Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Alternatives to Yubikey?

news.ycombinator.com

Post reply on HN
Print view View original

81–90 of 91 posts

Re: Ask HN: Alternatives to Yubikey?

#81

Post by erik998 »

Not exactly Yubikey but USB Armory has some close features:

https://www.crowdsupply.com/inverse-path/usb-armory

The following example security application ideas illustrate the flexibility of the USB Armory concept:

    mass storage device with advanced features such as automatic encryption, virus scanning, host authentication and data self-destruct
    OpenSSH client and agent for untrusted hosts (e.g Internet kiosks)
    router for end-to-end VPN tunnelling
    Tor bridge [see this, for example]
    password manager with integrated web server
    electronic wallet [the Electrum Bitcoin wallet works out of the box on the USB Armory. It has been tested with X11 forwarding from Linux as well as Windows hosts.]
    authentication token
    portable penetration testing platform
    low level USB security testing

Re: Ask HN: Alternatives to Yubikey?

#82

Post by lisper »

chaz6 wrote: post #77
lisper wrote: post #42

https://sc4.us/hsm It's fully open-source, but the only standard application currently supported is U2F. Disclosure: this is my product.

FYI your website is blocked by my work proxy:- Access Denied (content_filter_denied) Your request was denied because of its content categorization: "Placeholders"

Very sorry about that, but I have no idea what I can do about it. The page is not a placeholder. It's a very generic Bootstrap page with real content.

Re: Ask HN: Alternatives to Yubikey?

#83

Post by roman_zeyde »

epistasis wrote: post #16
captainmuon wrote: post #6

While we're at it, is there one that: - Lets me store certificates and PGP keys - Has two factor authentication (U2F) - Has open hard and software (source-available) Basically, a USB pen drive that allows U2F, and is can be made read only (either by a switch or only writable over a special interface). I don't really need tamper-resistance, pre-generated keys, smart cards or any other advanced features.

The difficulty with PGP keys, is that the most common implementation, GPG, wants complete control of the device and does not let it be shared so that other interfaces, like PKCS# can be used. So if you want something for both GPG and other purposes, it really needs to present as two separate devices, or you need to go hacking a branch of GPG. When I looked into doing this, it seemed that upstream would not be interes…

I can suggest using TREZOR and Ledger Nano S hardware devices for common GnuPG operations, e.g. signatures and decryption.

Please take a look at https://github.com/romanz/trezor-agent/blob/master/README-GP... for more details.

Disclosure: I am the main developer of this project.

Re: Ask HN: Alternatives to Yubikey?

#84

Post by Nexxxeh »

drdaeman wrote: post #22
Nexxxeh wrote: post #21

Earlier quoted context omitted.

Boot time and physical size might prove to make it unwieldy, but could you use a Pi Zero in a gadget mode with OTG? You can have it emulate USB HID, so presumably U2F would be workable, and it'll do USB Mass Storage too. Open hardware and software.

Unless you install some TPM module, RPi itself has no tamper-resistant storage and has DFU (so, basically plug it into a wrong device and it'll be able to run arbitrary code, pulling all secrets). An FST-01 is a somewhat better choice, but Gnuk doesn't implement U2F. If someone has enough time and knowledge I don't see why it won't be possible to add it, though.

Parent-poster said tamper-resistance wasn't an issue in their usage case.

But are you sure it'll DFU over USB?

If so, for avoiding DFU, could you use some simple hardware to disable the data lines on the OTG port until the Pi had finished booting?

Could one use an i2c or spi based crypto chip for key storage?

Re: Ask HN: Alternatives to Yubikey?

#86

Post by akulbe »

tptacek wrote: post #46
dkhenry wrote: post #44

Earlier quoted context omitted.

I use my yubikey and I love it. I have it set up to do GPG, SSH, TOTP, and U2F and it works great. It is worlds better then any other Smart Card or second factor out there, and U2F is literally just plug it in and tap it.

The U2F bit is a dream, yes. The rest of it not so much.

What do you recommend?

Re: Ask HN: Alternatives to Yubikey?

#87

Post by drdaeman »

Nexxxeh wrote: post #84
drdaeman wrote: post #22

Earlier quoted context omitted.

Unless you install some TPM module, RPi itself has no tamper-resistant storage and has DFU (so, basically plug it into a wrong device and it'll be able to run arbitrary code, pulling all secrets). An FST-01 is a somewhat better choice, but Gnuk doesn't implement U2F. If someone has enough time and knowledge I don't see why it won't be possible to add it, though.

Parent-poster said tamper-resistance wasn't an issue in their usage case. But are you sure it'll DFU over USB? If so, for avoiding DFU, could you use some simple hardware to disable the data lines on the OTG port until the Pi had finished booting? Could one use an i2c or spi based crypto chip for key storage?

Actually, no. I think I have confused RPi with some other board.

Don't have Pi at hand to test for sure, but searching online can't find mentions of USB DFU. I think I may be mistaken.

Re: Ask HN: Alternatives to Yubikey?

#88

Post by pgeorgi »

zurn wrote: post #71
pgeorgi wrote: post #45

Earlier quoted context omitted.

SecurID is just an expensive TOTP implementation (although a very established one, as you noted) That "gold standard" required reissuing 40 millions of devices in 2011 due to a single server breach. Lockheed-Martin was apparently really, really happy about it, too. If that's your desired level of security, just use any TOTP authenticator app on your smartphone.

Smartphones are insecure unless you can control all your users have new Apple phones. The problem with many affordable TOTP tokens is clock drift. Are RSA's tokens better with that?

Was there a practical attack on TOTP on smartphones that affected 40M users and spilled industrial secrets? SecurID managed to hit both of these.

Re: Ask HN: Alternatives to Yubikey?

#89

Post by jans23 »

dchest wrote: post #53
dsl wrote: post #11

NitroKey ( https://www.nitrokey.com/ ) is the non-crappy version of YubiKey.

I have two of their U2F and if the OP's problem is sales and support, I'm not really sure Nitrokey are without issues as well: 1) Ordered 2, received 1. Thankfully, support quickly sent the second one once I wrote to them. 2) Now they only work when I plug something else to another port to my Mac (no such problem with Yubikey). No reply since April 29: https://support.nitrokey.com/t/nitrokey-u2f-issues-in-macos-... E…

Feedback from Nitrokey (I'm working with them):

1) We are changing our warehouse process, adding a technical QA step, so that such mistakes won't happen anymore. Sorry for the trouble.

2) As you noticed, the former U2F is going to be replaced by a new FIDO U2F device which contains a full USB plug for better reliability, is more durable and has a touch button.

Re: Ask HN: Alternatives to Yubikey?

#90

Post by dchest »

jans23 wrote: post #89
dchest wrote: post #53

Earlier quoted context omitted.

I have two of their U2F and if the OP's problem is sales and support, I'm not really sure Nitrokey are without issues as well: 1) Ordered 2, received 1. Thankfully, support quickly sent the second one once I wrote to them. 2) Now they only work when I plug something else to another port to my Mac (no such problem with Yubikey). No reply since April 29: https://support.nitrokey.com/t/nitrokey-u2f-issues-in-macos-... E…

Feedback from Nitrokey (I'm working with them): 1) We are changing our warehouse process, adding a technical QA step, so that such mistakes won't happen anymore. Sorry for the trouble. 2) As you noticed, the former U2F is going to be replaced by a new FIDO U2F device which contains a full USB plug for better reliability, is more durable and has a touch button.

Great, thank you!
Post reply on HN