fido2support

[simon]

@nebulon maybe because you use Linux? Unfortunately, the support there is still very poor, but it looks much better on other devices. https://www.passkeys.io/compatible-devices

[adison]

@simon yeah true

[adisonverlice2]

alright, i'm wondering what improvements have been made sense this topic rolled out.

[sponch]

Looking forward to it

[crazybrad]

@adison +1 for passwordless.dev. Looks really interesting. We have been considering implementing passwordless in one of our applications and their generous user allowance makes a powerful business case. Seems to fit the Cloudron culture as well.

[adisonverlice2]

@crazybrad 1. witch app? and2. that is really coll man. yeah it does. i cant wait to see how this is going to go along with cloudron. not only that, i think it'll give bitwardens passwordless team a head because cloudron is not large, but pretty good in size. if i were you, what i would do is have it to where all the user has to do is give cloudron dashboard the key, then cloudron will do the other stuf unless required on the users end.

[crazybrad]

@adisonverlice2 We have a proprietary application (not hosted on Cloudron). I have considered using Cloudron as the single source of authentication truth, but for various reasons, I will likely not go in that direction.

[adisonverlice2]

@crazybrad i see. that is very cool.

[adisonverlice2]

i just thought of another way to do fido support.
have cloudron users use something like duo security and then login can be done using fido along with other ways cloudron does not natively support.

[adisonverlice2]

by the way, that link was a link from security now, a podcast i regularly listen to.
here is the official duo security address.
my business has used it before, so i think its pretty good at what it does.

[Jarod]

Hey!

Just want to push this. Would be cool to add password less authentication to Cloudron

[brerlapn]

@girish and @nebulon There's another resource like passwordless.dev that is maintained by members of the W3C and FIDO Alliance team that developed passkeys: https://passkeys.dev/ Even if it's tricky to implement passkey support for applications we host in Cloudron, being able to log in to the admin panel with a passkey would be massive as this provides the security of PKI encryption without the overhead nightmare of running a certificate authority.

It includes libraries and guides for thinking through the implementation. Mastodon handles are on the landing page, too, if you have questions. They maintain the site on their own to help orgs looking to adopt passkeys and one of the maintainers is the author of the SimpleWebAuthn (https://github.com/MasterKale/SimpleWebAuthn)

Bitwarden supports passkeys with their iOS mobile app now and in their beta Android app, and 1Password supports them in both mobile apps, so the ecosystem is at a point where there's full cross-platform support (except Linux dammit, but browser-based passkeys will work on Linux) and it's not just iOS or Chrome Password Manager.

[adisonverlice2]

i'm glad i've made this more of a trending topic on the forum.
this should push more support for FIDO in cloudron.

[IniBudi]

Yes, hopefully, this idea can be implemented in the next Cloudron update. I support this FIDO2 WebAuthn so we can log in to 2FA and approve the login process using our phone.

[nostrdev-com]

FID02 would be a great security upgrade

[matix131997]

I did a test today on a laptop running ZorinOS 17.1 with kernel 6.5.

I can confirm the two-way operation of the system using a QR key with Apple iPhone. On the website 'passkeys.io' I was able to write the key as well as read it.

[adisonverlice2]

@matix131997 o cool!

[3246]

To add my 2p to this topic: I currently cannot recommend Cloudron to businesses as OTP is phishable.

My recommendation to clients is usually to go with FIDO hardware keys and/or passkeys - especially for mission-critical stuff, thus I cannot recommend Cloudron because it does not support it

Ref. https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf, https://www.sectigo.com/resource-library/how-phishers-take-your-one-time-passwords, etc

[necrevistonnezr]

@3246 said in fido2support:

To add my 2p to this topic: I currently cannot recommend Cloudron to businesses as OTP is phishable.

That is exaggerated b/s. OTP is still an industry standard and a good balance between security and convenience (important if you want your 3,000 employees to comply with it!). The article argues that since a bad actor may convince you to reveal your OTP in some other channel, it‘s insecure - well, you can hardly get security against stupidity.
And I know many companies who have moved away from hardware keys or cards because of the excessive downtime when users forgot those hardware keys somewhere.

[3246]

Anything that can be phished will be phished. Seriously, though, I just want Cloudron to support better security, and FIDO2 beats OTP. I found getting keys physically or software into users' routines easier than getting OTP codes through apps or (shudder) SMS or Email.

I always try to design for as much stupidity as possible. Users display an amazing capacity for finding ways around security tactics. It's worth making that part of the research during the design phase I think ;-0

What's your experience been?