: last time I tried using FIDO (YubiKey 5 NFC) on a regular Google Play Services enabled Android phone, the only browser that worked with it was Google Chrome. Other browsers didn't work. Now, I don't know if it's Google's FIDO implementation that intentionally makes it unusable in other browsers (since other browsers like Firefox technically do have support for FIDO, just look in about:config) or if it's something else.

If we were to implement FIDO in microG or all the way down to AOSP, we would still have to wait for third party browsers to implement the API.

[samsapti]

Btw, is there anything wrong with switching microG to GPLv3? Just curious.

[nsp-devel]

I tried current Firefox 92 on a Samsung S6 with stock Android 7 and that supported FIDO2 just fine. I.e. can't confirm a "Chrome only".

[duplexsystem]

Are the microg maintainers against bountys because if not I'd like to put one on this

[duplexsystem]

I added a 20$ bounty for this

[samsapti]

I tried current Firefox 92 on a Samsung S6 with stock Android 7 and that supported FIDO2 just fine. I.e. can't confirm a "Chrome only".

Hmm, then they've probably fixed it since the last time I tried. I don't have Google Services anymore, so I can't test it again. But that's not important anyway, the important part right now is getting FIDO support to microG. Would it be possible to make the mfa-provider-app-thingy able to translate Google Services FIDO API calls into API calls compatible with the HWSecurity SDK? Because that would make FIDO enabled browsers, that are currently working with Google Services, work with microG.

Another thing I wanna point out is this, don't know how it's gonna play out with the (hopefully) upcoming microG implementation.

[duplexsystem]

Important to note that as of version 92 Firefox Android supports webauth.

Added support for Web Authentication API, which allows USB tokens (such as the use of USB or Bluetooth Security Key) for website authentication.

https://www.mozilla.org/en-US/firefox/android/92.0/releasenotes/

[samsapti]

Important to note that as of version 92 Firefox Android supports webauth.

Added support for Web Authentication API, which allows USB tokens (such as the use of USB or Bluetooth Security Key) for website authentication.

https://www.mozilla.org/en-US/firefox/android/92.0/releasenotes/

It still doesn't work with microG tho, I tried it a couple of days ago.

[duplexsystem]

It still doesn't work with microG tho, I tried it a couple of days ago.

correct

[Nuc1eoN]

I would also be interested in FIDO2 support.

I added a 20$ bounty for this

Where can I add a bounty?

[duplexsystem]

I would also be interested in FIDO2 support.

I added a 20$ bounty for this

Where can I add a bounty?

https://www.bountysource.com/issues/75974640-support-for-u2f-fido2-webauthn

[ssaavedra]

Are bounties still interesting here? On bountysource, microG project says that other methods should be considered instead. I'd be OK if @mar-v-in takes this, but if this is not an "official priority" I'd be also ok sponsoring somebody external to the project for this task (would love to confirm if he would, too).

Should we just fund the bountysource? Anyone's estimate of worth raising for this feature to land?

[duplexsystem]

If needed I'd be willing to raise my bounty in order to get a guarantee this feature will be implemented,

[mar-v-in]

Please don't put any bounties on bountysource. They failed to pay out for several months now.

As of now, I haven't looked into what it takes to implement the U2F APIs at all, so I also don't know how much work it would be. I do have it on my list though.

[pepijndevos]

Great to hear. Would be a useful feature to have. Just donated to your GH sponsor instead because this project is what makes my phone usable while maintaining my privacy. Happy to take a stab at some Java/C glue code once it's clear what actually needs to be done.

[bintzandt]

Great to hear. Would be a useful feature to have. Just donated to your GH sponsor instead because this project is what makes my phone usable while maintaining my privacy. Happy to take a stab at some Java/C glue code once it's clear what actually needs to be done.

I have also just set up a recurring donation via GH sponsors so this might hopefully get some extra attention!

(I understand that you might be too busy; just trying to help)

[ssaavedra]

Nice to see a milestone added to this. Thanks for prioritizing it somewhat, @mar-v-in. Glad to be a sponsor as well.

[luken-dev]

Logcat of two attempts at login below.

