Viewing profile — cr7pt0

Make sure you read down on this thread https://news.ycombinator.com/item?id=21884184 there is a lot of misinformation in the top posts that are completely debunked if you read down…

The only service I have seen that only allows Yubikeys so far is Vanguard.

I think the whole attestation thing is generally a terrible idea. It's not impossible to extract data from secure hardware, right now there is not a lot of incentive to do it becau…

Yes software authenticators that use a security key for OTP are a good option. This is what Yubikey does with the Yubikey Authenticator. As with most security things there are trad…

There are tokens that support this. OnlyKey has a secure backup feature where you can have an encrypted backup file. If you lose your physical key you would just load the backup fi…

If you are looking for a solution that supports FIDO2 and also functions as a hardware password manager (lots of sites still don't even support security keys) check out OnlyKey - h…

Here is the long answer to the comment provided above, as mentioned there its probably easier to take a look at the video first, the blue arrow in the video points to the values th…

Sure thing. Thanks for reviewing the code, we are always happy to get additional eyes on it. For your major bug I have to disagree about the major part, the RNG works well but yes …

I wanted to make sure I clearly address these comments, one of the issues in reading a post like this in an online thread is the most upvoted post can also be the most incorrect, a…

Yes, OnlyKey appears to the computer/mobile device as a keyboard. That is why it works on all computers and even iPhone/Android with an adapter available in our store - https://onl…

Yes it uses the K20, I think you may be confusing the threat model here. If you grounded the 6 capacitive touch buttons the device would not work at all so there would be no need f…

This is incorrect, a schematic only shows what electronics should contain. It doesn't provide any proof of what hardware actually contains. For that the best way to verify is to vi…

Definitely true, anyone who has ever seen proprietary crypto code knows this. Reviewing one file that is 7000 lines long is more straight forward than reviewing 7000 lines of code …

Sorry to hear that you had issues with the LED. We did receive reports of some user's having issue with LEDs on some computers years back. With the latest OnlyKey hardware there ha…

Just wondering, what additional security would you expect from open hardware vs. open software with transparently designed hardware? From a threat modeling perspective it seems tha…

You load the login data to your key using the app, press a button on your OnlyKey and it types any or all of the following: -URL to login page -Username -Password -TOTP To watch se…

Carrying your own smart cards and smart card reader may work for some use cases but I'm sure you can see why a small key attached to your key chain is a better solution in most cas…

It can only store up to 2 passwords, OnlyKey stores 24. For full comparison see https://crp.to/p

The delay is 0-2 + 0-2 so yes combining six possible values for a possible delay up to 4ms. The delay inside of an RNG loop obviously does not expose entropy to timing analysis, it…

The .ino file is included in Codacy review and receives a grade of A. You can find that here - https://app.codacy.com/manual/onlykey/OnlyKey-Firmware/dashb... All libraries are inc…

This is an interesting question. I would like to see more discussion like this in the security community. Of course this question should be proceeded by the question of what actual…

Thanks I guess... We always review PRs

It's interesting that Trezor and Solo are mentioned here. We specifically with OnlyKey decided not to go with an STM chip like the ones used in these devices due to the vulnerabili…

This backup you speak of is also a feature of OnlyKey. By using a passphrase you can securely backup your OnlyKey. If you lose the key you can just restore from backup to a new key…

FYI OnlyKey already supports TOTP for up to 24 accounts. No apps required OnlyKey types the 6 digit code for you.