Fingerprint security key option not found when adding the device to an existing account

[neokree]

Hello,

I recently bought a new phone, and I was trying to add it to my existing internet identity, only to find out that there isn't an option for it.

To be sure, with the same browser (Brave) I tried to create a new Identity, and this time the fingerprint option was available.

Is there a reason why you are not supporting the use of a fingerprint option when adding the device to an existing account?

Tested with a Google Pixel 6 with Android 13 installed

[nmattia]

Hi! apologies for the delay, was off for a few weeks.

That's really surprising. I can actually reproduce this... but not with every anchor, which is really odd. Let me investigate a bit and come back to you; thanks for the report!

---

EDIT: and now I can't reproduce it anymore... something odd is happening here for sure!

[neokree]

Hi @nmattia I also found out that the biometric authentication is available if you first recover your anchor using the seed on the new device, and after logging in you add your new device.

[neokree]

Maybe it's something that happens only the first time you try to connect with a new device to an existing anchor?
I can reproduce it every time by trying to login to a random anchor

[nmattia]

Ok, so we do exclude some authenticators when creating credentials for a new device:

internet-identity/src/frontend/src/flows/addDevice/welcomeView/registerTentativeDevice.ts

Line 142 in b66fe92

publicKey: creationOptions(existingAuthenticators),

I'm not 100% sure why it's there and what it does; @frederikrothenberger can you clarify why it's needed and what exactly it does?

[frederikrothenberger]

This excludes already registered devices. I.e. it prevents creating a new credential if an existing one is already available on the same WebAuthn Authenticator. So you cannot register TouchId twice using the same MacBook, but you can register TouchID and a YubiKey that is attached to the same MacBook because the YubiKey is considered a different Authenticator.

[nmattia]

@frederikrothenberger what happens if you have two anchors, 10000 and 10001, and 10000 has TouchID and you want to add TouchID to 10001? Is TouchID on 10000 considered registering TouchID twice?

[frederikrothenberger]

@nmattia: No, the excluded credential id's are the ones of the anchor you're trying to add a device to. So, when adding something to anchor 10000 you don't exclude any credentials used on other anchors.