10-05 22:03:50.326  6140  6174 D GeckoIdleService: next timeout 5000 msec from now
10-05 22:03:50.326  6140  6174 D GeckoIdleService: SetTimerExpiryIfBefore: next timeout 5000 msec from now
10-05 22:03:50.326  6140  6174 D GeckoIdleService: reset timer expiry to 5010 msec from now
10-05 22:03:50.326  6140  6174 D GeckoIdleService: Reset idle timeout: tell observer 0x70cf7c9528 user is back
10-05 22:03:50.647  6140  6156 W GeckoEditable: Invalid token
10-05 22:03:51.952  3659  3659 V InlineSuggestionRenderService: handleDestroySuggestionViews called for 0:1597396344
10-05 22:03:51.969  6140  6140 I GeckoSession: handleMessage GeckoView:PageStart uri=
10-05 22:03:52.104  6140  6154 W System  : A resource failed to call release. 
10-05 22:03:52.104  6140  6154 W System  : A resource failed to call release. 
10-05 22:03:52.227  6140  6390 I places::storage::history: breadcrumb: apply_observation: begin_transaction
10-05 22:03:52.283  6140  6390 I places::storage::history: breadcrumb: apply_observation: commit
10-05 22:03:52.626  6140  6390 I places::storage::history: breadcrumb: apply_observation: begin_transaction
10-05 22:03:52.668  6140  6390 I places::storage::history: breadcrumb: apply_observation: commit
10-05 22:03:55.339  6140  6174 D GeckoIdleService: Get idle time: time since reset 4929 msec
10-05 22:03:55.339  6140  6174 D GeckoIdleService: Idle timer callback: current idle time 4929 msec
10-05 22:03:55.339  6140  6174 D GeckoIdleService: next timeout 71 msec from now
10-05 22:03:55.339  6140  6174 D GeckoIdleService: SetTimerExpiryIfBefore: next timeout 71 msec from now
10-05 22:03:55.340  6140  6174 D GeckoIdleService: reset timer expiry to 81 msec from now
10-05 22:03:55.408  6140  6390 I places::storage::history: breadcrumb: apply_observation: begin_transaction
10-05 22:03:55.436  6140  6174 D GeckoIdleService: Get idle time: time since reset 5025 msec
10-05 22:03:55.436  6140  6174 D GeckoIdleService: Idle timer callback: current idle time 5025 msec
10-05 22:03:55.436  6140  6174 D GeckoIdleService: next timeout 4294967289974 msec from now
10-05 22:03:55.436  6140  6174 D GeckoIdleService: SetTimerExpiryIfBefore: next timeout 4294967289974 msec from now
10-05 22:03:55.436  6140  6174 D GeckoIdleService: reset timer expiry to 4294967289984 msec from now
10-05 22:03:55.436  6140  6174 D GeckoIdleService: Idle timer callback: tell observer 0x70cf7c9528 user is idle
10-05 22:03:55.459  6140  6390 I places::storage::history: breadcrumb: apply_observation: commit
10-05 22:03:55.710  6140  6140 I GeckoSession: handleMessage GeckoView:PageStop uri=null
10-05 22:03:55.716  6140  6930 I SessionStorage/AutoSave: Save: Load finished
10-05 22:03:55.833 19616 19616 D Fido2Privileged: onBind: Intent { act=com.google.android.gms.fido.fido2.privileged.START pkg=com.google.android.gms }
10-05 22:03:55.863 19616 19636 D Fido2Privileged: bound by: GetServiceRequest{serviceId=FIDO2_PRIVILEGED, gmsVersion=12451000, packageName='org.mozilla.firefox', extras=Bundle[{FIDO2_ACTION_START_SERVICE=com.google.android.gms.fido.fido2.privileged.START}]}
10-05 22:03:55.956  6140  6140 I WebAuthnFeature: Received activity delegate request with code: 10
10-05 22:03:49.151  2730  2730 W NotificationHistory: Attempted to add notif for locked/gone/disabled user 0
10-05 22:03:55.957  2730 11408 I ActivityTaskManager: START u0 {cmp=com.google.android.gms/org.microg.gms.fido.core.ui.AuthenticatorActivity (has extras)} from uid 10085
10-05 22:03:55.966   572   572 I android.hardware.power-service-qti: Power setMode: 5 to: 1
10-05 22:03:55.977  2730  2795 D CompatibilityChangeReporter: Compat change id reported: 135634846; UID 10085; state: DISABLED
10-05 22:03:55.978  2730  2812 D CompatibilityChangeReporter: Compat change id reported: 143937733; UID 10085; state: DISABLED
10-05 22:03:55.997  2233  2233 D Zygote  : Forked child process 7274
10-05 22:03:56.006  2730  2812 I ActivityManager: Start proc 7274:com.google.android.gms:ui/u0a85 for pre-top-activity {com.google.android.gms/org.microg.gms.fido.core.ui.AuthenticatorActivity}
10-05 22:03:56.014  7274  7274 E .android.gms:u: Not starting debugger since process cannot load the jdwp agent.
10-05 22:03:56.068  7274  7274 D ApplicationLoaders: Returning zygote-cached class loader: /system/framework/android.test.base.jar
10-05 22:03:56.072  7274  7274 W .android.gms:u: ClassLoaderContext classpath size mismatch. expected=1, found=0 (PCL[/system/framework/org.lineageos.platform.jar*1006563850] | PCL[])
10-05 22:03:56.090  7274  7274 D NetworkSecurityConfig: No Network Security Config specified, using platform default
10-05 22:03:56.090  7274  7274 D NetworkSecurityConfig: No Network Security Config specified, using platform default
10-05 22:03:56.091  7274  7274 I MultiDex: VM with version 2.1.0 has multidex support
10-05 22:03:56.091  7274  7274 I MultiDex: Installing application
10-05 22:03:56.091  7274  7274 I MultiDex: VM has multidex support, MultiDex support library is disabled.
