jola.dev jola.dev When entering a handle before passkey sign-in (eg prefilled by oauth flow), the backend uses start_securitykey_authentication(&credentials) which immediately presents "sign in with a security key" ui and unintentionally bypasses 1Password and other passkey implementations. This means that password manager users are required to delete their handle in order to sign in when authenticating through Oauth.
I'm willing to write and test a PR if that is desired.
Also affected by this! It's especially annoying because once you've chosen passkey as the auth method when creating an account, the browser session is "locked" into it. You have to clear local storage to be able to go back and pick password instead (the workaround for me since passkey doesn't work with 1P).
There is a workaround to make a passkey-only account with 1Password! During passkey creation the browser flow gives you a QR code to allow you to create a passkey on your phone, so you can scan that and create a passkey using the 1Password app on your phone. Then after account creation you just have to make sure the handle field is empty before clicking sign in with passkey and it should work as expected.
https://tangled.org/tranquil.farm/tranquil-pds/pulls/240/round/2?diff=unified#round-2 has been merged fixing this issue. I'm running this version and 1P works as expected!
I've now tried this on Bitwarden as well, works mostly fine, although I have to trigger it from Bitwarden rather than from the tranquil login button. I'm going to close this issue but if you're still having problems after upgrading feel free to re-open or create a new issue! Also consider donating to @oyster.cafe's yubikey fund so he can get a modern one
A similar issue appears when adding a passkey to an existing account from the Security page, but here there's no option to remove the handle, of course. Happening on Zen 1.21.4b and Firefox 152.0.3.