Should Keyroost incorporate a password vault, or allow you to unlock/launch your preferred password vault using a FIDO2 key?

[framefilter]

Caveat: I haven't actually looked into how feasible this would be (most likely i'd be incorporating code from another open source project, not building a password vault from scratch), so I don't know if it's even possible.

My feeling on this is no, it should not because I built it to be a manager app/cli for hardware security tokens and that would take focus away from the project. But I did find @token2's t2vault recently and thought the concept was exactly in the spirit of what I want: make hardware security keys more USEFUL and integrated into everyday life. The privacy and security "platform" is a big tent, and I personally believe every human being belongs in it. While I think keyroost is better positioned as a focused hardware security peripheral manager, I did want to put the idea out there as the community thus far has been very kind. To the degree that I can achieve it, I want this project to be what the users want it to be.

[token2]

We were actually considering submitting that code to Keyroost (since it is written in Rust and uses almost the same crates), but that raises the question of whether Keyroost stays a management tool - essentially a tool to manage the hardware, rather than a tool to “use” the hardware.

T2Vault is a PoC and could be scrapped and integrated into Keyroost if the community decides so, but the “toolchain” concept dilemma remains.

[framefilter]

I really like the idea of a hardware security key controlled password vault, and I definitely prefer a vendor neutral implementation. It's what I want too. But it would be a big change to start adding "use" in with "manage." I know Yubico is set to release a whole new set of features with their latest firmware, I need to get ahold of other vendors' hardware, etc etc. But it seems worth discussing with the users and other contributors before making that decision without community input.

[token2]

Yubico’s next firmware (5.8) is mainly aimed at supporting CTAP 2.3, which depends on browser implementations (notably payment confirmation and autofill/passkey enhancements). From a management perspective, not much will change. Token2 is also working in the same direction, but this is not something coming very soon—certainly not this year :)

A password vault is still just a password vault—Bitwarden supports this as a product feature, so it is an implementation choice rather than a management tool.

Ideally, you’d want something combining hmac-secret with largeBlob, but even then you’re limited to under 1 KB of storage, which isn’t enough for a full password manager.

[framefilter]

Good to know on CTAP 2.3, thanks. I've actually roadmapped what you're talking about (hmac-secret with largeBlob) for keyroost as part of my "let users decide what to do with largeBlob" sidequest. I'm hoping to have it released soon, but so far all I've got built is "read what's actually in the largeBlob" plus your contributions so far. I was planning on "marketing" it as a place to store recovery keys moreso than a vault, given the limited size. I'm barely past the brainstorming phase on that front, to be honest.

An actual proper resident password vault on a security key would be pretty neat to see someday. I was never able to get ahold of a mooltipass (not exactly what we're talking about, but somewhat similar), but the concept interested me. Having never used one, no idea if they were actually a good product that made users more secure though.