8

I'm enrolled in Google's Advanced Protection Program, which means I can only authenticate with a physical FIDO U2F token on every sign-in.

Trouble is, that when I try using my Google account, I see "You can only use your Security Keys with Google Chrome".

Image of User Accounts

Is there a way around this, or a way for me to use my U2F security key here?

Improve this question
0

4 Answers 4

Reset to default
3

There isn't a way to use your U2F token in this scenario. U2F depends on browser support, and as of August 2018, only Chrome, Firefox and Opera support it.

As a workaround, you could set up Google Authenticator and use that to log in.

Improve this answer
3
  • 1
    Unfortunately it's not possible to set up Google Authenticator, since ‘after you enroll, other authentication factors you might be used to, like codes sent via SMS or the Google Authenticator app, will no longer work.’ Google Advanced Protection Program
    – grg ♦
    Aug 30, 2018 at 18:20
  • It still should be possible to add a non-U2F second factor. Go to your Google account settings -> Sign in and Security -> Signing into Google -> 2-Step Verification and there should be an option to add Google Authenticator or other methods.
    – Ted Kaplan
    Aug 30, 2018 at 21:35
  • 1
    @thirtyseven unfortunately, no, the Google Advanced Protection Program does not allow you to add a non-U2F second-factor of authentication :(
    – Amin Shah Gilani
    Aug 31, 2018 at 8:34
2
+50

I looked into the issue you described and I saw on Google's Advanced Protection Program Page, and read that

Apple’s Mail, Calendar, and Contacts apps will continue to be able to access your Google data as normal.

Screenshot of Google Advanced Protection website

So, that means you should be able to use your U2F key on that application. I would contact Google or just turn off advanced protection program, then re-activate it.

Also, make sure you are on the latest version of MacOS (which is High Sierra 10.13.6 or Mojave 10.14) because that could be the reason why it is not working.

I hope this answer helps

Improve this answer
4
  • Turning off the advanced protection programme and reactivating it does not fix the problem. However, it's possible that updating MacOS to the latest version might fix it; I am running Yosemite (10.10.5), but am not able to update for other reasons. I would be interested to learn whether updating the Mac OS fixes the issue for other users who are able to update.
    – CaptainProg
    Oct 3, 2018 at 8:55
  • Unfortunately, it didn't help in my case. I'm on macOS High Sierra and have been since I activated Advanced Protection. I read this notice, or something similar, but I still couldn't get it to work. It's likely that this behavior is limited to iOS and not MacOS.
    – Amin Shah Gilani
    Oct 4, 2018 at 11:08
  • 1
    Okay. So I guess we still don't have an answer for this...
    – CaptainProg
    Oct 6, 2018 at 10:24
  • Mojave latest doesn't work either.
    – Christian
    Jan 15, 2019 at 20:37
2

This is now possible as of macOS Catalina 10.15.2, as Safari has gained support for security keys. When signing in to your Google account in the Internet Accounts preference pane, Safari will prompt you to touch your USB security key after you enter your Google account password, and will then prompt you to allow macOS access to your Google account.

Improve this answer
0

Google seems to think they have a solution (though it's not directly linked to the Advanced Protection Common Questions, and doesn't help in the case of Advanced Protection ) - because App Passwords are not available to Advanced Protection users.

All other articles about "Trusted Devices", etc. lead you down a rabbit whole of loops to "Checking Your Security Settings".

Sign in with an Apple Device

App Password unavailable

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .