Hardware security keys (e.g., Yubikeys) do work fully on GrapheneOS with zero Google Play Services. Authnkey, a handy little app that you can install from F-Droid, implements CTAP2 directly instead of going through Google's FIDO library.
My example: YubiKey 5C NFC over NFC only (my USB port is dead), Pixel 7a, Play-free profile:
- Pocket ID passkey login, PIN prompted and accepted over NFC
- Bitwarden WebAuthn 2FA, both web vault and native app
The community guidance still says sandboxed Play is required for
security keys, and that PIN over NFC needs USB. Neither holds if you skip Google's FIDO library. My key is firmware 5.4.3, so CTAP2.0. Found that you don't even need a 2.1 key for the PIN case.
f-droid.org/packages/pl.lebihan.authnkey
David Pinkerton
dave@dpinkerton.com
npub1jz0r...aju6
Systems thinking applied to servers, sats, and sets. CTO building self-hosted infrastructure and Bitcoin systems.
We're not paranoid enough! Roll those dice. Flip those coins.
I got my music tutor to accept Bitcoin payment a while back. That was with Muun. I thought that I was helping to nudge him onto Breez but regretted it today when he couldn't send me an invoice. Any had the same problem?


Agents easily shop at Bitrefill. 👀


The quantum threat to Bitcoin is invisible, remote, and unverifiable. This is the exact pattern Patrick Moore identified for scare stories that thrive on information asymmetry.
We're at ~1,500 qubits. You'd need millions. The gap is enormous. The headlines skip that part.
David Pinkerton
Quantum FUD Is a Fake Invisible Catastrophe
Patrick Moore’s 2021 book Fake Invisible Catastrophes and Threats of Doom makes a simple observation: most modern scare stories are built on phen...