Windows 10: FIDO2 BLE Bluetooth Communication problem with Android / iOS

Key_Soft · Jun 29, 2021

Hello.We are developing Android application for FIDO2 paswordless login. We have got problem with BLE connection on Windows side. When we pair our BLE Server with Windows, registration and login is working fine until disconnecting. After some time, or on application reload, the BLE server has new MAC address and Windows can't find the device while trying to register/login.It seems, like Windows Security API is not scanning known devices for FIDO access. The service will time out, until we run Third party SW for BLE scanning only scanning. We assume, that Windows should scan for FIDO service.

:)

FinnErikJ · Jun 29, 2021

Bluetooth Low Energy - BLE

Hi, I've seen a few questions around BLE. As I've been wanting to be able to use home-automation products with BLE, I recently contacted KEVO (Unikey) about their "interest" in developing an app for their smart lock, I got this reply back:

"With the introduction of the 8.1 OS, Windows phones have the ability to pair with most BLE devices. There are two forms of communication needed to pair. Central Communication (listener) and Peripheral Communication (talker).

Unfortunately the Windows phone only operated centrally, as do the Kevo, so pairing is not an option at this time.

We have had the same problem with Android, up until this month when the finally will be releasing Android L.

We are developeing the Android app now and we really hope that Windows will make the improvements to BLE capabilities as well."

Is above correct and if yes, should we expect WP8.1 to support this?

Regards, Finn

Brink · Jun 29, 2021

Passwordless FIDO2 verification on Android for Google Accounts

Passwords, combined with Google's automated protections, help secure billions of users around the world. But, new security technologies are surpassing passwords in terms of both strength and convenience. With this in mind, we are happy to announce that you can verify your identity by using your fingerprint or screen lock instead of a password when visiting certain Google services. The feature is available today on Pixel devices and coming to all Android 7+ devices over the next few days.

Simpler authentication experience when viewing your saved password for a website on passwords.google.com

These enhancements are built using the FIDO2 standards, W3C WebAuthn and FIDO CTAP, and are designed to provide simpler and more secure authentication experiences. They are a result of years of collaboration between Google and many other organizations in the FIDO Alliance and the W3C.

An important benefit of using FIDO2 versus interacting with the native fingerprint APIs on Android is that these biometric capabilities are now, for the first time, available on the web, allowing the same credentials be used by both native apps and web services. This means that a user only has to register their fingerprint with a service once and then the fingerprint will work for both the native application and the web service.

Note that your fingerprint is never sent to Google’s servers - it is securely stored on your device, and only a cryptographic proof that you’ve correctly scanned it is sent to Google’s servers. This is a fundamental part of the FIDO2 design.

Here is how it works

Google is using the FIDO2 capability on Android to register a platform-bound FIDO credential. We remember the credential for that specific Android device. Now, when the user visits a compatible service, such as passwords.google.com, we issue a WebAuthn “Get” call, passing in the credentialId that we got when creating the credential. The result is a valid FIDO2 signature.

High-level architecture of using fingerprint or screen lock on Android devices to verify a user’s identity without a password

Please follow the instructions below if you’d like to try it out.

Prerequisites

Phone is running Android 7.0 (Nougat) or later

Your personal Google Account is added to your Android device

Valid screen lock is set up on your Android device

To try it

Open the Chrome app on your Android device

Navigate to https://passwords.google.com

Choose a site to view or manage a saved password

Follow the instructions to confirm that it’s you trying signing in

You can find more detailed instructions here.

For additional security

Remember, Google's automated defenses securely block the overwhelming majority of sign-in attempts even if an attacker has your username or password. Further, you can protect your accounts with two-step verification (2SV), including Titan Security Keys and Android phone’s built-in security key.

Both security keys and local user verification based on biometrics use the FIDO2 standards. However, these two protections address different use cases. Security keys are used for bootstrapping a new device as a second factor as part of 2SV in order to make sure it’s the right owner of the account accessing it. Local user verification based on biometrics comes after bootstrapping a device and can be used for re-authentication during step-up flows to verify the identity of the already signed-in user.

What’s next

This new capability marks another step on our journey to making authentication safer and easier for everyone to use. As we continue to embrace the FIDO2 standard, you will start seeing more places where local alternatives to passwords are accepted as an authentication mechanism for Google and Google Cloud services. Check out to get an early glimpse of the use cases that we are working to enable next.

fsFxbC543n8
Click to expand...

