This is the issue with Bitwarden’s Mac desktop app.

If your key supports both protocols (which Yubikey 5 does), the only valid reason I see for adding Yubico OTP as second factor in Bitwarden is that you will need to login to your vault on a client that does not support WebAuthn (like CLI or Linux desktop, for example). It’s fast.ĭistinguishing between the two is all very opaque across services and in documentation. WebAuthn definitely authenticates faster than OTP. Having both enabled doesn’t seem to present any issues. I would like to disable Yubikey OTP in Bitwarden settings but the Bitwarden desktop app seems to fall back to it and bypass WebAuthn so I need either both enabled or to stick with OTP. At least in Bitwarden it’s easy to tell as the pop-ups are different when you tap the key. So you are left wondering which one was utilized. But there is nothing which clearly indicates this within Google settings and the workflows look basically the same. This is what the link to the directory noted by the poster above indicates.

Google Accounts is Yubikey OTP, I believe, unless you are enrolled in Advanced Protection. I just tried it and it worked and began to experiment. I assume maybe because it’s the broader implemented standard right now? There is nothing which indicates that you can also set your Yubikey up under WebAuthn. Neither require a pin unless you set it.īitwarden intentionally pushes you toward Yubikey OTP with the 2FA Yubikey branding. I am playing with both Yubikey OTP and WebAuthn for Bitwarden.

Cisco duo yubikey