What's coming in 9.1

[nebulon]

We have finally implemented Passkey support. Will be part of 9.1 then

[Teiluj]

Any chance to have some VPN per App or S3-as-a-service in there as well?

[nostrdev]

@nebulon what about FIDO2 or WebAuthN?

[jdaviescoates]

@nostrdev said in What's coming in 9.1:

@nebulon what about FIDO2

I think that's already done

[joseph]

FIDO2 is the broad name of the standard. passkeys is the (marketing) name of the FIDO2 "key" . WebAuthn is the standard for server to browser/client communication and is part of FIDO2. That is my understanding.

[nostrdev]

so long as we can use an external signing device (like Trezor), and not trust some foreign spyware company like Google or Microsoft or Apple, that would be great.

[james]

Hello @nostrdev
We have tested the passkey support with the Bitwarden browser extension, YubiKey 5, Nitrokey and native support from some browsers and operating systems like Windows, Apple and Linux.
Please note, we implemented passkey support and not the full WebAuthn/FIDO2 specification available options.

[nebulon]

To support passkey login via the cloudron cli, we will move to oidc login for the cli in 9.1

Basically the cli will open a browser window to login and obtain an access token. For everyone using the cli in some automated pipeline, one can still use it with a pre-obtained api key from the dashboard.

[girish]

said in What's coming in 9.1:

Improved progress reporting - show percentage complete and elapsed/estimated time for backups and app installations.
Convert backup site creation dialog to a view

Save these two, other features are implemented. Work has started on getting 9.1 release out.

[nostrdev]

@james

Using Bitwarden means keeping your secret on a potentially compromised device. Better to use a hardware key.

The problem with both Yubikey and Nitrokey is that if you lose the device, you lose the key. Big problem.

The fact you cannot recover a passkey, make those devices a pass, from us. Or at least, they must be used in a far more careful and limited fashion - ie, fallback to email recovery - than what would otherwise be the case (sovereign recovery).

With Trezor - and other hardware wallets that use deterministic webAuthN - you can recover from a seed. This means that the loss of a device is not catastrophic.

EDIT: Am reading the Trezor forums and apparently they do support Passkeys, it's just that the Resident Key is encrypted with the seed, and not deterministically generated. So for recovery, you just back up the file using regular cloud storage.

Looking forward to testing it on cloudron, and letting you all know the results.

https://trezor.io/guides/bonus-tools/what-is-fido2