10-05 22:03:56.155  7274  7274 D FidoUi  : onCreate caller=org.mozilla.firefox options=BrowserPublicKeyCredentialRequestOptions[PublicKeyCredentialRequestOptions[challenge=AJhMu1kz8rOeOsZ9M7zD2WkLOJ1PfrhBLbk0QfjgRqmMi7NYhmT86icV8zEQ7Hznf7Vt0SaWLOPaupmm0LOshlyb_lId21Wy-F-DjspFeA2QIbHk4valH846MQilCFoWYT95oF7Ka20lMvqAG9fw7WmIM4YNwKaHGSrEGTDekND4RM61EV2sLyAwZbUHpPykoS9sxfDh9DBb26RpJXgyIAPKr_MEwNOkD1FuIwsdVnbYO44IgDFFH5ZIDNwPPpDWf9Fo8eBbWiVfSohDRg3RZC7VzEDV4uCDQOWJqeDNqeQA0L3zM7A1vFVF9Yc5E1J_cwSaUoR8OZ03wOe3ZMQFfwJuI-1nQXUizcdqTyrAi0IbT6woWMuaRhutKUK0kvkWa1jR7lgw4qDLHydx-N1HR7GH0jMkli6oPEjycFiMD_V4EZESZQYd0JRkjpB4MnKLLewdciJilkI1ZNAGuza0rSq-A3Qw9FAQrjMBzpRiBi457n29tYlFfoDyDK-sBNnQzQIaHRnUWqG4P7PuxYuDPcW5uNVfk7E7bWm6g9j64wv9Y0mWdIiUzL3QrzHVAFth6x5tfh60DdzjwatRbH-zmkExteyLOC2ToqIoVuDO1sufh06IaAR6RaehG3mZJq-OvpFsjglWzrs4PSXXo-8rCaS9_G5rezqHsjOeGKOExIsydeYDXLUo1FZEeBxWPyAyvSjCEXUr8TgE8a5pkZcfk7rG9bgGdRyP2gWRpAi7IZhiHlNRbiTQYlke1ZDKfiPtHpC6nvD4KgSMq7V2k0Daf3uccr_v_LdPNG9x9Xe3XiL4vfR1zsUHzzp9uVpjlJas_twSMfbAvqCQiaHvdkNknoX9EerHHEMwR4HyEOHfsdZceXL6S57igPHGhyM3YHLuTabH0EFUGdFDtbw3hwZGQL43O04pTS4aO-jOkoeFeEPIAS0pw04Ny77QN2SfcPKws9mU_j67FaN18sCAdKJXfgG3lnlGhZKudyWA5mS_zTVyIbpzKqo9n8P6yqk1AM4sjNX7-j_sjYolV2zyo2X7tJ5MeQFzVzrGQd9ryr7EJAKa5nvJV9vgbDDTQF0zG_jfl65OwP7HzGnTaUY6SPq91uRTonAJFk6sP4GkGuUXFvCxtrXLQKSsRY1oGOScKlUaGinANimFYg6hqdmLmWfoCOmwBT7fMlr_zDvSc1shGp5stoy2lesYKlbbgMHibbWFfShuiBIn-mUeaI7EKAGzaY-5mijTEaxQr_ze4bb_kbF48z0PGZlnQbgFFUsA_sk5LEqqYI4oOkvD7n0fISzIeytka2EyJq-Frpr76U35ZkPFKW1Gz-UrNf6zdWHbtfNnZ2nVtGr8HV37a2KacyFv0fMiDuxtfoeQtks28kABOVixgqR6ChQiUrFqAHiVPxAmjbvMkPDKI2wCjpzRh_tmrySzesvUWycdroVLCwXG8OMwVFEB1MJLgSjcG0MUauYfdPbeiO-g0xf4EqLR2OYQ6xH6Dhwtq3-jhDKmItDQI4TCdcYxtFlkaUuJFu_cHN7cdWFf48DxdObQ7-mklrdj0Z3mnuNB84V1X3YL5913_rh1gWwWLeu7vYVHEwqQaH_plzkgmJZ27oBhC_GC-nQmBnERoTg27COcLVFF9fBt_uFL8WyEXqYnyfsS7InNuoet6zOTgLc9_nVJhyOQmpFICK1FXWOzBNcU0SQuEJm4ETDBCSKj2r8S-h9fLWUB4oXk0UEHfarYrKuOLz5gz1l6sO4N6cPWBUGR4Z_kdjNLrYF3GyWjk36gts-7EwC8ZLkxDYMt8c_wzQhMJ14RrO-3Y2tu0e80o_UtvJKDkweOPyyTttFRPan3AfJRvrJDhYar3dEy5owumHvpmY__o8AX40ulLTt14E-8kKNfARwNXuHiAoJmPk8bsrHJqTAg5KZSxRURGQz0PHwSZ8mAbckrrT26OgBU8UMdps8UJjZExcwnlh6vm00eidj0XeXD8P4jjbwzEihVN7KtMjn37ETK4l80MdYSBkP7MkZQ_mFqb5pX8JumDRb7lJDhh3wlQgzsv-8c1FYnXU9x5vG3Ph9TC3nMg1PFCSYm3oWaK0U8PrGEfvOWXyjc4OPrZKNxDWQ4_S8dKtlDYrywatbm50Axl6IJz4cudkAc7Ef1Ki1avQaGO6-xzdQhHAQwpsvOYQbWr09f-2rwjIQJhjmXGBt5RQiOJUlZBnOGlyPC7-OagX_hLwlnkDzzI4OBWtN9NYPR7x3tW_kbmu3oyLMG4Z1Jrka-XNakD9ZGie5QdJZy3-2gdoiOI9YKuQgV2u-ZVdoJQwZg4R4BvdosrNcY3TS0H1BPgbPS6Ge3oSG5GPy1XNmRXzSkgxhXnWP5i7BHX_ZTEjbnAzIJds2iQYLg2UHEjmHVEm7Q8VuxkcK-VYtUZ1iV0HMDaDdKRFh89lYKpkeRaRvjJoUqDRD1KZgHKkyC1ElgmfP8hONkjOLO8RyF9KRknLS2H-uQEaNIMfcDPA0um8-hJN0urWuXJaFhNH4drz_TWSYAFdvWjPb259esatRQmGM5LuCaELsAD0dMcfxAqgoERoBjW2ki8g9_IY4OpLz0ekAfw7LD-CATILiaaiTOwTR2AWNJDhD8kybvLoMCyAy99Jhy6yJVz1yLkFDBrrQsZGjv42LTxAJcd2bDAW-Zk3P5HNrmSc_azJ-MXjfYWBvTeIP4Cl70ZRcfH6qKtocHzce7QS6EvSlcXhbLOkbHQBF3lkGrdQgyDhUBlZoZX713kfClBkkFeEVMktjSJlf1pWdihrJpxiW-3Zdiv_pxvrpmnhHYLbZgPUNvvpL19dL_OGyPxvtCEJBd4YKP5jdI4aMsZJTFhRr7Ll11NoGH9tkg5cE4AxOdPb8, timeoutSeconds=120.0, rpId="google.com", allowList=[PublicKeyCredentialDescriptor[W-DEYiPMMcqip9pm5ToRee3jCaOCZcc8qrIPUTuPGbOntMZx7ovaJBDKIXhZMhV60-_Y_7PIkwKSzZMu47sVhA, type=public-key, transports=[]], PublicKeyCredentialDescriptor[sWETwJbeOiv7aAIRqNdclyUXdM7A8Xe0kEN1Mz-dJHCRMXT3TTylpSWyYpGpYj11JuolVvuoK7qYFmLH_fT_nw, type=public-key, transports=[]]], authenticationExtensions=AuthenticationExtensions[fidoAppIdExtension="https://www.gstatic.com/securitykey/origins.json"]], origin=https://accounts.google.com]
10-05 22:03:56.227  7274  7274 D FidoUi  : Finish with error: FIDO AppId must be same TLD+1 (NOT_ALLOWED_ERR)
10-05 22:03:56.270  6140  6140 I WebAuthnFeature: Received activity result with code: 10 and original request code: 10
10-05 22:03:56.281  6140  6140 E WebAuthnTokenManager: errorCode.name: NOT_ALLOWED_ERR
10-05 22:03:56.281  6140  6140 E WebAuthnTokenManager: errorMessage: FIDO AppId must be same TLD+1
10-05 22:03:56.298   572   572 I android.hardware.power-service-qti: Power setMode: 5 to: 0
10-05 22:03:56.339  3434  3451 W System  : A resource failed to call release. 
10-05 22:03:56.339  3434  3451 I chatty  : uid=10149(com.android.launcher3) FinalizerDaemon identical 1 line
10-05 22:03:56.339  3434  3451 W System  : A resource failed to call release. 
10-05 22:03:56.352  6140  6390 I places::storage::history: breadcrumb: apply_observation: begin_transaction
10-05 22:03:56.385  6140  6390 I places::storage::history: breadcrumb: apply_observation: commit
10-05 22:03:56.412  3205  3236 I ndroid.systemu: NativeAlloc concurrent copying GC freed 25535(1260KB) AllocSpace objects, 2(40KB) LOS objects, 49% free, 10MB/20MB, paused 87us total 167.717ms
10-05 22:03:59.373  6140  6174 D GeckoIdleService: next timeout 5000 msec from now
10-05 22:03:59.373  6140  6174 D GeckoIdleService: SetTimerExpiryIfBefore: next timeout 5000 msec from now
10-05 22:03:59.373  6140  6174 D GeckoIdleService: reset timer expiry to 5010 msec from now
