Extension no longer working for me

[rezin23]

The "I tried" test

• Auto 2FA is up-to-date on my machine
• There aren't any other open issues that talk about my issue
• I know the basics of how this extension works (see the tutorial)

Body

Hello, I received an email from my IT department stating the following:

"Your current version of the Duo mobile application will stop working between now and April 15. Please update the Duo Mobile app now to avoid losing access to resources."

The extension has indeed stopped working. Obviously, my IT department is not aware that I'm using this extension for 2FA.

As far as I'm aware, I am on the most current version of the extension. Below is a screenshot of the error that I'm getting.

Any help is appreciated immensely.

Thank you so much!

[FreshSupaSulley]

Delete the device in settings, and recreate it. Please return to this issue and let me know if it works for you.

We issued a patch a while ago that increments the build version for NEW devices. Old devices aren't "updated", you just have to create new ones.

[rezin23]

Yep, I tried that last night, and just tried again right now. When I'm on the QR page the extension is not recognizing the QR, I also tried the manual activation code, and that did not work as well. To be clear, I deleted the device both from the extension as well as my works DUO page.

Your help is super appreciated!

[FreshSupaSulley]

hmmm... I assume the extension is updated? What browser do you use?

As far as I'm aware, I am on the most current version of the extension

Could you double check for me? Open chrome://extensions and looking at the version of Auto 2FA. It should say 1.6.4. If it is up-to-date, I'll definitely have some reverse-engineering to do

[rezin23]

Confirmed, 1.6.4. Thank you so much for the help! This is by far my most used and loved extension.

[FreshSupaSulley]

Alright... if you're on the latest version I'll need to reverse-engineer what the mobile app currently does and why it doesn't work for you. I can't provide you with a timeline on when I figure this out, but it definitely won't be patched for at least a few days.

Because I can't reproduce the problem on my end (OSU seemingly has looser security restrictions than your organization), I'm going to need you to eventually load a development version of the extension to try it out yourself. I'll provide those details when I have something to test.

Thank you for your patience!

[FreshSupaSulley]

TL;DR

Try loading Auto 2FA as an unpacked extension and adding a device, I naively updated the app version to the latest one (which is only months ahead of what we've been using). Worked for me, but at the end of the day, I don't know what the problem is. If it worked, please tell me!

Info dump

Upon booting up an old Android device in the simulator and inspecting the network traffic, I did discover the presence of some new(? not sure when this was added) parameters that hint at device attestation. Basically that means the server is checking the integrity of the device and it's really obnoxious to work around.

POST request of /v2/activation in the latest version (only 2 builds ahead of what we're currently using in the extension)

Duo Mobile /activation (POST) URL as of 4/19/26: https://api-de8c7017.duosecurity.com/push/v2/activation/e40kc3v9h1SwVTf5k9UZ?customer_protocol=1

Headers:
Accept-Encoding: gzip
Connection: Keep-Alive
Content-Length: 4486
Content-Type: application/x-www-form-urlencoded
Host: api-de8c7017.duosecurity.com
User-Agent: DuoMobileApp/4.110.0 (Android 13; sdk_gphone64_x86_64) okhttp3/4.12.0

