GNOME Bugzilla – Bug 791144
Google Online Account Two Factor with hardware key fails immediately
Last modified: 2020-05-27 09:04:13 UTC
The hardware key authentication two factor fails immediately with a web based retry dialogue when connecting a Google account to the online accounts in settings using a hardware key second factor. Steps to reproduce: 1. Set Google Account to default to a hardware security key like a Yubikey or other FIDO standard key after having two factor authentication enabled on your Google Account. 2. Open Online accounts 3. Add a Google Account 4. Enter google email address 5. Enter google password 6. (this is the login flow of two factor, if default is the hardware key the error should appear). Work around: Choose use another method to authenticate: enter the authentication code and you will proceed. Expectations were: The ability to use the hardware key to authenticate as the second factor. Initial reported to Ubuntu bugtracker against gnome-online-accounts version 3.26.1-1ubuntu1 on Ubuntu 17.10 on the date reported 2017-11-17: https://bugs.launchpad.net/ubuntu/+source/gnome-online-accounts/+bug/1733002
I recall discussing something similar with Nathaniel McCallum [1] at Flock some years ago. However, I don't recall the details clearly. Does the login flow with the hardware key involve the web browser? I am asking because one of the things Nathaniel pointed out was missing support in WebKit. [1] https://npmccallum.gitlab.io/about/
I found these: https://bugs.webkit.org/show_bug.cgi?id=143491 https://lists.webkit.org/pipermail/webkit-dev/2017-February/028755.html Assuming that I am not completely wrong, I am closing this as NOTGNOME because the necessary work needs to happen in WebKitGTK+ and that's hosted outside GNOME infrastructure.
I'm using gnome-online-accounts 3.36.0-1 and I also stumble in this limitation. The bug indicated in webkit is now fixed and in theory supports u2f (https://trac.webkit.org/changeset/243193/webkit), but unfortunately I still can't use u2f with my google account. Something must be missing in the gnome side to activate this feature.