10-05 22:03:59.373  6140  6174 D GeckoIdleService: Reset idle timeout: tell observer 0x70cf7c9528 user is back
[ telephony & keyguard entries removed ]
10-05 22:04:00.365  6140  6390 I places::storage::history: breadcrumb: apply_observation: begin_transaction
10-05 22:04:00.398  6140  6390 I places::storage::history: breadcrumb: apply_observation: commit
10-05 22:04:00.483  6140  6140 I WebAuthnFeature: Received activity delegate request with code: 11
10-05 22:04:00.486  2730 11113 I ActivityTaskManager: START u0 {cmp=com.google.android.gms/org.microg.gms.fido.core.ui.AuthenticatorActivity (has extras)} from uid 10085
10-05 22:04:00.489   572   572 I android.hardware.power-service-qti: Power setMode: 5 to: 1
10-05 22:04:00.496  6140  6152 I mozilla.firefo: Background concurrent copying GC freed 162140(6069KB) AllocSpace objects, 8(132KB) LOS objects, 49% free, 4912KB/9825KB, paused 287us total 178.640ms
10-05 22:04:00.501  2730 11113 W ActivityTaskManager: Tried to set launchTime (0) < mLastActivityLaunchTime (63140476)
10-05 22:04:00.524  6140  6154 W System  : A resource failed to call release. 
10-05 22:04:00.537  7274  7274 D FidoUi  : onCreate caller=org.mozilla.firefox options=BrowserPublicKeyCredentialRequestOptions[PublicKeyCredentialRequestOptions[challenge=AJhMu1kpVg9_Ct8qsWStT3NFCIJD12Xzwlj_TOzAWzHWll_mnVBVJNhn5CkobyRVX8EkUqoBWc9jwFUrYlZ6IdSu-ICzeZCBCXkERGNJUE3tER7YzAJIeYTRNUmS_QHUnYL-Y5236G3biSLRj4_A_CS-A6Jv4P0BsPBfpDHMqX2Z5ue0qeuQO2-Gd2dbOZjIx-gU6jI-TnuiUrgPkVg1RDzKTb30FiuDZDsTQQwpwad0oq1YFH04g53sExTTOZvXkxXk6hpCTovN8Yygo2T4VxVuSqmmlJVKxBwwTh9v6MKwldBuH026b-stGkzFnilzPVdyQGtD5X1u2A59uSe6meL8MM5A1iYJteHv6idHaNgghrWwdbNPNpwehidGQHWl7cCkvTvrmWGIkT_Ae6fhp04D_KBdpTaq1CpntfF9TolM5KpdVgRKhP9BDwtqd_b3MJLTI_RcANxGNwanZijB9w7s2Ja2xJHWZP0NhQLtIqTEDwLOhGZEOt4NcXy4BOZImxwCEwXU2Vy3HP465bYgVQIZUPWbw6dA1tvf4BmosJG2kC04hJW-S7CkjLHK_sXV5i3wF-g0mCCl__HIA7PW-t837_C4F42rhgzo6JycA2iQWCWg9D7kIBnUoLFJkp2zV8T-0M4rMXhlltmFGHzFONjWhIPwMK6l0X_qTs_2dEirkmS6n0yPVTpgKKxasevZ9gAp9k2NhTlZayKsCtzLQaNlBfZ_xMefObxIrqQQvJCXhrrEwVoWhu_tMKzRSDy9fDDjtbMh4K4r_IBZ_xa-ujxxDGIJ9iK__pqI21nH7ljG1L7bkbKnL-58ug-TdaKzrSxRcMmqd48th3ad5_cqeQrJiChPnq0rK3Vyk-RnC68PBBKlsvYw3yoUVf_zrUZTwaqMwpPMmx24sJ89Fj1BhvqyY9pCiVykn4gnYgzGWchO2DIg9PeM5lKCUILECycSNwVwTIPZXvXlyVFr5UgSeE96fLEW-_6Dgp1TOuGcGp8h2b1SjrVLOQbqwDECGYcz8w8dYH-RL9TYBcmUxv0m1JE9UID7KoTYaZrbZ1sxvaeGXtdboJsnO1o49mRrD7Nlh1nah1OrIsYy8obegePwzX4iiDiqX38uQ_2LyBGL_YM1ZInBTd8Zuyeem3ynWtjSTX6CcdoLLvA7S5xt_n49bvaDf_9UXB-jecryDbXOiafvuXo894F1gVfy8EfqV_8_Htd5NFa-nBPWwyEEA_kR_DdTbn0sykA0Tm0Qc8iLbQGqssoSkM1yrO6vvGiQUM2LI1cnVfW164GJBUNK1s1ZrezB1OL-npzBbtYZmV6Ne7SHvoPNZo10hc0Dgs_Hm6nJhANy1mC2jS3IUSzvQcueSjz78pAh10CsEcrxVvhxC1H8nOqMTmvXXxyzIP5tyDiVZN96r-4X2cEj297GpvUqQHAcEQ1_AgRQqR-5TrmbuRUJfHj8TUOnt8yLzunlwM2UPazvMiAV-V5VPgwh2EF1tIL_wkgmjqKkUvebbWtxQ834sQTnuWsIlCHOt5YSWNGCbMnB8Y3o04ajlT2ZFak0EgeooQXFJlg9MoMWDalj3QE6ECSzCKT5aE9fpb4wjwp4UED2UAG3YUcI2k6C7diSq68oJZtDPw2R6FZZ6JNGPIqIFTNgs2XjuNu3iCRRmU1UYltG_l1PwaYSy6sqlgHjBXsy_f0SjBYuBbCHHDSk2tETRKmoA86NKJ4cul9aM_FTRJLSsR-awSp2Usg2Do1BkoSn9chSeDve_Lql1nTEnN_kR_Yg9pRAzmvJIMinJYu4WcoDvdu_r5yFd0vgNeRdfePW6dDhygmSHlSsdflO8lnZsFH6LmZGeG71ZnkQwzjA_W-FG4PaCItLnofI8FggWRNfdEDvegkUqpxgdQDwEXJ_Vsvkzx0BM-2Vc-Ridcql4U9zk3xhQ4UbtJjKQILEAzWecfgJv-z8ALNYmGgv5DdwnvJgjbAgAIeoHAXwLIq3Sdb7d4JRZiskfcyoQTQyUIlKGMaWNZa-WfjwWcgKxGeWlJzsz5UaLq2L_kCoMtic9sHC3-xjFqyvA_lxtJPMfEwGvReTPNLzbHC04gBWkAXoJWcfS6wlktQQEetuBeboMmOevizt-bDOtrXvYQfJvJ30Ve7LxaaH117dmQNsubnT8fq3Nv-uGOYLt_O2TqSLHEiWAuqiLmNFv0rcxWQ6-dSq3BB98ReC8eTDPHo-FrBuLIxP5uYZQ5AAmyzNYlxKY-c8IF3memuvKn4MH4h6xUTBslAFIhqil6Crv3rPCugogkqPa4g6dpkF4GbVMDKsAC7drzyvB5oAuiVCugKoqWqPyT2P02CapXX7NkIh0MdgTwWtUSusf2MP5V2uvGBqTNj0MTLgMItyiOGZGpNqgDVxC_trXRVb2we6-ruC9XrEsBVk-tV6q9O9126QQGTI_A99Vqbal_8RntaPnds7zlgoinFdz_4SO7IuKMbOvjjejAXX6s5HGhsQS6KpZCgAIF1n00xmlxFNhQHUeS5y5ADNU4IcVMxa5osHEFgSJxBZ_A_vIdM2paG382WAm1VV267oIwqdP-fypBLWvglhfULLSEiJ_tqJTT1_jbwY7Z-cneG3p-jb2PgdSFG4SqOavl5MHc0B_qEVqjoH93k1xhUCYSFoY5EZyqggbuqF2ZvtfCKw31oZjWjGcnxEWpXzzBmN9d9JdzhI8V8WCv-0oujw80WGfUuMsudQnIgtvyYSIJ4Dfso_YdfhacXhJ5JMf9U9X6T2BhWLJs901T0d4W-l37NOEQvegZWcsuStXijiMjYeDbEImCOmV-6ywVWDQLb7ONYnbmTtuk5_3TAESVd0-HlDGjRDPXY5a_hrxmJup3IPbkura9ayDZg, timeoutSeconds=120.0, rpId="google.com", allowList=[PublicKeyCredentialDescriptor[W-DEYiPMMcqip9pm5ToRee3jCaOCZcc8qrIPUTuPGbOntMZx7ovaJBDKIXhZMhV60-_Y_7PIkwKSzZMu47sVhA, type=public-key, transports=[]], PublicKeyCredentialDescriptor[sWETwJbeOiv7aAIRqNdclyUXdM7A8Xe0kEN1Mz-dJHCRMXT3TTylpSWyYpGpYj11JuolVvuoK7qYFmLH_fT_nw, type=public-key, transports=[]]], authenticationExtensions=AuthenticationExtensions[fidoAppIdExtension="https://www.gstatic.com/securitykey/origins.json"]], origin=https://accounts.google.com]
10-05 22:04:00.538  7274  7274 D FidoUi  : Finish with error: FIDO AppId must be same TLD+1 (NOT_ALLOWED_ERR)
10-05 22:04:00.564  6140  6140 I WebAuthnFeature: Received activity result with code: 11 and original request code: 11
10-05 22:04:00.577  6140  6140 E WebAuthnTokenManager: errorCode.name: NOT_ALLOWED_ERR
