Feature Requests

Proposed Features Hardware Key Login Description: Enable FIDO2/U2F hardware keys for 2FA or passwordless login. Implementation: Support YubiKey, Titan, etc., with fallback options (e.g., authenticator codes). Benefits: Phishing-resistant authentication for secure access across platforms. Passkey Authentication Description: Integrate FIDO2 passkeys for passwordless login via hardware keys or device biometrics. Implementation: Support device-native passkeys (e.g., Windows Hello, Face ID) and key-based passkeys. Benefits: Simplifies login while maintaining high security. Encryption Key Management Description: Store XSalsa20 encryption keys on hardware keys for zero-knowledge security. Implementation: Support secure key storage and rotation, with encrypted recovery codes. Benefits: Strengthens encryption by keeping keys off vulnerable devices. Technical Considerations Use FIDO2/U2F standards for compatibility. Ensure cross-platform support (web, desktop, mobile). Protect against key cloning and align with S3Drive’s quantum-resistant encryption. Benefits Phishing-resistant, passwordless authentication. Secure encryption key storage. Alignment with industry trends (e.g., Apple, Microsoft passkeys).

Allow supporting multiple mounts. In such case user could also mix their S3 mounts, with Rclone mounts and managed account (S3Drive) mounts.

Excerpt from Discord: > Thumbnails. Do they ever get deleted? They don't get deleted at the moment. It's actually not that straightforward to delete them reliably, as there are multiple ways app can delete files (sync, mount, delete, delete version, delete using S3 API credentials). We may implement partial deletion in the near future from the app UI, however deletion as a result of mount/sync operation is a long-term goal, as we use internally Rclone which isn't really aware of thumbnails. Discord: https://discordapp.com/channels/1069654792902815845/1395443849173930165

Currently when user uploads files through the mount they don't exactly have clue if file is already uploaded and whether they can safely disconnect the app. This task is do detect pending uploads operation, indicate that by using sync/progress icon in the tray and e.g. Mount settings. When user tries to quit the app, mention that there are pending operations before allowing them to safely quit.

Allow user to store their S3 bucket's configuration encrypted on the S3Drive servers. That way user could synchronize their list of back-ends between devices without manual configuration or JSON export/import. In the future this also would allow to assign company S3 credentials to specific user account and provide it to employee logged in via e-mail/password or SSO.

Files > 100M are uploaded using multipart upload using 5MB chunks. If upload gets interrupted, next time when file gets uploaded we verify MD5 (only if E2E encryption is disabled) of each chunk so it doesn't gets reuploaded. The issues is that MD5 verification is relatively slow. If 10GB file was interrupted at 50%, then it means we need to verify 5GB of data which isn't instant. The idea is to store the file local modification date and trust that file contents hasn't changed if modification date hasn't changed. Using this pattern we could resume upload immediately. We could also resume upload of encrypted files given that we continue uploading chunks using the same nonce prefix (this is safe, because we're not reusing nonce. Yet to be uploaded chunks receive their own nonce counter). Finally implement exponential back-off retry for failed transfers (e.g. 400 bad request, 5xx errors and timeouts).

Internal task to improve robustness of the Transfers tab. Part of this task is to migrate away from Hive and use Isar.

Add support for conflict resolution: --conflict-resolve string Automatically resolve conflicts by preferring the version that is: none, path1, path2, newer, older, larger, smaller (default: none) (default "none")

At the moment when user enables E2E encryption for S3 back-ends (or S3Drive storage) UI updates between devices are encrypted using the user's defined encryption key. Rclone crypt back-end on the other hand, doesn't expose the encrypted data to S3Drive (only decrypted data is shown) and as such S3Drive operates on decrypted data. This could be improved by extracting the encryption passphrase from the user's config, deriving the encryption key and encrypting/decrypting the UI updates on both ends.