Is there any plan to support FIDO2/WebAuthn over Bluetooth on the Trezor Safe 7?
Currently, every WebAuthn authentication requires connecting a USB cable, even though the device already supports Bluetooth for Trezor Suite.
Supporting FIDO2/WebAuthn over Bluetooth would make the Safe 7 much more convenient for daily use as a security key, especially for frequent logins on laptops, tablets, and phones. It would eliminate the need to plug in a cable every time while still requiring on-device confirmation.
Is this feature on the roadmap, or is it not planned?
I think FIDO2/WebAuthn over Bluetooth could also be relevant to a security concept I recently proposed for Trezor, which I called ITAKT (Independent Transaction Authorization Key Technology).
The idea is to use an independent hardware security key as a mandatory authorization layer for transactions, with the authorization cryptographically bound to the exact transaction being signed.
In that context, wireless FIDO2/WebAuthn support could potentially provide a convenient communication channel between the Trezor and an external authorization device, while keeping the authorization key independent from the wallet’s signing key.
Of course, I see Bluetooth/FIDO2 transport and transaction authorization as two separate problems, and I would not want the transport layer itself to become a trusted security boundary.
The key point for ITAKT would be that the authorization must be cryptographically bound to the transaction itself, rather than merely proving that the user possesses a FIDO2 device.
Your proposal therefore caught my attention because FIDO2/WebAuthn support could potentially provide useful infrastructure for something like ITAKT in the future.