David Pinkerton on Nostr: Hardware security keys (e.g., Yubikeys) do work fully on GrapheneOS with zero Google ...
Hardware security keys (e.g., Yubikeys) do work fully on GrapheneOS with zero Google Play Services. Authnkey, a handy little app that you can install from F-Droid, implements CTAP2 directly instead of going through Google's FIDO library.
My example: YubiKey 5C NFC over NFC only (my USB port is dead), Pixel 7a, Play-free profile:
- Pocket ID passkey login, PIN prompted and accepted over NFC
- Bitwarden WebAuthn 2FA, both web vault and native app
The community guidance still says sandboxed Play is required for
security keys, and that PIN over NFC needs USB. Neither holds if you skip Google's FIDO library. My key is firmware 5.4.3, so CTAP2.0. Found that you don't even need a 2.1 key for the PIN case.
f-droid.org/packages/pl.lebihan.authnkey
Published at
2026-08-14 12:47:47 UTCEvent JSON
{
"id": "01cb93ab2a2fe13067a66e49feded2d2753954951a864ed0b85468ca229dab25",
"pubkey": "909e3fdc259a211ead564dc589e34a81aef214665d5e6889ef8bb6d473f2b10a",
"created_at": 1786711667,
"kind": 1,
"tags": [],
"content": "Hardware security keys (e.g., Yubikeys) do work fully on GrapheneOS with zero Google Play Services. Authnkey, a handy little app that you can install from F-Droid, implements CTAP2 directly instead of going through Google's FIDO library.\n\nMy example: YubiKey 5C NFC over NFC only (my USB port is dead), Pixel 7a, Play-free profile:\n\n- Pocket ID passkey login, PIN prompted and accepted over NFC\n- Bitwarden WebAuthn 2FA, both web vault and native app\n\nThe community guidance still says sandboxed Play is required for\nsecurity keys, and that PIN over NFC needs USB. Neither holds if you skip Google's FIDO library. My key is firmware 5.4.3, so CTAP2.0. Found that you don't even need a 2.1 key for the PIN case.\n\nf-droid.org/packages/pl.lebihan.authnkey",
"sig": "e2119c4a0976c92a3dd9e848c4d3acee5378c824e89abd7509c68bbe63afb3f79b7c271b61c39a6f73d5962293c0749f2aa0ea249069490e371a7062bc875d96"
}
