Asked for OATH password on Android?

[blogdemoi]

Asked for OATH password on Android?

[dainnilsson]

This sounds more like something for Yubico customer support, but I'll see if I can help.

This app should only prompt you for an OATH password if one is set. Note that the app (including the desktop version) supports "remembering" this password which would explain why you're not prompted for the password on desktop each time. If you open the desktop app and go into the OATH settings menu (top right of the Authenticator view), there should be a menu entry with either the text "Set password" or "Manage password", depending on if you have a password set or not. You can use this to confirm whether or not you have one set. This menu will also allow you to remove or change the password, though only after entering the correct password.

I believe KeypassXC supports several mechanisms for using a YubiKey, but the more commonly used one uses the slot based challenge-response mode, which isn't part of OATH at all, which would explain why you can use it without providing the OATH password. When you say you use the YubiKey to log into various websites, are you actually using OATH for that (6-8 digit time sensitive codes) or are you using something like FIDO/WebAuthn? If it's the latter, this is again not using OATH, and would not require your OATH password.

[dainnilsson]

Closing due to inactivity and more information required. Feel free to post more info and we'll re-open it!