10-05 22:04:00.577  6140  6140 E WebAuthnTokenManager: errorMessage: FIDO AppId must be same TLD+1
10-05 22:04:00.590   572   572 I android.hardware.power-service-qti: Power setMode: 5 to: 0
10-05 22:04:00.658  6140  6390 I places::storage::history: breadcrumb: apply_observation: begin_transaction
10-05 22:04:00.672  3205  3236 I ndroid.systemu: NativeAlloc concurrent copying GC freed 3957(283KB) AllocSpace objects, 0(0B) LOS objects, 49% free, 10MB/20MB, paused 593us total 120.928ms
10-05 22:04:00.735  6140  6390 I places::storage::history: breadcrumb: apply_observation: commit
10-05 22:04:02.493  3205  3205 V ShadeControllerImpl: NotificationShadeWindow: com.android.systemui.statusbar.phone.NotificationShadeWindowView{2f20a7c I.E...... ......ID 0,0-1080,1920} canPanelBeCollapsed(): false
10-05 22:04:02.495  2730 11408 I ActivityTaskManager: START u0 {act=android.intent.action.MAIN cat=[android.intent.category.HOME] flg=0x10000000 pkg=com.android.launcher3 cmp=com.android.launcher3/.uioverrides.QuickstepLauncher (has extras)} from uid 10149
10-05 22:04:02.496   572   572 I android.hardware.power-service-qti: Power setMode: 5 to: 1
10-05 22:04:02.530  2730  3647 W ActivityManager: Unable to start service Intent { act=com.android.launcher3.WINDOW_OVERLAY dat=app://com.android.launcher3:10149?v=9&cv=14 pkg=com.google.android.googlequicksearchbox } U=0: not found
10-05 22:04:02.532  3434  3434 D RecentsOrientedState: current RecentsOrientedState: [this=RecentsOrientedState@c2f9bc4 mOrientationHandler=PortraitPagedViewHandler@f533aad mDisplayRotation=0 mTouchRotation=0 mRecentsActivityRotation=0 isRecentsActivityRotationAllowed=false mSystemRotation=false mFlags=291]
10-05 22:04:02.536  2730 11408 W ActivityManager: Unable to start service Intent { act=com.android.launcher3.WINDOW_OVERLAY dat=app://com.android.launcher3:10149?v=9&cv=14 pkg=com.google.android.googlequicksearchbox } U=0: not found
10-05 22:04:02.532  3434  3434 D RecentsOrientedState: current RecentsOrientedState: [this=RecentsOrientedState@c2f9bc4 mOrientationHandler=PortraitPagedViewHandler@f533aad mDisplayRotation=0 mTouchRotation=0 mRecentsActivityRotation=0 isRecentsActivityRotationAllowed=false mSystemRotation=false mFlags=291]
10-05 22:04:02.578  3434  3434 D RecentsOrientedState: current RecentsOrientedState: [this=RecentsOrientedState@4c45838 mOrientationHandler=PortraitPagedViewHandler@f533aad mDisplayRotation=0 mTouchRotation=0 mRecentsActivityRotation=0 isRecentsActivityRotationAllowed=false mSystemRotation=false mFlags=35]
10-05 22:04:02.578  3434  3434 I chatty  : uid=10149(com.android.launcher3) identical 2 lines
10-05 22:04:02.578  3434  3434 D RecentsOrientedState: current RecentsOrientedState: [this=RecentsOrientedState@4c45838 mOrientationHandler=PortraitPagedViewHandler@f533aad mDisplayRotation=0 mTouchRotation=0 mRecentsActivityRotation=0 isRecentsActivityRotationAllowed=false mSystemRotation=false mFlags=35]
10-05 22:04:02.581   572   572 I android.hardware.power-service-qti: Power setMode: 5 to: 0
10-05 22:04:02.694  3205  3236 I ndroid.systemu: NativeAlloc concurrent copying GC freed 1741(175KB) AllocSpace objects, 0(0B) LOS objects, 49% free, 10MB/20MB, paused 82us total 104.298ms
10-05 22:04:02.894   619   619 E Layer   : [Surface(name=Task=1)/@0x6d6133a - animation-leash#0] No local sync point found
10-05 22:04:02.895   619   619 E Layer   : [Surface(name=Task=144)/@0xe9d808d - animation-leash#0] No local sync point found
10-05 22:04:02.900  6140  6140 I MemoryController: onTrimMemory(20)
10-05 22:04:02.900  6140  6140 I FenixApplication: onTrimMemory(), level=20, main=true
10-05 22:04:03.230  6140  6140 I SessionStorage/AutoSave: Save: Background
10-05 22:04:03.242  6140  6172 I libglean_ffi: glean_core::metrics::ping: Glean disabled: not submitting any pings.
10-05 22:04:03.242  6140  6172 I libglean_ffi: glean_core::core: baseline ping not submitted on inactive
10-05 22:04:03.242  6140  6172 I libglean_ffi: glean_core::metrics::ping: Glean disabled: not submitting any pings.
10-05 22:04:03.242  6140  6172 I libglean_ffi: glean_core::core: events ping not submitted on inactive
10-05 22:04:03.329  2730 11113 D ConnectivityService: requestNetwork for uid/pid:10167/6140 NetworkRequest [ TRACK_DEFAULT id=2664, [ Capabilities: INTERNET&NOT_RESTRICTED&TRUSTED Uid: 10167 AdministratorUids: [] RequestorUid: 10167 RequestorPackageName: org.mozilla.firefox] ]
10-05 22:04:03.329  2730  3161 D ConnectivityService: NetReassign [2664 : null → 129]
10-05 22:04:03.331  2730  3157 D UntrustedWifiNetworkFactory: got request NetworkRequest [ TRACK_DEFAULT id=2664, [ Capabilities: INTERNET&NOT_RESTRICTED&TRUSTED Uid: 10167 AdministratorUids: [] RequestorUid: 10167 RequestorPackageName: org.mozilla.firefox] ] with score 60 and providerId 5
10-05 22:04:03.333  2730  3193 D Ethernet: got request NetworkRequest [ TRACK_DEFAULT id=2664, [ Capabilities: INTERNET&NOT_RESTRICTED&TRUSTED Uid: 10167 AdministratorUids: [] RequestorUid: 10167 RequestorPackageName: org.mozilla.firefox] ] with score 60 and providerId 5
10-05 22:04:03.334  3614  3614 D PhoneSwitcherNetworkRequstListener: got request NetworkRequest [ TRACK_DEFAULT id=2664, [ Capabilities: INTERNET&NOT_RESTRICTED&TRUSTED Uid: 10167 AdministratorUids: [] RequestorUid: 10167 RequestorPackageName: org.mozilla.firefox] ] with score 60 and providerId 5
10-05 22:04:03.334  2730  3157 D WifiNetworkFactory: got request NetworkRequest [ TRACK_DEFAULT id=2664, [ Capabilities: INTERNET&NOT_RESTRICTED&TRUSTED Uid: 10167 AdministratorUids: [] RequestorUid: 10167 RequestorPackageName: org.mozilla.firefox] ] with score 60 and providerId 5
[ telephony & keyguard entries removed ]
10-05 22:04:03.359  3614  3614 D Telephony: isEmergencyPreferredAccount: subId=1, activeData=1
10-05 22:04:03.359  3614  3614 D Telephony: isEmergencyPreferredAccount: Device does not require preference.
10-05 22:04:03.359  3614  3614 D Telephony: isEmergencyPreferredAccount: subId=2, activeData=1
10-05 22:04:03.359  3614  3614 D Telephony: isEmergencyPreferredAccount: Device does not require preference.
10-05 22:04:03.372  6140  6260 I libglean_ffi: glean_core::upload: New upload task with id db44e1bc-24bd-4ac7-8846-183163def2f8 (path: /submit/org-mozilla-firefox/deletion-request/1/db44e1bc-24bd-4ac7-8846-183163def2f8)
10-05 22:04:03.431  6140  6260 W glean/ConceptFetchHttpUploader: IOException while uploading ping
10-05 22:04:03.431  6140  6260 W glean/ConceptFetchHttpUploader: java.io.IOException: org.mozilla.geckoview.WebRequestError: Request failed, error=0x43, category=0x3
10-05 22:04:03.431  6140  6260 W glean/ConceptFetchHttpUploader: 	at mozilla.components.browser.engine.gecko.fetch.GeckoViewFetchClient.fetch(GeckoViewFetchClient.kt:63)
10-05 22:04:03.431  6140  6260 W glean/ConceptFetchHttpUploader: 	at mozilla.components.service.glean.net.ConceptFetchHttpUploader.performUpload$service_glean_release(ConceptFetchHttpUploader.kt:5)
10-05 22:04:03.431  6140  6260 W glean/ConceptFetchHttpUploader: 	at mozilla.components.service.glean.net.ConceptFetchHttpUploader.upload(ConceptFetchHttpUploader.kt:14)
10-05 22:04:03.431  6140  6260 W glean/ConceptFetchHttpUploader: 	at mozilla.telemetry.glean.net.BaseUploader.upload(Unknown Source:17)
10-05 22:04:03.431  6140  6260 W glean/ConceptFetchHttpUploader: 	at mozilla.telemetry.glean.net.BaseUploader.doUpload$glean_release(BaseUploader.kt:2)
10-05 22:04:03.431  6140  6260 W glean/ConceptFetchHttpUploader: 	at mozilla.telemetry.glean.scheduler.PingUploadWorker.doWork(PingUploadWorker.kt:16)
10-05 22:04:03.431  6140  6260 W glean/ConceptFetchHttpUploader: 	at androidx.work.Worker$1.run(Worker.java:1)
10-05 22:04:03.431  6140  6260 W glean/ConceptFetchHttpUploader: 	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1167)
10-05 22:04:03.431  6140  6260 W glean/ConceptFetchHttpUploader: 	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641)
10-05 22:04:03.431  6140  6260 W glean/ConceptFetchHttpUploader: 	at java.lang.Thread.run(Thread.java:923)
10-05 22:04:03.431  6140  6260 W glean/ConceptFetchHttpUploader: Caused by: org.mozilla.geckoview.WebRequestError: Request failed, error=0x43, category=0x3
10-05 22:04:03.431  6140  6260 W glean/ConceptFetchHttpUploader: 	at org.mozilla.gecko.mozglue.GeckoLoader.nativeRun(Native Method)
10-05 22:04:03.431  6140  6260 W glean/ConceptFetchHttpUploader: 	at org.mozilla.gecko.GeckoThread.run(GeckoThread.java:151)
10-05 22:04:03.433  6140  6260 W libglean_ffi: glean_core::upload: Recoverable upload failure while attempting to send ping db44e1bc-24bd-4ac7-8846-183163def2f8, will retry. Error was RecoverableFailure { unused: 0 }
10-05 22:04:03.433  6140  6260 I libglean_ffi: glean_core::upload::directory: Processing ping at: /data/user/0/org.mozilla.firefox/glean_data/deletion_request/db44e1bc-24bd-4ac7-8846-183163def2f8
10-05 22:04:03.435  6140  6260 I libglean_ffi: glean_core::upload: New upload task with id db44e1bc-24bd-4ac7-8846-183163def2f8 (path: /submit/org-mozilla-firefox/deletion-request/1/db44e1bc-24bd-4ac7-8846-183163def2f8)
10-05 22:04:03.471  6140  6260 W glean/ConceptFetchHttpUploader: IOException while uploading ping
10-05 22:04:03.471  6140  6260 W glean/ConceptFetchHttpUploader: java.io.IOException: org.mozilla.geckoview.WebRequestError: Request failed, error=0x43, category=0x3
10-05 22:04:03.471  6140  6260 W glean/ConceptFetchHttpUploader: 	at mozilla.components.browser.engine.gecko.fetch.GeckoViewFetchClient.fetch(GeckoViewFetchClient.kt:63)
10-05 22:04:03.471  6140  6260 W glean/ConceptFetchHttpUploader: 	at mozilla.components.service.glean.net.ConceptFetchHttpUploader.performUpload$service_glean_release(ConceptFetchHttpUploader.kt:5)
10-05 22:04:03.471  6140  6260 W glean/ConceptFetchHttpUploader: 	at mozilla.components.service.glean.net.ConceptFetchHttpUploader.upload(ConceptFetchHttpUploader.kt:14)
10-05 22:04:03.471  6140  6260 W glean/ConceptFetchHttpUploader: 	at mozilla.telemetry.glean.net.BaseUploader.upload(Unknown Source:17)
