Ask HN: What do you think about the Secalot hardware token?

#1

Post by pablo1 » Thu, Jan 10, 2019, 1:09 PM UTC

Comparing open source security tokens/OTP generators/UFA tokens/PGP Smartcards, it seems the product from secalot has the most features for a similar price as the alternatives. It also has open source software and hardware.

https://www.secalot.com/

Has anybody tried it and can compare it to more popular alternatives like the yubikey or the nitrokey?

How would you rate this from a security aspect?

Re: Ask HN: What do you think about the Secalot hardware token?

#2

Post by jans23 » Fri, Jan 11, 2019, 8:18 AM UTC

From the security point of view the most obvious difference to me is that Nitrokey contains a secure element while Secalot doesn't. (Secalot contains a microprocessor with cryptographic acceleration but don't confuse this with a secure element.) Secure elements are secure key stores which protect against extraction of cryptographic keys by malware and by physical attackers.

Also Secalot seems to be a small project while Nitrokey is a (small) company, which might influence quality of security and maintenance too.

Disclaimer: I'm with Nitrokey UG.

Re: Ask HN: What do you think about the Secalot hardware token?

#3

Post by pablo1 » Sat, Jan 12, 2019, 4:08 PM UTC

jans23 wrote: post #2

From the security point of view the most obvious difference to me is that Nitrokey contains a secure element while Secalot doesn't. (Secalot contains a microprocessor with cryptographic acceleration but don't confuse this with a secure element.) Secure elements are secure key stores which protect against extraction of cryptographic keys by malware and by physical attackers. Also Secalot seems to be a small project wh…

Interesting. That is a definitive plus for Nitrokey indeed. I wonder if they plan on creating a version that supports PGP and U2F.

I really like the Nitrokey pro version, it is pretty much everything I need except for the U2F.

Re: Ask HN: What do you think about the Secalot hardware token?

#4

Post by jans23 » Sun, Jan 13, 2019, 10:22 AM UTC

pablo1 wrote: post #3

jans23 wrote: post #2

From the security point of view the most obvious difference to me is that Nitrokey contains a secure element while Secalot doesn't. (Secalot contains a microprocessor with cryptographic acceleration but don't confuse this with a secure element.) Secure elements are secure key stores which protect against extraction of cryptographic keys by malware and by physical attackers. Also Secalot seems to be a small project wh…

Interesting. That is a definitive plus for Nitrokey indeed. I wonder if they plan on creating a version that supports PGP and U2F. I really like the Nitrokey pro version, it is pretty much everything I need except for the U2F.

Yes, a Nitrokey with OpenPGP Card and FIDO is planned. You can get notified directly by subscribing its newsletter at https://www.nitrokey.com/newsletter

Re: Ask HN: What do you think about the Secalot hardware token?

#5

Post by pablo1 » Wed, Jan 16, 2019, 11:31 AM UTC

jans23 wrote: post #4

pablo1 wrote: post #3

Earlier quoted context omitted.

Interesting. That is a definitive plus for Nitrokey indeed. I wonder if they plan on creating a version that supports PGP and U2F. I really like the Nitrokey pro version, it is pretty much everything I need except for the U2F.

Yes, a Nitrokey with OpenPGP Card and FIDO is planned. You can get notified directly by subscribing its newsletter at https://www.nitrokey.com/newsletter

Any planned realease date? I'm considering waiting for the release of it.