Reset Credentials

[HGBits]

Hi I returned, I have a very specific problem now.
I lost my access pin and to reset the passsless asks to confirm presence, my notebook has no biometrics key and the dunst does not display any kind of interaction when displaying the notification.

I want to know how I do in this case to be able to reset the passless.

[pando85]

Thanks for reporting this. I've investigated it and this is a Passless UX/notification compatibility issue rather than a requirement for biometric hardware.

The confirmation you're seeing is CTAP User Presence (UP). Passless implements it through the desktop notification, so a fingerprint reader or other biometric device is not required.

The problem is Dunst: it supports Freedesktop notification actions, but it doesn't normally render the Accept / Deny actions as visible buttons. Passless currently assumes those actions will be visible.

As a workaround, while the Passless notification is active, try:

dunstctl context

and select Accept. Depending on your Dunst configuration, middle-clicking the notification can also invoke/open its actions.

I've opened #370 to fix this properly:
#370

The intended fix is to make UP confirmation discoverable/actionable on Dunst and similar notification daemons, while keeping UP and the stronger UV semantics separate.

Thanks again — this is definitely something Passless should handle better.

[pando85]

There is a workaround you can use now without waiting for the fix — and you don't need biometric hardware.

Since you've forgotten the PIN, we can clear Passless's persisted PIN state directly. You do not need to delete your stored passkeys.

First stop Passless:

systemctl --user stop passless.service

Then, depending on the backend you're using:

Local backend

With the default path:

rm -f "${XDG_DATA_HOME:-$HOME/.local/share}/passless/local/pin_state.json"

If you've configured local.path / PASSLESS_LOCAL_PATH, use that directory instead.

TPM backend

Default path:

${XDG_DATA_HOME:-$HOME/.local/share}/passless/tpm

For the normal TPM backend:

rm -f "${XDG_DATA_HOME:-$HOME/.local/share}/passless/tpm/pin_state.json.tpm"

For portable TPM:

rm -f "${XDG_DATA_HOME:-$HOME/.local/share}/passless/tpm/pin_state.json.tpm.portable"

Don't delete portable_parent.json; that isn't necessary for resetting the PIN.

pass / password-store backend

By default the Passless data is under:

~/.password-store/fido2

The PIN configuration is Git-synced, so use pass to remove it rather than just deleting the file:

pass rm -f fido2/pin_state
rm -f "${PASSWORD_STORE_DIR:-$HOME/.password-store}/fido2/pin_retries.gpg"

If you've customized pass.path, replace fido2 with that path.

Then start Passless again:

systemctl --user start passless.service

Passless will see the missing PIN state as a fresh authenticator PIN state, so you should be able to configure a new PIN while keeping your existing credentials.

If you tell me which backend you're using (local, pass, TPM, or portable TPM) and whether you've changed its path, I can give you the exact command for your setup.

I've also documented this workaround in #370 while we fix the Dunst confirmation issue properly.

[HGBits]

Thank you! I reset the PIN following the instructions for pass as the backend.

[HGBits]

While I have you, I wanted to ask — does Passless support other authentication methods besides PIN?

[pando85]

Not yet. We have desktop notifications, pin and GPG key auth.