Issue with USB Security Keys (Keyboard Interface) Causing Screen Freeze/Flicker on Android Devices

[陳冠翰]

Hi all,

I am writing to report an issue we've encountered while testing USB security key registration on Android devices using WebAuthn.

Environment Details:

• Devices / Android Versions:

  • Google Pixel (Android 15)

  • Samsung Galaxy A53 (Android 14)

• Test Website:
  https://webauthn.io

• USB Security Keys Used:

  • FEITIAN

  • Thetis
    (Both security keys include a keyboard interface.)

Reproduction Steps:

1. Navigate to https://webauthn.io

2. Enter a user name and click Register

3. Click More options, then select Another device

4. Choose USB security key

5. Insert the FIDO device after triggering the registration flow

6. Observe the screen behavior

Actual Result:
Upon inserting the USB security key, the screen either freezes or flickers. This interrupts the registration process.

Expected Result:
After inserting the USB security key, the process should continue smoothly to the PIN, fingerprint, or touch verification prompt without any screen issues.

Additional Notes:

• The same issue is observed when attempting to register a passkey with a Google Account.

• The issue seems to occur only with USB security keys that include a keyboard interface.

• This does not appear to be a security-related issue, but rather a UI or system-level compatibility problem.

Please let us know if any additional information is needed, or if there are known workarounds or fixes for this behavior.

[Pro Coder 101]

I did not get the part where you said 'Keyboard interface'. Do you mean the keys that has HID Keyboard feature too for passwords?

I tested with Galazy Z Flip 4, Galaxy Tab S10+ on browsers Chrome and Samsung Internet. I used a Yubikey 5 which also has a HID Keyboard feature. The issue was not reproducible. 

Aditya Mitra
CCNA, SecurityX
https://AdityaMitra5102.github.io
https://www.linkedin.com/in/AdityaMitra5102
https://scholar.google.com/citations?user=oXPSCNUAAAAJ

--
You received this message because you are subscribed to the Google Groups "FIDO Dev (fido-dev)" group.
To unsubscribe from this group and stop receiving emails from it, send an email to fido-dev+u...@fidoalliance.org.
To view this discussion visit https://groups.google.com/a/fidoalliance.org/d/msgid/fido-dev/03a8da23-d330-42e1-a57e-148ad0c3e629n%40fidoalliance.org.

[Pro Coder 101]

Edit: Forgot to attach the screen record

Aditya Mitra
CCNA, SecurityX
https://AdityaMitra5102.github.io
https://www.linkedin.com/in/AdityaMitra5102
https://scholar.google.com/citations?user=oXPSCNUAAAAJ

[陳冠翰]

The keyboard interface refers to the OTP functionality provided by security keys, which is typically available on multi-application security keys.Sorry, I didn't mention this earlier, but I tested with a YubiKey 5 NFC, and this issue does not occur. I have tested multiple security keys, and only YubiKey doesn't encounter this issue.Additionally, I tried setting the PID/VID of the security key under development to match that of the YubiKey 5 NFC, and this issue no longer occurs. This is a very strange situation.

[Pro Coder 101]

Is it somehow possible that the security key is emulating the 'Enter' key multiple times and which causes the Fido ceremony to be started multiple times and it goes on a stack one on top of another? 

Aditya Mitra
CCNA, SecurityX
https://AdityaMitra5102.github.io
https://www.linkedin.com/in/AdityaMitra5102
https://scholar.google.com/citations?user=oXPSCNUAAAAJ

[陳冠翰]

In my opinion, it seems more like another FIDO ceremony is being triggered to handle the FIDO key insertion event instead of using the original FIDO ceremony. This causes a second dialog to appear on top of the first dialog.
Occasionally, the second dialog will prompt for a PIN, and regardless of whether the PIN is correct or not, the first dialog will not disappear.
I find it incomprehensible that this situation disappears after modifying the PID/VID.

[My1]

Several fido keys of different makers have otp or adjacent functionality via an hid keyboard yes. 

And at least to my experience if the otp keyboard is enabled it usually just sees physical keyboard and throws out the virtual one on the screen.

Not sure if you have otp disabled or whether yubis are just prominent enough to have an exclusion rule. 

To view this discussion visit https://groups.google.com/a/fidoalliance.org/d/msgid/fido-dev/CAN%2B3J_jf-fWW%3DdT%3D9htLpLYKkCCDvs_MKn_1K-FgakifGfjEUQ%40mail.gmail.com.

[陳冠翰]

The issue I'm encountering is not about the virtual keyboard failing to display, but rather about another dialog appearing and stacking when the key is inserted. These are two different situations. Using a YubiKey 5 (FIDO+CCID+OTP) cannot reproduce this issue.
For the virtual keyboard display issue, you can simply go to keyboard settings and enable "Display on screen keyboard when external device is plugged in" to resolve it. However, regardless of whether this feature is enabled or not, it will not make this issue disappear.

[My1]

Any chance you could record this? 

[Joshua Cigna]

To reproduce you need to have the "display onscreen keyboard when external device is plugged in" enabled.   I have been able to re-produce this on several devices with this configuration with a Yubikey 5.

It seems to work properly on my Pixel 9a & Galaxy S24 with the latest updates.

Issue is logged with Google Android team here - https://issuetracker.google.com/issues/415018778

[Joshua Cigna]

This is what I see. Recorded on a Samsung Tab 10 FE, Chrome v 139, latest version of Google Play Services and all Samsung patches (as of 20250922) applied.