# Multiple Webauthn registrations fail **URL:** \ **Category:** Two Factor Authentication\ **Created:** [February 19, 2021, 12:34pm UTC](https://onlykey.discourse.group/t/multiple-webauthn-registrations-fail/238 "2021-02-19T12:34:41Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![flumm](https://avatars.discourse-cdn.com/v4/letter/f/bc79bd/32.png) [@flumm](https://onlykey.discourse.group/u/flumm)\ **Post date:** [February 19, 2021, 12:34pm UTC](https://onlykey.discourse.group/t/multiple-webauthn-registrations-fail/238/1 "2021-02-19T12:34:41Z")
hi, i am not sure if its a bug or by-design, but if i register my onlykey twice, the authentication fails afterwards with ’ The operation either timed out or was not allowed. See: [Web Authentication: An API for accessing Public Key Credentials - Level 2](https://www.w3.org/TR/webauthn-2/#sctn-privacy-considerations-client.') i tested this on chromium on [https://webauthn.io](https://webauthn.io): - register a username - sucessfully login - register the same username again - login fails with the above error this works with other keys (e.g. a yubikey) without problems i have set a fido2 pin and the fwversion is v2.1.0-prodc is this normal? ---
**Author:** ![Extrawdw](https://yyz2.discourse-cdn.com/free1/user_avatar/onlykey.discourse.group/extrawdw/32/60_2.png) [@Extrawdw](https://onlykey.discourse.group/u/Extrawdw)\ **Post date:** [February 19, 2021, 1:20pm UTC](https://onlykey.discourse.group/t/multiple-webauthn-registrations-fail/238/2 "2021-02-19T13:20:26Z")
Same issue when I testing on [webauthn.io](http://webauthn.io) with username `test`, but when I test it with a rather unique username, the problem not appear. Plus Yubico Demo Website has no problem with the username `Yubico demo user` as it always uses, so I will rather consider this a website-specific issue. ---
**Author:** ![Extrawdw](https://yyz2.discourse-cdn.com/free1/user_avatar/onlykey.discourse.group/extrawdw/32/60_2.png) [@Extrawdw](https://onlykey.discourse.group/u/Extrawdw)\ **Post date:** [February 19, 2021, 1:24pm UTC](https://onlykey.discourse.group/t/multiple-webauthn-registrations-fail/238/3 "2021-02-19T13:24:15Z")
I tested the [webauthn.io](http://webauthn.io/) with my YubiKey 5 NFC also, the problem is the same. ---
**Author:** ![t11](https://avatars.discourse-cdn.com/v4/letter/t/8e7dd6/32.png) [@t11](https://onlykey.discourse.group/u/t11)\ **Post date:** [February 19, 2021, 3:10pm UTC](https://onlykey.discourse.group/t/multiple-webauthn-registrations-fail/238/4 "2021-02-19T15:10:06Z")
@flumm I tested this with solokeys and was able to see the same issue. OnlyKey uses the solokeys implementation of FIDO2 here [solo/fido2 at master · solokeys/solo · GitHub](https://github.com/solokeys/solo/tree/master/fido2) That FIDO2 implementation is certified but there are still differences from things like Yubikey such as how the key deals with duplicate registrations. ---
**Author:** ![flumm](https://avatars.discourse-cdn.com/v4/letter/f/bc79bd/32.png) [@flumm](https://onlykey.discourse.group/u/flumm)\ **Post date:** [February 19, 2021, 3:57pm UTC](https://onlykey.discourse.group/t/multiple-webauthn-registrations-fail/238/5 "2021-02-19T15:57:08Z")
ok, just to clarify, the problem i initially had was with the webui of proxmox backup server (which supports webauthn). on there i can register a yubikey (i borrowed one shortly from a colleague) multiple times and login always worked without problems but not with onlykey. i then tried to replicate it on [webauthn.io](http://webauthn.io) (for testing) and assumed it was the same problem… i’ll test some more next week since it seems the issue is something else ---
**Author:** ![Extrawdw](https://yyz2.discourse-cdn.com/free1/user_avatar/onlykey.discourse.group/extrawdw/32/60_2.png) [@Extrawdw](https://onlykey.discourse.group/u/Extrawdw)\ **Post date:** [February 19, 2021, 5:53pm UTC](https://onlykey.discourse.group/t/multiple-webauthn-registrations-fail/238/6 "2021-02-19T17:53:15Z")
I have few guesses: - the service only accepts few AAGUID, or rejected OnlyKey’s AAGUID - Attestation issue ---
