Using Chrome to Enroll Fingerprints
Set a PIN and enroll the first fingerprint using the Chrome browser on a macOS, Linux or Chrome OS device. To enroll more fingerprints use the Chrome settings as described in Enrolling Additional Fingerprints.
A YubiKey Bio is a FIDO2 hardware authenticator. Both Windows and Mac have built-in FIDO2 authenticators - i.e., software authenticators that in this case are also platform authenticators. The prompts in both Windows and Mac might assume you will be using their own authenticators. Therefore it is quite easy to register their authenticators with a site or service by mistake, without realizing that you are not registering your YubiKey. Read the prompts carefully to avoid this. And remember that the PIN is associated with the authenticator, not the site or service.
Although there are two FIDO applications on the YubiKey Bio, namely FIDO2 and U2F, it is the FIDO2 PIN that is required as fallback for both. The PIN is not associated with any site. When the fingerprint does not work and the key falls back to the PIN, it is the key that needs the PIN for authentication to all sites, including U2F sites (even though U2F has no concept of PIN). With fallback to PIN, it is easy if the user is authenticating to a WebAuthn/FIDO2 site, because the browser/client app can prompt for the PIN. Otherwise the user must unblock biometrics by using either:
- The YubiKey Bio start page
- Yubico Authenticator for Desktop.
Enrolling the First Fingerprint
Use an up-to-date Chrome browser to open the YubiKey Bio Series setup website. Insert your YubiKey Bio into your computer.
Scroll down to the green button, Enroll using Chrome, and click it. The Use your security key with Yubico.com popup appears, taking you through the PIN setup (if no PIN is set) and later the fingerprint enrollment:
If the amber LED flashes slowly, it means that either no fingerprint is enrolled or biometrics is blocked. If you have reason to believe biometrics is blocked, go to the appropriate link on the YubiKey Bio Series setup page or to Troubleshooting and Tools. Otherwise, touch the key:
If no PIN is set, set one by entering at least 4 digits, then confirming this PIN by re-entering it. If the YubiKey Bio already has a PIN set you are prompted to enter it.
When prompted, touch the fingerprint sensor and the bezel. You are prompted to touch the sensor several times, as set out below. Change the angle of finger to sensor slightly each time.
Continue lifting and re-applying the same finger until the gray circle is entirely blue, the fingerprint icon is replaced by a tick mark, and the message in the popup reads “Your fingerprint was captured.”
Click Next. The Touch your security key again to complete the request popup appears:
Touch the bezel and sensor one last time. The final popup announces that enrollment was successful. The YubiKey Bio now has a template for that fingerprint.
Enrolling Additional Fingerprints
If the YubiKey Bio already has fingerprint(s) enrolled on it, repeating the procedure for the first fingerprint does not work for subsequent fingerprints. Instead follow these steps.
You can also use this method for setting a PIN for a new YubiKey Bio and enrolling all fingerprints.
|Step 1:||Either paste
|Step 2:||Click Fingerprints and follow the instructions in the popup.|
To get in touch with Yubico Support, click here.