10-05 22:04:03.471  6140  6260 W glean/ConceptFetchHttpUploader: 	at mozilla.telemetry.glean.net.BaseUploader.doUpload$glean_release(BaseUploader.kt:2)
10-05 22:04:03.471  6140  6260 W glean/ConceptFetchHttpUploader: 	at mozilla.telemetry.glean.scheduler.PingUploadWorker.doWork(PingUploadWorker.kt:16)
10-05 22:04:03.471  6140  6260 W glean/ConceptFetchHttpUploader: 	at androidx.work.Worker$1.run(Worker.java:1)
10-05 22:04:03.471  6140  6260 W glean/ConceptFetchHttpUploader: 	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1167)
10-05 22:04:03.471  6140  6260 W glean/ConceptFetchHttpUploader: 	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641)
10-05 22:04:03.471  6140  6260 W glean/ConceptFetchHttpUploader: 	at java.lang.Thread.run(Thread.java:923)
10-05 22:04:03.471  6140  6260 W glean/ConceptFetchHttpUploader: Caused by: org.mozilla.geckoview.WebRequestError: Request failed, error=0x43, category=0x3
10-05 22:04:03.471  6140  6260 W glean/ConceptFetchHttpUploader: 	at org.mozilla.gecko.mozglue.GeckoLoader.nativeRun(Native Method)
10-05 22:04:03.471  6140  6260 W glean/ConceptFetchHttpUploader: 	at org.mozilla.gecko.GeckoThread.run(GeckoThread.java:151)
10-05 22:04:03.472  6140  6260 W libglean_ffi: glean_core::upload: Recoverable upload failure while attempting to send ping db44e1bc-24bd-4ac7-8846-183163def2f8, will retry. Error was RecoverableFailure { unused: 0 }
10-05 22:04:03.473  6140  6260 I libglean_ffi: glean_core::upload::directory: Processing ping at: /data/user/0/org.mozilla.firefox/glean_data/deletion_request/db44e1bc-24bd-4ac7-8846-183163def2f8
10-05 22:04:03.474  6140  6260 I libglean_ffi: glean_core::upload: New upload task with id db44e1bc-24bd-4ac7-8846-183163def2f8 (path: /submit/org-mozilla-firefox/deletion-request/1/db44e1bc-24bd-4ac7-8846-183163def2f8)
10-05 22:04:03.491  6140  6260 W glean/ConceptFetchHttpUploader: IOException while uploading ping
10-05 22:04:03.491  6140  6260 W glean/ConceptFetchHttpUploader: java.io.IOException: org.mozilla.geckoview.WebRequestError: Request failed, error=0x43, category=0x3
10-05 22:04:03.491  6140  6260 W glean/ConceptFetchHttpUploader: 	at mozilla.components.browser.engine.gecko.fetch.GeckoViewFetchClient.fetch(GeckoViewFetchClient.kt:63)
10-05 22:04:03.491  6140  6260 W glean/ConceptFetchHttpUploader: 	at mozilla.components.service.glean.net.ConceptFetchHttpUploader.performUpload$service_glean_release(ConceptFetchHttpUploader.kt:5)
10-05 22:04:03.491  6140  6260 W glean/ConceptFetchHttpUploader: 	at mozilla.components.service.glean.net.ConceptFetchHttpUploader.upload(ConceptFetchHttpUploader.kt:14)
10-05 22:04:03.491  6140  6260 W glean/ConceptFetchHttpUploader: 	at mozilla.telemetry.glean.net.BaseUploader.upload(Unknown Source:17)
10-05 22:04:03.491  6140  6260 W glean/ConceptFetchHttpUploader: 	at mozilla.telemetry.glean.net.BaseUploader.doUpload$glean_release(BaseUploader.kt:2)
10-05 22:04:03.491  6140  6260 W glean/ConceptFetchHttpUploader: 	at mozilla.telemetry.glean.scheduler.PingUploadWorker.doWork(PingUploadWorker.kt:16)
10-05 22:04:03.491  6140  6260 W glean/ConceptFetchHttpUploader: 	at androidx.work.Worker$1.run(Worker.java:1)
10-05 22:04:03.491  6140  6260 W glean/ConceptFetchHttpUploader: 	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1167)
10-05 22:04:03.491  6140  6260 W glean/ConceptFetchHttpUploader: 	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641)
10-05 22:04:03.491  6140  6260 W glean/ConceptFetchHttpUploader: 	at java.lang.Thread.run(Thread.java:923)
10-05 22:04:03.491  6140  6260 W glean/ConceptFetchHttpUploader: Caused by: org.mozilla.geckoview.WebRequestError: Request failed, error=0x43, category=0x3
10-05 22:04:03.491  6140  6260 W glean/ConceptFetchHttpUploader: 	at org.mozilla.gecko.mozglue.GeckoLoader.nativeRun(Native Method)
10-05 22:04:03.491  6140  6260 W glean/ConceptFetchHttpUploader: 	at org.mozilla.gecko.GeckoThread.run(GeckoThread.java:151)
10-05 22:04:03.493  6140  6260 W libglean_ffi: glean_core::upload: Recoverable upload failure while attempting to send ping db44e1bc-24bd-4ac7-8846-183163def2f8, will retry. Error was RecoverableFailure { unused: 0 }
10-05 22:04:03.493  6140  6260 I libglean_ffi: glean_core::upload::directory: Processing ping at: /data/user/0/org.mozilla.firefox/glean_data/deletion_request/db44e1bc-24bd-4ac7-8846-183163def2f8
10-05 22:04:03.494  6140  6260 W libglean_ffi: glean_core::upload: Reached maximum recoverable failures for the current uploading window. You are done.
10-05 22:04:03.497  6140  6210 I WM-WorkerWrapper: Worker result SUCCESS for Work [ id=62e5166c-ddc5-4ebe-a445-2e510b1f8862, tags={ mozilla.telemetry.glean.scheduler.PingUploadWorker, mozac_service_glean_ping_upload_worker } ]
10-05 22:04:03.502  2730  3161 D ConnectivityService: releasing NetworkRequest [ TRACK_DEFAULT id=2664, [ Capabilities: INTERNET&NOT_RESTRICTED&TRUSTED Uid: 10167 AdministratorUids: [] RequestorUid: 10167 RequestorPackageName: org.mozilla.firefox] ] (release request)

