cannot log into `fluxer.com` in the Android app after migrating passkey

(#4614) Bug Open: Needs triage migration mobile security

Reproduction steps

  1. have a passkey on your fluxer.com account which is bound to the fluxer.com origin
0(b). have an up to date Android app - i have 2026.11.100-beta.2; this is relevant, because i'm vaguely aware that an app might need to declare passkey origins somehow? i would expect the broken behavior on an app that only knows of the old origins. but 2026.11.100-beta.2 was released after i reported 4574, so it ought to be "aware" of the new origin
  1. simply try to log in to fluxer.com in the Android app using the passkey

Expected behaviour

i should be prompted for my passkey, which i can then select and be logged into my account

Actual behaviour

i am not prompted for anything. i am immediately presented with an error message "No passkeys found for this app. Log in with an email and password instead". this error message even occurs on the screen that requires use of a passkey when there is no email and password prompt available because that's not a valid way to log into my account. that's probably wrong even if there genuinely is no passkey on this device. but like, i have a passkey.

Build information

Version 2026.11.100, Beta 2, Channel Beta, Build 890, Android 17 (arm64), Device Google Pixel 9a, Locale en-US, Push unifiedpush, Flutter 3.47.9, Dart 3.13.7

Platform

Android

Evidence

I'm using Bitwarden as my password manager. I know it can be janky with Android apps in particular. I've attached a video in which i showcase the problem. Observe that the "use your passkey right now?" prompt is not captured by the system screen recorder, because it's a system prompt that needs me to input my device unlock credentials. I made my password manager screen recordable, but the device unlock is not affected by that. It is simply presented as a black screen. In the video, i show two passkeys. One is bound to fluxer.com, and one bound to fluxfur.com. Both should be okay to use in the com.fluxer Android app. Only fluxfur.com prompts me to use that passkey (it doesn't grant login; because that passkey was revoked; but the app successfully tries to use it for login). When logging into fluxer.com through the app, i am not prompted for a passkey (notice that the recording doesn't show black; it just fails instantly). Before logging into the app, the video shows logging into fluxer.com successfully, to prove that the passkey is bound to that domain. Despite having two passkeys that are supposed to be attached to the app, i am never presented the choice between those two passkeys. This is good. This is expected, because there's no instance that accepts both my passkeys. This has been the case since before the domain migration. It never asked me to select a passkey. Deja vu Passkey login through the Android app has previously worked when the origin was web.fluxer.app (about two months ago when i first logged in, then i'm not sure i ever tried again). Passkey login through the Android app did not work on fluxfur.com two months ago when i first set up my account there. That's why my passkey for FluxFur was revoked. I just didn't remove it from my password manager yet. I haven't tried an Android passkey on fluxfur.com in the two months since i set up my account there, but i suspect it would work fine now (edit: nope! it doesn't! ^.^). If i recall correctly, the login experience two months ago was very similar to what my recording shows today. it lets me choose my passkey on one instance, and completely rejects any attempt to log into the other instance with a passkey (even though i definitely had a passkey saved on both instances). But now, the instances are flipped compared to two months ago.

Comments

Sign in with Fluxer to comment and vote.

No comments yet.