Release notes unclear which credentials are erased, and in the future, there should be a mechanism to repair credentials rather than wiping them.

[adryd325]

Hi,

I'm mildly frustrated with the update system. The updates release notes aren't clear which credentials get invalidated. Authenticator is a very vague term. Is it FIDO2 credentials? TOTP Authenticator credentials? or everything.

It's also frustrating because I chose to either live with bugs, or have to spend an hour reenrolling everything. If possible future releases should try to update data structures rather than destroy everything, as otherwise it makes it difficult to recommend the solo2 to friends.

[nickray]

I updated the release notes https://github.com/solokeys/solo2/releases/tag/2.964.0.
Also added a link to an associated discussion #129 in the new releases category.

It is "just" the FIDO credentials that are affected, not the TOTP credentials.

Understood that this is frustrating, and we envision such breaking releases to be very rare. In this case, the bug was so severe (and not clear from the CTAP spec) that for many/most users, the device did not work at all, hence while we tried to be backwards compatible, this did not work this time. Looking forward, we now (assume to) have a solid base, with no backwards-compatibility "hacks" in the shared FIDO authenticator library.

[needs-coffee]

While I agree that this should have been clearer at the point the update was released - which is now fixed in the release notes - sometimes breaking changes can/must happen as pointed out by @nickray.