Can't login on mobile if the account has a USB security key

What happened?

When trying to login I am asked to use my usb security key and not given an option to type in a one-time pass. Clicking the "Enter the One-Time Password" text does nothing and I couldn't scroll down to view any input field that may exist.

What did you expect to happen?

A field for typing in a one-time pass should always be available, even if the account has a USB key registered.

Version

2025.3.0-dev

What type of issue is this?

Client-side

What browser are you using? (Client-side issues only)

Firefox Fennec

What operating system are you using? (Client-side issues only)

Android

Contribution Guidelines

By submitting this issue, you agree to follow our Contribution Guidelines

• I agree to follow this project's Contribution Guidelines
• I have searched the issue tracker for similar issues, and this is not a duplicate.

Just looked into how MK coded the TOTP option in that dialog to work and it seems like somehow they expected someone to still try with a key first before unlocking that option 😕

Of course this wouldn't be an issue for people that got security keys that also support NFC, for people that have security keys with a USB-C plug instead of a USB-A plug or for people who use the built-in passkey feature from apps like Google Password Manager (and Apple's equivalent)

I can see why they did this since normally if you can't use a passkey to login on some sites they don't even give you an option for TOTP at all and you just lose your account if you lose the passkey (hence all the warnings sites/manufacturers tend to give) and this is simply done from a security perspective.

But considering that MK added an TOTP option for failed passkey logins I don't really see why it should be locked till that happens.

Do you think we can just like, add a little "verify with authenticator app instead" link/button that skips ahead to the TOTP route?

one possibility would be to add a new prompt (like how passkey, totp and etc is) that would show the option to choose between passkey or totp instead of the current:

1. user logins
2. the login check goes through what is enabled using the highest security standard by default
3. changes to that prompt

the other and more easier option would be to just remove the disabled property from the button/text on the passkey prompt.

I have thought about this some more and I think showing the auth options after clicking login is more practical when a user has TOTP and Passkey setup than having it be only that small text.

Especially since this would be more familiar to some other sites login flow

added bugfrontend label

added from-upstream label