cannot log into feedback site after migrating passkey

(#4574) Bug Open: Confirmed Priority: P1 api feedback-site migration security

Thread

Comment by Fullest
FullestReviewer 1 vote Merged from #4607 1 reply
Status changed from Needs triage to Answered
Hey there, there exists a passkey migration flow, but it may not be obvious how to get it to trigger. I'm not sure exactly how it will manifest with Proton Pass, but for example with Bitwarden the flow works as follows:
  1. Follow your steps
  2. When the passkey window from Bitwarden appears, no passkey is offered. Close this window.
  3. Fluxer begins a passkey migration process automatically.
That step 2 is not at all intuitive and that feedback has been given to Hampus so he'll probably make this a bit more obvious for users very soon.
Comment by sodiboo
sodiboo OP1 vote
in the video i recorded for this, i specifically made a point to show that i cancelled the prompt (and commented that i could log in otherwise) because Yes it is very unintuitive that the normal pre-passkey-migration flow requires cancelling once! i hope that can be improved indeed! (NEONSY mentioned "WebAuthn Related Origins", which perhaps sounds less hacky than the current passkey bridge? and could work in both directions(?) (or always log in on fluxer.com, even for OAuth)) (note that i realize the comment i'm currently replying to didn't have that context because the issues were merged)