google-chromefidopasskeyyubico

Can I use a yubikey 5 nano as a google passkey without a pin?


When I try to use my Yubikey 5 nano as a passkey for google, like the comment to this answer, I find that the FIDO2 PIN has to be set. When I remove the FIDO2 PIN, the passkey is also removed.

Can I use a yubikey 5 nano as a google passkey without a pin?

If not, are there any plans to allow it?


Solution

  • Creating resident keys, which the question you linked to requires a pin as per the CTAP 2.1 specification step 10 and step 11 in makeCredential.

    You also have that Chrome on assertion for example is implemented in such a way to block you from being able to use the device without some sort of user verification, which in the case of the Yubikey 5 is a pin and a user presence check. This isn't exactly required by the specifications, but given that using a resident key without any type of validation is a bit of a niche case it isn't unreasonable. There have been complaints Google does this though for example this bug

    So no, I don't think you can expect being able to use it without pin input.