[Linux/Fedora] Browser biometrics integration is not working

[mihalyr]

Steps To Reproduce

• Go to settings
• Enable unlock with biometrics
• Links with desktop app
• Open settings again and check the biometrics setting

Expected Result

• biometrics enabled and working

Actual Result

• biometrics not enabled
• trying again it will show enabled, but leaving settings and opening it again it is reset to disabled, cannot enable it

Screenshots or Videos

No response

Additional Context

I'm not sure if this is even supposed to work under Linux, when I first time click to enable it shows me the pass phrase to connect the desktop app, I allow it in the desktop app, go back to the browser and go to the settings it wills show disabled again, then I click to enable again, it will show enabled and a new option appears to underneath, but when I leave the settings and come back again it is reset to disabled again. I am not sure how this supposed to work, but seemingly the option does not do anything.

Operating System

Linux

Operating System Version

Fedora 40

Web Browser

Firefox

Browser Version

130

Build Version

2024.9.0

Issue Tracking Info

• I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.

[quexten]

Hi @mihalyr , yes, biometrics has been tested to work on Fedora with Firefox. However, support depends on a few things (which we should probably better present to the user, and the error messaging should definitely be better than what you have encountered).

Since you are on Fedora, could you let me know:

• Browser installation type (Flatpak/.rpm)
• Bitwarden desktop installation type (Flatpak/.rpm/appimage)

[mihalyr]

Hi @quexten I use Firefox from the distro RPM (Fedora 40 Sericea - rpm-ostree based) and the desktop app is from your website an AppImage.

[quexten]

Interesting, my first thought was that there is an issue of browser <-> desktop communication (in snap/flatpak this is not supported yet for instance). But since this is fedora sericea, there might be a few other issues. Is biometric unlock in just the desktop app (without involving any browser) working for you?

I think the following problems could occur:
Currently biometric unlock relies on polkit and libsecret. On gnome/kde these come with the DE, but on sway programs providing these (polkit agent, and something like gnome-keyring) might need to be installed? (I do not know about Fedora Atomic, but that's how it is on Arch).

Further, since Sericea is atomic, can Bitwarden desktop even modify the polkit files (to add the bitwarden polkit unlock policy) (since they are immutable?), or does an ostree need to be created here?

[mihalyr]

I've got an interesting reply from your colleague on another issue where they state that biometrics on Linux desktop is not supposed to work: #11052 (comment)

If that is the case, then I assume this explains why it won't work with the browser extension either. But doesn't give me an error just silently disables the option. It would be perhaps nicer if either the desktop app or extension would show me some error that the functionality is not available on my system. Or not even show that option. But it's just a small thing, I can ignore it if it's not there yet, I just installed the desktop app and tried out various options to see how they work.

[Hazmi35]

Not sure if this affects Windows. I am currently on Windows 11, I've used biometrics on browser extension long before and it works.

Some earlier updates requires me to unlock the desktop app first to authorize browser biometrics. Then some updates fixed it to like how it was before (you can unlock browser ext via biometrics even when the desktop app is locked).

Then today, I can't even press the biometrics button, nothing would show up, no Windows Hello, nothing.

[mihalyr]

Hi @quexten

Is biometric unlock in just the desktop app (without involving any browser) working for you?

No, I don't even have that option in the desktop app, only in the browser extension. I don't use biometrics on my laptop, but saw the option in the extension and was going to give it a try if I can hook it up with my fingerprint reader. But in the process I realized that I have one of those unlucky hardwares (thank you Synaptic) that has closed source drivers and only support Windows without any Linux alternative in sight. So in short, my sensor is dead on Linux so it wouldn't work.

I think, I was confused by how Bitwarden was showing the option, allowing me to check it and even acted as it connection to the desktop app with the security phrase and all, but didn't give any errors just didn't work.

I realize how diverse the Linux ecosystem is and don't expect that a variety of products will be supported, I was just missing an error, because Bitwarden looked like all is fine but not doing anything.

I'll close the ticket, I don't think I can make this work on my side. I found a project that tried to reverse engineer these drivers, but development has stalled and libfprint lists the vendor as unsupported. I might try again on a new machine :)

Thank you for your time.

[quexten]

@Hazmi35 the issue on Windows (and Mac) is unrelated and is fixed by updating your desktop client.

@mihalyr I still feel that this is not the best UX as evidently, users get confused by the setting. It might be simpler to separate the "browser desktop integration" and the "biometrics" part and only show the latter once the desktop app communicated to the extension that biometric unlock is available.

[rmcmilli]

I'm having a similar issue on Fedora 40 but the desktop app fingerprint auth works for me. I am unable to get browser extensions to work though. On extension setup I get the polkit fingerprint prompt, but actual auth attempts don't prompt at all.

Edit: Updated to latest AppImage and all works as expected.