Passkeys and multiple accounts for a site is broken
I have multiple accounts on a site that supports passkeys. I successfully migrated the accounts to using passkeys, however, when I go to log in, I select to use a passkey and it just automatically submits the first one in my vault list. It should prompt and allow me to select between the available options if there is more than one in the vault.
1Password Version: Not Provided
Extension Version: Not Provided
OS Version: Not Provided
Browser:_ Not Provided
Comments
-
I just noticed the same issue with my multiple Google accounts. I'd just registered a passkey for one of them and it worked fine, but today I registered a passkey for a second Google account and the registration worked fine, but logging in doesn't work. 1Password just repeatedly tries to sign in with the first Google account in the list, so it gets stuck in a loop on authentication step until I choose the option to try with another method.
0 -
Hey @billvortex, what website are you seeing this on?
0 -
Hey @Backspaze, the development team is actively investigating how selecting a passkey out of many passkeys during the login process will work. The behavior on Google.com has been brought up to us a few times now. I'm curious, if you enter the email first, rather than going straight for the sign in with a passkey button, are you able to select the correct account?
0 -
@Joy_1P I'm not quite sure. Both of the Google accounts are cached in the browser so if I go to https://myaccount.google.com/, I see both accounts and can choose which one I want to log in with as shown in the screenshot below.
Once I click on one of the accounts, it asks me to confirm my identity with the key, and there's a button to proceed with this and a link for trying with another method as shown below. When choosing the option to try with another method, I get two options; use the key or use my password, of which the latter will then ask me for the TOTP code for regular 2FA.
If I open https://myaccount.google.com/ in a private session, it asks me for my email/username and password and then shows the screen below. For some reason it can't find my passkey, which I think is related to something about cookies being involved in the registration of passkeys, which has been mentioned in other threads.
0 -
The site I'm using these on is an internal site, so I can't share it, however, it does use Hanko.io as the login provider and the behavior duplicates on their passkey test page at https://www.passkeys.io
0 -
@Backspaze if you select your account from this, you should be brought to this screen. From there, select Continue. 1Password should sign you in with the correct passkey for the account that has been selected.
It does work on my end when testing. Could you try that and let me know how it goes?
0 -
@Backspaze that's strange. It works for me no matter which account I choose, as long as there is a saved passkey. You had mentioned this earlier:
Once I click on one of the accounts, it asks me to confirm my identity with the key, and there's a button to proceed with this and a link for trying with another method as shown below. When choosing the option to try with another method, I get two options; use the key or use my password, of which the latter will then ask me for the TOTP code for regular 2FA.
Can you confirm if you are clicking "Try Another Way" or if you are clicking "Continue"? Are you saying that when you click "Continue", you are prompted to sign in with your password or 2fa?
Make sure you're trying this in your regular profile and not in a private session. The passkeys for Google seem to be linked to the browser that they're saved in, and it wouldn't be possible to save that in a private session.
0 -
When I click on Continue, the authentication loop I'm talking about is that 1Password in the browser shows a notification in top right corner about trying to sign in with the passkey, but it's always trying to use the Google account listed at the top in 1Password.
Make sure you're trying this in your regular profile and not in a private session. The passkeys for Google seem to be linked to the browser that they're saved in, and it wouldn't be possible to save that in a private session.
Thanks for confirming that. It seems a bit odd to link the key to a browser as this makes it more difficult to use passkeys effectively. You'd have to register a passkey for every browser on every device you use, and can't use the passkey in an incognito session.
0 -
Hey again @Backspaze!
Thanks for confirming that. It seems a bit odd to link the key to a browser as this makes it more difficult to use passkeys effectively. You'd have to register a passkey for every browser on every device you use, and can't use the passkey in an incognito session.
1Password doesn't tie passkeys to the browser, but it appears that Google is doing so. This is something that we're only seeing for passkeys created for Google accounts. Passkeys for other accounts and websites saved to 1Password do not run into this issue.
There's not much that we can do our end about this limitation, but we do hope that Google will be able to improve on their implementation of passkeys after some time. We also encourage you to leave feedback about this to Google. Here's a guide on how to do that: https://support.google.com/chrome/answer/95315
When I click on Continue, the authentication loop I'm talking about is that 1Password in the browser shows a notification in top right corner about trying to sign in with the passkey, but it's always trying to use the Google account listed at the top in 1Password.
