Hi all,
My 2-step verification security key is a passkey that is stored in Bitwarden, and re-authentication keeps failing when I use Microsoft Edge on Windows 11. Using the dev console in Edge (F12) I've tracked it down to the transports that Box sends during the sign-in request, and I'm hoping that someone at Box can take a look at it.
This is what happens:
When Box asks for my security key, for example after I save a change in Enterprise Settings > Security, the WebAuthn request lists my credential with the transports "usb" and "nfc". Bitwarden, however, registers its passkeys with the transports "internal" and "hybrid". When Bitwarden sees the usb/nfc hint, it assumes that the credential lives on a physical hardware key, and it declines the request. Edge then hands the request over to Windows, and Windows asks me to insert a USB key that I don't have.
To confirm this, I wrote a small Tampermonkey user script that changes the transports in the request to "internal" and "hybrid" before Bitwarden sees it. With the script running, Bitwarden picks up the request and signs it, and Box accepts the result. That tells me that the credential itself is fine, and that the transport hint is the only thing that is wrong.
Question for Box Support/Staff:
Would Box consider storing the transports that the authenticator reports at registration (from getTransports()) and sending those back during sign-in?
Leaving the transports out entirely when they aren't known would also fix it.
Either change would allow passkeys from password managers like Bitwarden to work as 2-step security keys without needing a workaround.
In the meantime, I'm happy to share the user script with anyone else who runs into this.
Thanks,
Environment: Microsoft Edge on Windows 11, Bitwarden browser extension, Box enterprise instance