Physical token - how to make Firefox accept them as an alternative to a password login for specific websites
With the push towards 2FA in many websites, I now need to use an authenicator, passkey, or physical token to access some websites.
I've chosen to use authenicators and physical tokens as my means of doing so.
However, whenever I try to use a physical token to access websites while in Firefox, there's no way I can find to do so. Firefox seems to default to passwords or authenicators... and there's never any way to actually select the physical token plugged into my USB socket.
So how do I get Firefox to recognize a physical token and to allow me to use it when accessing websites that I've already prepped to accept them?
پاسخها (8)
Firefox supports USB security keys through WebAuthn. On the website's login page, look for Use another method or Security key, then insert the key and touch its button when prompted. Make sure you registered the key with that account first. If the option never appears, the site may not support security keys for that login method, or the key may not be configured correctly.
You can try a "dry run" e.g. here https://www.passkeys.io/ and for platform support check:
if there's any limitation documented for your combination of OS version and credential store.
jbr said
You can try a "dry run" e.g. here https://www.passkeys.io/ and for platform support check: if there's any limitation documented for your combination of OS version and credential store.
I'm talking about using a physical token, not a virtual passkey stored on my computer. Like this:
And the above should give you an option to use USB FIDO2 token.
Also check https://whatarepasskeys.info/#faq where some of the Q+A in the beginning describe the relation of FIDO2 and Passkeys:
What is FIDO2, and how does it relate to passkeys? FIDO2 is the technical standard passkeys are built on. You don't need to know the details - just know that "passkey" is the friendly name for what FIDO2 makes possible, and it's why passkeys work the same way across operating systems, websites, apps, devices and credential managers from different companies. Is a passkey the same as a physical security key (like a YubiKey)? A physical security key can store a passkey, but you don’t need one to use passkeys. Most consumers store their passkeys in a credential manager on their phone, computer or other devices. Physical security keys are another option for storing your passkeys and can be useful for people who want an additional way to sign in.
The longer read: https://startwithidentity.com/standards/webauthn-fido2/
You don't seem to mention using the HW key just as an MFA protecting your existing credential — you seem to specifically mention replacing your flow with a passwordless one — which Passkey is, no matter if synced, device–bound, or cross–device. (Your link specifically mentions "Passkey" in the name of the FIDO2 product there FWIW.)
Depending on the services you plan to use this for, they most likely support WebAuthn/Passkey functionality, so you'd be storing your credential on the HW stick, and using WebAuthn login options to present the credential from the USB. (But you'd be creating keys per site, and storing them on the stick, IIUC?)
It turns out that I needed to disable Windows Hello, as Firefox was defaulting to that passkey instead of the physical token that I had inserted into my USB port.
After disabling Hello, Firefox stopped trying to use it as a default.
Is there any way to set the default 2FA method I want to use within Firefox itself? I shouldn't have to disable Windows Hello in order to use a physical token.
ویرایش شده توسط Gogogodzilla
jbr said
Also check https://whatarepasskeys.info/#faq where some of the Q+A in the beginning describe the relation of FIDO2 and Passkeys:What is FIDO2, and how does it relate to passkeys? FIDO2 is the technical standard passkeys are built on. You don't need to know the details - just know that "passkey" is the friendly name for what FIDO2 makes possible, and it's why passkeys work the same way across operating systems, websites, apps, devices and credential managers from different companies. Is a passkey the same as a physical security key (like a YubiKey)? A physical security key can store a passkey, but you don’t need one to use passkeys. Most consumers store their passkeys in a credential manager on their phone, computer or other devices. Physical security keys are another option for storing your passkeys and can be useful for people who want an additional way to sign in.The longer read: https://startwithidentity.com/standards/webauthn-fido2/
You don't seem to mention using the HW key just as an MFA protecting your existing credential — you seem to specifically mention replacing your flow with a passwordless one — which Passkey is, no matter if synced, device–bound, or cross–device. (Your link specifically mentions "Passkey" in the name of the FIDO2 product there FWIW.)
Depending on the services you plan to use this for, they most likely support WebAuthn/Passkey functionality, so you'd be storing your credential on the HW stick, and using WebAuthn login options to present the credential from the USB. (But you'd be creating keys per site, and storing them on the stick, IIUC?)
No, I do specifically mention using a HW key. Right here (in my OP), in fact:
However, whenever I try to use a physical token to access websites while in Firefox, there's no way I can find to do so.
IOW you don't want to replace passwords. You're looking to add only a 2FA to your passwords?
شما باید برای پاسخ به پستها وارد حسابتان شوید. اگر هنوز حسابی ندارید، لطفاًً یک سؤال جدید آغاز کنید.