Source: https://security.googleblog.com/2019...r-with_12.html

Brink · Jun 29, 2021

Passwordless FIDO2 verification on Android for Google Accounts

Passwords, combined with Google's automated protections, help secure billions of users around the world. But, new security technologies are surpassing passwords in terms of both strength and convenience. With this in mind, we are happy to announce that you can verify your identity by using your fingerprint or screen lock instead of a password when visiting certain Google services. The feature is available today on Pixel devices and coming to all Android 7+ devices over the next few days.

Simpler authentication experience when viewing your saved password for a website on passwords.google.com

These enhancements are built using the FIDO2 standards, W3C WebAuthn and FIDO CTAP, and are designed to provide simpler and more secure authentication experiences. They are a result of years of collaboration between Google and many other organizations in the FIDO Alliance and the W3C.

An important benefit of using FIDO2 versus interacting with the native fingerprint APIs on Android is that these biometric capabilities are now, for the first time, available on the web, allowing the same credentials be used by both native apps and web services. This means that a user only has to register their fingerprint with a service once and then the fingerprint will work for both the native application and the web service.

Note that your fingerprint is never sent to Google’s servers - it is securely stored on your device, and only a cryptographic proof that you’ve correctly scanned it is sent to Google’s servers. This is a fundamental part of the FIDO2 design.

Here is how it works

Google is using the FIDO2 capability on Android to register a platform-bound FIDO credential. We remember the credential for that specific Android device. Now, when the user visits a compatible service, such as passwords.google.com, we issue a WebAuthn “Get” call, passing in the credentialId that we got when creating the credential. The result is a valid FIDO2 signature.

High-level architecture of using fingerprint or screen lock on Android devices to verify a user’s identity without a password

Please follow the instructions below if you’d like to try it out.

Prerequisites

Phone is running Android 7.0 (Nougat) or later

Your personal Google Account is added to your Android device

Valid screen lock is set up on your Android device

To try it

Open the Chrome app on your Android device

Navigate to https://passwords.google.com

Choose a site to view or manage a saved password

Follow the instructions to confirm that it’s you trying signing in

You can find more detailed instructions here.

For additional security

Remember, Google's automated defenses securely block the overwhelming majority of sign-in attempts even if an attacker has your username or password. Further, you can protect your accounts with two-step verification (2SV), including Titan Security Keys and Android phone’s built-in security key.

Both security keys and local user verification based on biometrics use the FIDO2 standards. However, these two protections address different use cases. Security keys are used for bootstrapping a new device as a second factor as part of 2SV in order to make sure it’s the right owner of the account accessing it. Local user verification based on biometrics comes after bootstrapping a device and can be used for re-authentication during step-up flows to verify the identity of the already signed-in user.

What’s next

This new capability marks another step on our journey to making authentication safer and easier for everyone to use. As we continue to embrace the FIDO2 standard, you will start seeing more places where local alternatives to passwords are accepted as an authentication mechanism for Google and Google Cloud services. Check out to get an early glimpse of the use cases that we are working to enable next.

fsFxbC543n8
Click to expand...

Source: https://security.googleblog.com/2019...r-with_12.html

Windows 10: FIDO2 BLE Bluetooth Communication problem with Android / iOS

FIDO2 BLE Bluetooth Communication problem with Android / iOS

FIDO2 BLE Bluetooth Communication problem with Android / iOS

FIDO2 BLE Bluetooth Communication problem with Android / iOS

FIDO2 BLE Bluetooth Communication problem with Android / iOS - Similar Threads - FIDO2 BLE Bluetooth

multiple Android and IOS 2fa devices.

multiple Android and IOS 2fa devices.

Is BLE transport for FIDO2 roaming authenticator on Windos11 supported?

Is BLE transport for FIDO2 roaming authenticator on Windos11 supported?

How does FIDO2 authentication over BLE transport work for browsers that do not support BLE.

How does FIDO2 authentication over BLE transport work for browsers that do not support BLE.

How does FIDO2 authentication over BLE transport work for browsers that do not support BLE.

Passwordless FIDO2 verification on Android for Google Accounts

Groove Music on Android and iOS is dead.