Physical token - how to make Firefox accept them as an alternative to a password login for specific websites

Firefox supports USB security keys through WebAuthn. On the website's login page, look for Use another method or Security key, then insert the key and touch its button when prompted. Make sure you registered the key with that account first. If the option never appears, the site may not support security keys for that login method, or the key may not be configured correctly.

You can try a "dry run" e.g. here https://www.passkeys.io/ and for platform support check:

•  https://www.passkeys.io/compatible-devices
•  https://passkeys.dev/device-support/

if there's any limitation documented for your combination of OS version and credential store.

You can try a "dry run" e.g. here https://www.passkeys.io/ and for platform support check:

•  https://www.passkeys.io/compatible-devices
•  https://passkeys.dev/device-support/

if there's any limitation documented for your combination of OS version and credential store.

I'm talking about using a physical token, not a virtual passkey stored on my computer. Like this:

https://thetis.io/products/fido2-key-usb-a-c-nfc

And the above should give you an option to use USB FIDO2 token.

Also check https://whatarepasskeys.info/#faq where some of the Q+A in the beginning describe the relation of FIDO2 and Passkeys:

What is FIDO2, and how does it relate to passkeys? FIDO2 is the technical standard passkeys are built on. You don't need to know the details - just know that "passkey" is the friendly name for what FIDO2 makes possible, and it's why passkeys work the same way across operating systems, websites, apps, devices and credential managers from different companies. Is a passkey the same as a physical security key (like a YubiKey)? A physical security key can store a passkey, but you don’t need one to use passkeys. Most consumers store their passkeys in a credential manager on their phone, computer or other devices. Physical security keys are another option for storing your passkeys and can be useful for people who want an additional way to sign in.

The longer read: https://startwithidentity.com/standards/webauthn-fido2/

You don't seem to mention using the HW key just as an MFA protecting your existing credential — you seem to specifically mention replacing your flow with a passwordless one — which Passkey is, no matter if synced, device–bound, or cross–device. (Your link specifically mentions "Passkey" in the name of the FIDO2 product there FWIW.)

Depending on the services you plan to use this for, they most likely support WebAuthn/Passkey functionality, so you'd be storing your credential on the HW stick, and using WebAuthn login options to present the credential from the USB. (But you'd be creating keys per site, and storing them on the stick, IIUC?)

It turns out that I needed to disable Windows Hello, as Firefox was defaulting to that passkey instead of the physical token that I had inserted into my USB port.

After disabling Hello, Firefox stopped trying to use it as a default.

Is there any way to set the default 2FA method I want to use within Firefox itself? I shouldn't have to disable Windows Hello in order to use a physical token.

Also check https://whatarepasskeys.info/#faq where some of the Q+A in the beginning describe the relation of FIDO2 and Passkeys:

What is FIDO2, and how does it relate to passkeys? FIDO2 is the technical standard passkeys are built on. You don't need to know the details - just know that "passkey" is the friendly name for what FIDO2 makes possible, and it's why passkeys work the same way across operating systems, websites, apps, devices and credential managers from different companies. Is a passkey the same as a physical security key (like a YubiKey)? A physical security key can store a passkey, but you don’t need one to use passkeys. Most consumers store their passkeys in a credential manager on their phone, computer or other devices. Physical security keys are another option for storing your passkeys and can be useful for people who want an additional way to sign in.

The longer read: https://startwithidentity.com/standards/webauthn-fido2/

You don't seem to mention using the HW key just as an MFA protecting your existing credential — you seem to specifically mention replacing your flow with a passwordless one — which Passkey is, no matter if synced, device–bound, or cross–device. (Your link specifically mentions "Passkey" in the name of the FIDO2 product there FWIW.)

Depending on the services you plan to use this for, they most likely support WebAuthn/Passkey functionality, so you'd be storing your credential on the HW stick, and using WebAuthn login options to present the credential from the USB. (But you'd be creating keys per site, and storing them on the stick, IIUC?)

No, I do specifically mention using a HW key. Right here (in my OP), in fact:

However, whenever I try to use a physical token to access websites while in Firefox, there's no way I can find to do so.

IOW you don't want to replace passwords. You're looking to add only a 2FA to your passwords?

IOW you don't want to replace passwords. You're looking to add only a 2FA to your passwords?

Typically, websites will offer multiple avenues to login (passwords, passkeys, authenicators, or physical tokens). When you chose an option, that option is the way you login to the website. There will be backup methods, should your default choice fail. But the website will start with your primary method.

I had a problem accessing one site.

I had set up my login preference to that site, selecting the use of a physical token.

However, when I tried to do so today, a pop-up kept appearing asking me to login via a password or authenicator, instead. And there was no way to actually do that, as the pop-up only had a button to cancel the login attempt. (That pop-up looked as if it was coming from my Windows system itself, not Firefox. Except that the pop-up stated that it was Firefox that was source that was requesting the alternate login attempt.)

And when I went into the Firefox settings, I could see no way to get Firefox to even recognize a physical token (any physical token, for that matter) as the primary means of login to that website.

Now, due to the pop-up's information, it seems that I need to do something in order to have Firefox recognize my physical token as my means to login to that particular website. After all, that's what the whole pop-up was all about in the first place.

But I can't find anything in the settings menu of Firefox that would allow me to do that.

---

And I was only able to fix the problem by disabling Windows Hello in the settings menu of my desktop computer.

Which, to me, has absolutely nothing to do with Firefox or the pop-up at all.

The whole thing is extremely odd, and I never had this problem in the past.