Cannot register Yubikey with Chrome

[norbusan]

Hi,

I am trying to register my yubikey neo with the plugin, but then clicking on "New" it an instant it changes to "Failed" without me doing anything.

I am running chrome 49, and verified on the yubico test site that the key can be used with this browser.

OS is Debian/unstable.

Thanks

[kasparsd]

U2F requires HTTPS. Do you have that?

[lazyrivr]

I've gotten the same thing on a couple of my Wordpress sites (though not all), and all of them have HTTPS. I'm running Chrome 49 on Windows 10.

All the sites I'm having trouble with have been around for a while, and have/had several plugins, so I think it might be some kind of plugin conflict. Interestingly, they have all had other two-factor plugins previously as well - either Google Authenticator or Authy - so maybe it's related somehow.

[lazyrivr]

I retract my previous theory - it turns out the answer is much simpler than that (at least for my situation).

I noticed closed issue #89 that was very similar, and, based on the comments there, checked out the console. That's when I noticed it:

sign Object {version: "U2F_V2", challenge: "rw1XSYbsNrMP8l6B-P6khCKb7acUQsyuTP0lUdqeA8c", appId: "http://www.andy-bell.com"}
Register callback Object {errorCode: 2} Window {external: Object, chrome: Object, document: document, ajaxurl: "/wp-admin/admin-ajax.php", pagenow: "profile"…}
Registration Failed 2

The appId was just http, not https. Back when I converted all my sites to HTTPS, I did so with server redirects. In doing so, I forgot to go to the General Settings in WordPress and change the WordPress Address and Site Address URLs to https.

I went in, changed those settings, and tried adding the U2F key again, and it worked - on all 4 sites that it wasn't working on before. WordPress in general had been working fine with just the server redirects for over a year, but that little oversight seems to be what caused U2F to fail.

[norbusan]

Bingo!
I can confirm that. But I still consider it a bug.
I think it is quite common to have the main site on http, but use admin only over https.

Thanks for your research!

Norbert

[norbusan]

One more thing: After changing the http to https, and unconditionally returning true in providers/class.two-factor-fido-u2f.php, function is_browser_support, I can use the yubikey also with firefox and the u2f addon: https://addons.mozilla.org/en-US/firefox/addon/u2f-support-add-on/

So it would be nice if this would be supported from the plugin out of the box.

[kasparsd]

Thanks for confirming the HTTPS issue @norbusan!

Closing as a duplicate of #79.

[norbusan]

Thanks - any chance on the firefox extension plugin support?

[kasparsd]

@norbusan Sure, I created a new issue for that #117.

[norbusan]

Thanks!