URL encoded params:
pubkey=-----BEGIN%20PUBLIC%20KEY-----%0AMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuyiEiBEzMBv3u0wmy0cS%0AN1SxFCQ6uSBaqZ5bxnl2%2F2yDrodApa4ujwurzR659ShV5CKaaVahdnVGrAVzV6E%2F%0AXTjk2eIjCSRy%2FzLQQLJeZp5QXDgYrDT3PufohCf0s7BiJTaDBiOcmGrZ3F%2BpzF5B%0AnF2ZRr7ZGULIy%2FClTcOv2VBPzBxdaxO3L6yV7c%2B%2BWY8zr4%2FOps2ix8om%2BlAVnCuw%0AUhZSCroL0NAQm8oLMj0VUoZZUyNdoIyQRLCsQt2aNCFxtgx%2B5sjrbAL7yHXi%2BtjN%0AIOS0Qnrm9kRPIFMFrd6HnqnXmZr3kH4oakd4uJjAR8vITW2d35n%2BtHSL1h13KUa8%0A5QIDAQAB%0A-----END%20PUBLIC%20KEY-----%0A&pkpush=rsa-sha512&attestation_challenge_set=true&key_attestation_cert_chain_information=%5B%0A%20%20%22MIIDjTCCAzOgAwIBAgIBATAKBggqhkjOPQQDAjA5MQwwCgYDVQQKEwNURUUxKTAnBgNVBAMTIGZiZWQ4MGUzZDJiZmVlNTExMzVlMzIyMjg2NjY3MzZjMB4XDTcwMDEwMTAwMDAwMFoXDTQ4MDEwMTAwMDAwMFowHzEdMBsGA1UEAxMUQW5kcm9pZCBLZXlzdG9yZSBLZXkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC7KISIETMwG%2Fe7TCbLRxI3VLEUJDq5IFqpnlvGeXb%2FbIOuh0Clri6PC6vNHrn1KFXkIpppVqF2dUasBXNXoT9dOOTZ4iMJJHL%2FMtBAsl5mnlBcOBisNPc%2B5%2BiEJ%2FSzsGIlNoMGI5yYatncX6nMXkGcXZlGvtkZQsjL8KVNw6%2FZUE%2FMHF1rE7cvrJXtz75ZjzOvj86mzaLHyib6UBWcK7BSFlIKugvQ0BCbygsyPRVShllTI12gjJBEsKxC3Zo0IXG2DH7myOtsAvvIdeL62M0g5LRCeub2RE8gUwWt3oeeqdeZmveQfihqR3i4mMBHy8hNbZ3fmf60dIvWHXcpRrzlAgMBAAGjggF5MIIBdTAOBgNVHQ8BAf8EBAMCBLAwggFhBgorBgEEAdZ5AgERBIIBUTCCAU0CAgDICgEAAgIAyAoBAAQkOWFmYzllNGYtOTBiYS00NDFmLTgyNDQtNzAwNzNlZWE5MDgwBAAwggERoQgxBgIBAQIBAqIDAgEBowQCAggApQgxBgIBBAIBBqYLMQkCAQECAQMCAQW%2FgUgFAgMBAAG%2Fg3cCBQC%2FhT0IAgYBnadhp0O%2FhT4DAgEAv4VATDBKBCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEBAAoBAgQgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC%2FhUEFAgMB%2B9C%2FhUIFAgMDFeO%2FhUVMBEowSDEiMCAEGWNvbS5kdW9zZWN1cml0eS5kdW9tb2JpbGUCAz62sDEiBCC%2BWqilQ26ZcSHl5V5Mp%2BBHhEiICRS5%2BUwkLF5P2%2BjYmL%2BFTgMCAQC%2FhU8GAgQBNIytMAAwCgYIKoZIzj0EAwIDSAAwRQIgR6gCQ2Cv6d3YsQhSMSeJKNR0bffmvcPuzTeJqpEMXd0CIQC5skHSZLR4E%2BBq5A7okEt%2FQbPYP3XLnDKvrUsvcSOKTw%5Cu003d%5Cu003d%22%2C%0A%20%20%22MIIB7zCCAZWgAwIBAgIRAPvtgOPSv%2B5RE14yIoZmc2wwCgYIKoZIzj0EAwIwQTElMCMGA1UEAxMcRHJvaWQgVW5yZWdpc3RlcmVkIERldmljZSBDQTEYMBYGA1UEChMPR29vZ2xlIFRlc3QgTExDMB4XDTI2MDQxNTIxNDI1OVoXDTI2MDUwMTIxNDI1OVowOTEMMAoGA1UEChMDVEVFMSkwJwYDVQQDEyBmYmVkODBlM2QyYmZlZTUxMTM1ZTMyMjI4NjY2NzM2YzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABFErNSNvHnM%2BBdh6Prdaq0DTODhQ8c4VbwbqHXe2xvM9GF89z6Y7h5wP9JUsL7gVSt%2Bsj5X%2B6FLenTCOcwxLqg2jdjB0MB0GA1UdDgQWBBSGb21TbYtmSe8tc7%2BABX9BIMf1SjAfBgNVHSMEGDAWgBTH7lDp%2BKj6stGKC82m%2F5YFJFzvQjAPBgNVHRMBAf8EBTADAQH%2FMA4GA1UdDwEB%2FwQEAwICBDARBgorBgEEAdZ5AgEeBAOhAQgwCgYIKoZIzj0EAwIDSAAwRQIhANkP10y2uLhJEZ4Qm28n6tiOq0SXoEz5EJ5gGNa5fWDyAiBMHBMjt1JgwHqxZJkWUkcogITVmVHgh7e0hJ3lvjBAyA%5Cu003d%5Cu003d%22%2C%0A%20%20%22MIIB%2BDCCAZ2gAwIBAgIRAIcYc5H1G4mzMK9wlg7P8qswCgYIKoZIzj0EAwIwQTElMCMGA1UEAxMcRHJvaWQgVW5yZWdpc3RlcmVkIERldmljZSBDQTEYMBYGA1UEChMPR29vZ2xlIFRlc3QgTExDMB4XDTI2MDQxNTEzNDEzMFoXDTI2MDYyNjEzNDEzMFowQTElMCMGA1UEAxMcRHJvaWQgVW5yZWdpc3RlcmVkIERldmljZSBDQTEYMBYGA1UEChMPR29vZ2xlIFRlc3QgTExDMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEx5MD3wx%2FjnnjAFO8WtZddQOI5vEr5I3v71VhoyCAaJC2N6eerYm%2FUCP3hewFgDOmAF%2F%2FT53h4BmjQX64sUTsjaN2MHQwHQYDVR0OBBYEFMfuUOn4qPqy0YoLzab%2FlgUkXO9CMB8GA1UdIwQYMBaAFMfuUOn4qPqy0YoLzab%2FlgUkXO9CMA8GA1UdEwEB%2FwQFMAMBAf8wDgYDVR0PAQH%2FBAQDAgIEMBEGCisGAQQB1nkCAR4EA6EBADAKBggqhkjOPQQDAgNJADBGAiEAyBSLvlr8pJ2aM2XKk%2B7WQZzWIwgi5PVgjQ8U%2BqmVznMCIQD1jqhtBtaDV16gGyaKMs6ZDQo%2BGkpsEiSllKgPevGGDQ%5Cu003d%5Cu003d%22%0A%5D&hsm_status=true&token=GCM%3AfryEPcaMSn6sUwcVIixqbz%3AAPA91bHl6xChDbKkGoT8bsr67H_aNIl17jTmEviuQ2S6fGaRcfD4oCKQ4mjvg1ciDirPhIe6DeTUzdN9LgEFaoI7HZSSebxon9EJdAJc231W9GB7ZSuaZXU&in_work_profile=false&app_install_id=999f5587-65fb-4663-bd9f-f3bb62648da2&app_version=4.110.0&ble_status=undetermined&security_patch_level=2022-11-05&language=en&ble_sharing_disallowed_by_work_profile=false&platform=Android&supports_strong_box=false&manufacturer=Google&fips_available_during_backup=unknown&passcode_status=false&bluetooth_attempt_timeout=10.0&full_disk_encryption=true&model=sdk_gphone64_x86_64&install_source=com.uptodown&app_id=com.duosecurity.duomobile&architecture=x86_64&supports_wifi_aware=false&restore_duration=unknown&ble_disallowed_by_work_profile=false&using_auto_time=true&has_duo_wear=false&jailbroken=false&platform_authenticator_available=false&version=13&has_wearable=false&days_since_last_system_backup_attempt=unknown&encrypted_system_backup_available=unknown&ble_config_disallowed_by_work_profile=false&fcm_token_days_since_creation=0&app_build_number=4110000&play_services_available=true&touchid_status=false&region=US

I highly doubt your organization is disallowing 4.108.0 because it's "too old" (it's not). Maybe they're enforcing always using the latest Duo app version in which case the head of the repo could resolve your issue. It could be that organization's can opt-into checking device integrity? It could be a multitude of things that's wrong. But I encourage you to reverse-engineering the protocol yourself to see what's up, I just can't do this for you.

Wish you the best of luck.

[rezin23]

Thank you so much for your help with this. Based on the communication I've received from my IT department it seems like the reason it stopped working was because the "app" wasn't on the latest version. Perhaps future versions of the extension will work? I am not a technical person, what do you mean when you say "the head of the repo could resolve your issue"?

[FreshSupaSulley]

"the head of the repo could resolve your issue" = the most recent code could resolve your issue.

Seems you're not a very technical person and that's ok! What you're going to have to do to test if the code works for you is to load Auto 2FA as an unpacked extension, which requires you build the project yourself. I built it for you here (this is for Chromium). Let me know if you need any help.