[restena-sw]

Maybe I'm again living in the past with my Fairphone 3 /e/OS 1.4 build, apologies. In case not:

I tried to register the Fairphone against a server that required Passwordless compatibility (userVerification required, residentKey required, keyProps report requested, credProtect = 2 required). Basically the client-side JS you can find here: https://github.com/simplesamlphp/simplesamlphp-module-webauthn/blob/release-2.0/www/assets/js/webauthn.js#L116

To my surprise, the microG "token" went through a successful registration but did not report about a resident key being created (it did execute and report about userVerification being done).

This is not a conformant implementation: if residentKey is set to required, it needs to fail the registration process if it cannot assert resident keys. And if it does support resident keys with the credProps client extension, it needs to respond with credProps or fail the request if it doesn't understand the extension.

Of course, once it properly creates and stores and reports about resident keys, a natural question would be how the security of the stored credentials is ascertained. Like, does microG use TEE storage if available on the phone, etc.

[mar-v-in]

Hi @restena-sw

First of all, thanks for looking into these things, it's very much appreciated.

The WebAuthn implementation on Android is a little bit more complex than on desktops. This is because parts of what the client / user agent is supposed to do according to the WebAuthn specification are done in the browser app, while other parts are done in Play Services / microG.

Browsers do not forward the credProps extension from the webauthn registration operation to microG. Either it is meant to be handled entirely in the browser, or not supported at all. credProps was also not part of WebAuthn L1, so maybe support for L2 is just not available to Android yet (enterprise attestation also is not supported).

microG does store the keys in the Android key store, which will use TEE or SE on supported devices. Since 304c352 we also have support for the android-key attestation statement on supported devices (and android-safetynet attestation statement for unsupported devices).

[strugee]

I believe https://github.com/microg/GmsCore/wiki/Implementation-Status needs updating to indicate partial support?

[luken-dev]

Hi,
Tried installing latest nightly on a fresh LineageOS install, and it works exactly the same. Keys work, with the exception of logging into a Google account, which fails to bring up a security key prompt.

[restena-sw]

Re the firefox tests on e/OS/: my bad... yes, I tried Firefox which means there is no Level 2 support - Firefox has open bugs and lots of votes on passwordless FIDO. Also on a desktop, Firefox doesn't know how to handle passwordless. I should really have run those tests with a Chromium-based browser, where Level 2 is available.

So I used the e/OS/ built-in fork of Bromite, but that doesn't have any FIDO capabilities at all :-( So, for the moment, there is no way for me to test UV, resident keys or credProtect on this device. IOW: forgot what I said.

FWIW, credProps is indeed part of WebAuthN Level 2, see chapter 10.4 (https://www.w3.org/TR/webauthn/#sctn-authenticator-credential-properties-extension)

[mar-v-in]

@restena-sw According to https://chromestatus.com/feature/5701094648840192 credProps extension support is only available on Chrome/Chromium Desktop since version 89. Mobile Chrome (and forks) are still at L1. The latest (beta) version of the official fido library for Android (available here) is dated January 2021 and does not support L2, the PR for WebAuthn L2 is dated February 2021 and Chrome 89 was released March 2021. So for now, no support for WebAuthn L2 on Android (when using the official fido library, other implementations like the Hardware Security SDK might be able to support it in case you need it).

[Yannik]

Hi, Tried installing latest nightly on a fresh LineageOS install, and it works exactly the same. Keys work, with the exception of logging into a Google account, which fails to bring up a security key prompt.

@luken-dev
A logcat would surely help in debugging this issue.

[ale5000-git]

@mar-v-in
Soon I will be able to test it with a Fido2 key that support USB/NFC/Bluetooth.
How is the current bluetooth support?

[mar-v-in]

I don't have a key with Bluetooth yet, so I couldn't test and thus didn't start development

[ale5000-git]

Meanwhile I will report whether it works or not with USB once it is arrived.
I have ordered this: https://shop.ftsafe.us/collections/multipass-fido-series/products/k25

[luken-dev]

@Yannik see here: #849 (comment)

[ale5000-git]

@mar-v-in
I have seen a report on a forum that say that adding a Google account with SafetyNet disabled make microG 0.2.25.223616 crash.
It may be related to the new FIDO code.

[mar-v-in]

@ale5000-git It's not directly related to FIDO code but was introduced with adding support for DroidGuard attestation for MinuteMaid account sign-up flow (which indeed is new in 0.2.25).

[restena-sw]

Just confirmed that a Fairphone 3 with e/OS/ 1.5 Android 12 (microG 0.2.24.223616-101) can both register and authenticate WebAuthN with the fingerprint sensor of the device. Hooray!
Given the absence of a browser app that could possibly support Passwordless auth, I guess this is as far as we can go right now.
Thanks VERY much @mar-v-in !

[ale5000-git]

@restena-sw
Fennec F-Droid (a fork of Firefox) will likely include microG FIDO libraries soon so it will likely work although it isn't ready yet.
relan is working on it.

[ale5000-git]

@mar-v-in
Is it possible to have another nightly build with the latest fixes please?

[mar-v-in]

Nightly is updated.

I'm closing this issue now, as I feel that Bluetooth support, caBLE support and the non-browser Fido API are minor functionality (which I also probably won't tackle in near future).

[Nuc1eoN]

Hi, sorry for bringing this issue up again.

I waited a long time for this feature to be implemented and I just tested v0.2.25.x and cannot get FIDO2 to work 🤔

This is me trying to log into github:

It immediatly fails without a prompt.

So therefore I have tried webauthn.io:

Now here at least I did get a prompt if I want to use my securty key and it vibrates after holding it against my phone. However as you see the process still fails.

Any idea what is happening? Or did I misunderstand the implemented feature?

My security key is a Solokey 1 NFC.

[mar-v-in]

webauthn.io: If you are using a SoloKey via NFC or USB: microG only supports user verification performed on the authenticator itself, which typically means they need a fingerprint scanner. If you're using the option of using the devices screen lock, that should provide user verification. On webauthn.io you can also disable "require user verification" under advanced settings.

GitHub does work for me and if it fails without a prompt, the key itself can't be the issue. Can you please provide a logcat (feel free to do a new issue for this)?

[ale5000-git]

@Nuc1eoN: I suggest also to try with the latest nightly build since some bugs were fixed after the release, the NFC timeout was also increased.

[Nuc1eoN]

webauthn.io: If you are using a SoloKey via NFC or USB: microG only supports user verification performed on the authenticator itself, which typically means they need a fingerprint scanner.

Oh I did not know that! Yes you are right after unticking user verification it works ;)
Will user verification with security key and PIN be supported in the future?

GitHub does work for me and if it fails without a prompt, the key itself can't be the issue. Can you please provide a logcat (feel free to do a new issue for this)?

Thank you I followed your suggestion and opened a new issue: #1817

[Yannik]

webauthn.io: If you are using a SoloKey via NFC or USB: microG only supports user verification performed on the authenticator itself, which typically means they need a fingerprint scanner.

@mar-v-in Could you clarify please: Is using a FIDO2-Token with a PIN (e.g., a yubikey) not supported at all? Or is this just something with the SoloKey?

[mar-v-in]

microG currently does not support FIDO2 authentication methods that require a PIN to be entered on the client (if PIN is entered on the authenticator, there is no issue, but only few authenticators support that). PIN is required for most popular security keys (incl. Yubikey and Solokey) when user verification is required, but often is optional if user verification is not required. Rule of thumb: If you need to enter your PIN when using your Yubikey for sign-in on your desktop (which typically means your browser asks for your PIN) it won't work with microG. This is the same restriction as is currently present in Play Services, as is reported in this issue in Chromium bug tracker.

I'm not saying that we can't go beyond the feature set of Play Services, but it is not a primary objection of microG. If someone wants to implement this (shouldn't be too hard) I'd be happy to accept a PR.

[Yannik]

@mar-v-in Oh, that's too bad. Thank you for the explanation.

[Chinchzilla]

Hi there, I'm on 0.2.26.223616-37 and U2F works both via NFC and USB. WebAuthn works on registration via USB but not authentication. NFC for WebAuthn doesn't work at all. Device Pixel 4a.

[ale5000-git]

@Chinchzilla
Please open a new ticket for the problem.

If you can. also update microG GmsCore to v0.2.27.223616 (or higher) please.