I just tested again and as long as I select the account beforehand on the website via Google, I don't run into this issue. Are you able to record the behavior that you're seeing and share that with us?
Make sure to include the account selection in your recording so that we can review the entire process from your end and so that we can figure out where things are going wrong.
After you have the video, please attach it to an email message addressed to support+forum@1password.com. With your email please include:
- A link to this thread: https://1password.community/discussion/140854/passkeys-and-multiple-accounts-for-a-site-is-broken
- Your forum username: Backspaze
You should receive an automated reply from our BitBot assistant with a Support ID number. Please post that number here. Thanks!
0 -
Yep, I'm aware that the issue with tying passkeys to the browser lies with Google, and my comment was in regards to that. But as you said (wrote?), we can only hope that Google does something about it in the future. For what it's worth, I've sent feedback to Google according to the instructions in the link you provided. Those instructions though, are for feedback regarding Chrome, and the passkey issue is system wide. But getting in touch with Google isn't the easiest, so I guess we'll have to make do with what we got and hopefully the feedback will find its way to the right department.
I've made a recording and sent to the email address according to your instructions. In the email I also included step by step information to clarify what's happening in the recording. The Support ID is: [#APA-73863-462]
0 -
Yep, I'm aware that the issue with tying passkeys to the browser lies with Google, and my comment was in regards to that. But as you said (wrote?), we can only hope that Google does something about it in the future. For what it's worth, I've sent feedback to Google according to the instructions in the link you provided. Those instructions though, are for feedback regarding Chrome, and the passkey issue is system wide. But getting in touch with Google isn't the easiest, so I guess we'll have to make do with what we got and hopefully the feedback will find its way to the right department.
Gotcha! I misunderstood and had wanted to clarify. I do find that it is hard to get in touch with Google, but their developers do seem to be active on https://bugs.chromium.org. If you take a look, you'll find some reports of passkey-related bugs on there. So it does seem like they're working hard from their end too. It might be worth making a report to see if you get a response.
I've made a recording and sent to the email address according to your instructions. In the email I also included step by step information to clarify what's happening in the recording. The Support ID is: [#APA-73863-462]
Thanks for sending us the recording! I do see that one of our support specialists have responded. Let's continue the conversation from there.
ref: APA-73863-462
0 -
I can confirm this behavior for Microsoft as well (login.live.com). If I put the email address in first, or click "open and fill" option in 1Password it still will just sign me in with the first account I created.
0 -
I'm on Windows 11 Pro (22H2, 22621.1848), Chrome 114.0.5735.199, and 1Password in the browser, Beta 2.13.1. I have multiple logins with google.com and have passkeys associated with all the google.com logins. I am seeing the same issue with loging in -- I get stuck in an "authentication" loop where it repeatedly tries one of my accounts (I believe it is the last passkey saved), independent of which account I select on google.com. It appears to be identical to the one reported by @Backspaze. Please let me know if I can help with replicating or debugging this issue.
0 -
I'm having this issue on https://www.passkeys.io/.
I have two accounts (differing email addresses) and it is impossible for me to sign into the account with the alternative email address. It auto signs in with the first passkey. Definitely not right!
0 -
Seeing the same thing on github.com
1 -
Same on github.com too, I can provide any additional info by request (because not sure, what do you need in this case)
0 -
Thanks folks. The team is working with how to selecting a specific passkey out of multiple passkeys for any give site. I hope we'll be able to address this soon.
0 -
Same here. Look at github.com as another UC to check.
0 -
Cross posting this post from one of the developers.
https://1password.community/discussion/comment/691745/#Comment_691745
1 -
Since the release of 1Password in the browser 2.14.2 I can now sign in with passkeys for multiple Google accounts.
Interestingly, when I sign in on https://accounts.google.com/ 1Password shows a list of all possible items that has a passkey, and it's just a matter of choosing the right one. However, on https://passage.1password.com/demo, 1Password only shows one item (and it's the correct one) even though I have multiple items with passkeys for that site, so that site certainly works better in that regard, as there's no risk of choosing the wrong account. The demo site still isn't fully functional though, as 1Password doesn't show it's inline menu in the Email or phone number field and clicking in Autofill in the extension doesn't do anything. You have to drag and drop or copy/paste, which isn't ideal for a demo site.
I created another thread about the demo site a while ago but I never received any feedback from 1Password there and Passage never got back to me after their first email reply, so I thought I'd just mention this here instead.
0