**Author:** ![t11](https://avatars.discourse-cdn.com/v4/letter/t/8e7dd6/32.png) [@t11](https://onlykey.discourse.group/u/t11)\ **Post date:** [February 19, 2021, 7:10pm UTC](https://onlykey.discourse.group/t/multiple-webauthn-registrations-fail/238/7 "2021-02-19T19:10:06Z")
Some services restrict to only allow keys from certain vendors. For example, [Vanguard.com](http://Vanguard.com) supports only Yubikey, all other security keys are not permitted. For Azure AD, a handful of vendors are approved however any vendor key can be used by disabling ‘Enforce Attestation’ more info on that here - [Error adding Yubikey to Security Info - Microsoft Q&A](https://docs.microsoft.com/en-us/answers/questions/3908/error-adding-yubikey-to-security-info.html) There may be a similar setting in the server you are using. Another thing to try would be to use a different browser such as Firefox to register the security key. Let me know if that works, if it does there is a possibly related issue here - [Cannot register to Microsoft Account - #13 by t11](https://onlykey.discourse.group/t/cannot-register-to-microsoft-account/205/13) ---
**Author:** ![flumm](https://avatars.discourse-cdn.com/v4/letter/f/bc79bd/32.png) [@flumm](https://onlykey.discourse.group/u/flumm)\ **Post date:** [February 19, 2021, 7:46pm UTC](https://onlykey.discourse.group/t/multiple-webauthn-registrations-fail/238/8 "2021-02-19T19:46:24Z")
I am one of the devs of proxmox and just wondered if we do something wrong. We do not enforce any vendor (at least not intentionally). It may have to do with the rust library for webauthn though. It is not so important since registering a key twice is not really a “normal” use case anyway and it works if I register it once. Nonetheless I’ll investigate next week and report my findings (if you want) ---
**Author:** ![t11](https://avatars.discourse-cdn.com/v4/letter/t/8e7dd6/32.png) [@t11](https://onlykey.discourse.group/u/t11)\ **Post date:** [February 22, 2021, 1:59pm UTC](https://onlykey.discourse.group/t/multiple-webauthn-registrations-fail/238/9 "2021-02-22T13:59:56Z")
Yes, additional findings would be great thanks. ---
**Author:** ![flumm](https://avatars.discourse-cdn.com/v4/letter/f/bc79bd/32.png) [@flumm](https://onlykey.discourse.group/u/flumm)\ **Post date:** [February 22, 2021, 2:27pm UTC](https://onlykey.discourse.group/t/multiple-webauthn-registrations-fail/238/10 "2021-02-22T14:27:35Z")
ok i tested a bit further it works with firefox, so it should not be a general onlykey problem. i found this bug: [Registering with same username twice!!! · Issue #15 · duo-labs/webauthn.io · GitHub](https://github.com/duo-labs/webauthn.io/issues/15) which mentions that it might be bug/behavioural problem with chrome and their webauthn implementation ([https://chromium-review.googlesource.com/c/chromium/src/+/1629587](https://chromium-review.googlesource.com/c/chromium/src/+/1629587)) though i am not sure i completely understand this yet the key i borrowed from a colleague was a yubikey 4, so it is not a fido2 key only u2f (afaics from the yubikey spec sheet) in contrast to the onlykey/yubikey 5. so my guess is that the fido2 implementation of chrome/chromium is at fault here. our fix is to include the already registered devices in the excludeCredentials option on register, that way, chromium shows the user that this key is already registered thank you for your input 🙂 ---
**Author:** ![flumm](https://avatars.discourse-cdn.com/v4/letter/f/bc79bd/32.png) [@flumm](https://onlykey.discourse.group/u/flumm)\ **Post date:** [February 24, 2021, 12:02pm UTC](https://onlykey.discourse.group/t/multiple-webauthn-registrations-fail/238/11 "2021-02-24T12:02:12Z")
i did some further investigation into this (since we now tested a yubikey 5 succesfully) and it seems that the token sets numberOfCredentials in the assertion response but not a user identification list there is already an open chromium bug[0], but i did not find the mentioned ctap2 pr afaict, the spec[1], says this is ok but it is not completely clear to me 0: [1087642 - chromium - An open-source project to help move the web forward. - Monorail](https://bugs.chromium.org/p/chromium/issues/detail?id=1087642) 1: [Client to Authenticator Protocol (CTAP)](https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#authenticatorGetAssertion)