Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Alternatives to Yubikey?

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 91 posts

Re: Ask HN: Alternatives to Yubikey?

#21

Post by Nexxxeh »

captainmuon wrote: post #6

While we're at it, is there one that: - Lets me store certificates and PGP keys - Has two factor authentication (U2F) - Has open hard and software (source-available) Basically, a USB pen drive that allows U2F, and is can be made read only (either by a switch or only writable over a special interface). I don't really need tamper-resistance, pre-generated keys, smart cards or any other advanced features.

Boot time and physical size might prove to make it unwieldy, but could you use a Pi Zero in a gadget mode with OTG?

You can have it emulate USB HID, so presumably U2F would be workable, and it'll do USB Mass Storage too.

Open hardware and software.

Re: Ask HN: Alternatives to Yubikey?

#22

Post by drdaeman »

Nexxxeh wrote: post #21
captainmuon wrote: post #6

While we're at it, is there one that: - Lets me store certificates and PGP keys - Has two factor authentication (U2F) - Has open hard and software (source-available) Basically, a USB pen drive that allows U2F, and is can be made read only (either by a switch or only writable over a special interface). I don't really need tamper-resistance, pre-generated keys, smart cards or any other advanced features.

Boot time and physical size might prove to make it unwieldy, but could you use a Pi Zero in a gadget mode with OTG? You can have it emulate USB HID, so presumably U2F would be workable, and it'll do USB Mass Storage too. Open hardware and software.

Unless you install some TPM module, RPi itself has no tamper-resistant storage and has DFU (so, basically plug it into a wrong device and it'll be able to run arbitrary code, pulling all secrets).

An FST-01 is a somewhat better choice, but Gnuk doesn't implement U2F. If someone has enough time and knowledge I don't see why it won't be possible to add it, though.

Re: Ask HN: Alternatives to Yubikey?

#23

Post by voidz »

cafogleman wrote: post #19

I recommend the OnlyKey: https://www.amazon.com/OnlyKey-Color-Password-Manager-Obsole... The device uses strong encryption (where legal), and goes beyond U2F to include password management, certificate storage, OTP/Google Auth, and plausible deniability. The hardware is teensy-based, and the firmware is open source. The devs have released fairly regular updates, and even encourage hacking on it to meet custom needs.

Does not ship to the Netherlands... Meh!

Re: Ask HN: Alternatives to Yubikey?

#24

Post by tptacek »

drdaeman wrote: post #20
tptacek wrote: post #17

It's worth considering: almost nobody who uses Yubikeys loves them, but they are by a wide margin the tokens experts recommend most.

There was a series of changes, e.g. regarding platform keys, software source availability etc etc. I think there were some "I don't endorse this anymore" posts, although I don't really remember the details.

I've read "I don't endorse this" from open source advocates, but none from crypto engineers.

Re: Ask HN: Alternatives to Yubikey?

#25

Post by j_s »

This came up last week on the OpenPGP discussion; here's a re-post -- no one else has mentioned the sc4-hsm yet. https://news.ycombinator.com/item?id=14495213

Open source (-ish?) Yubikey alternatives

https://sc4.us/hsm/ $75 | https://news.ycombinator.com/item?id=12053181

https://trezor.io/ $99 | https://news.ycombinator.com/item?id=10795087 (not much on HN)

https://www.floss-shop.de/en/security-privacy/smartcards/13/... €16.40 (OpenPGP Smart Card v2.1; 4096-bit keys)

https://www.fidesmo.com/fidesmo/about/privacy-card/ €15 (NFC only; recommended by the terminated SIGILANCE OpenPGP Smart Card project; 2048-bit keys)

Re: Ask HN: Alternatives to Yubikey?

#26

Post by tptacek »

api wrote: post #18
tptacek wrote: post #17

It's worth considering: almost nobody who uses Yubikeys loves them, but they are by a wide margin the tokens experts recommend most.

The problem is largely with their docs, or lack thereof. Just figuring out how to use one as a token for ssh is incredibly painful. The docs are very "enterprise," meaning half-done, overly complicated, confusing, scattered, etc.

It is extraordinarily annoying to set up a Y4 for SSH. We use gpg-agent in ssh-agent compat mode.

Re: Ask HN: Alternatives to Yubikey?

#27

Post by noja »

j_s wrote: post #25

This came up last week on the OpenPGP discussion; here's a re-post -- no one else has mentioned the sc4-hsm yet. https://news.ycombinator.com/item?id=14495213 Open source (-ish?) Yubikey alternatives https://sc4.us/hsm/ $75 | https://news.ycombinator.com/item?id=12053181 https://trezor.io/ $99 | https://news.ycombinator.com/item?id=10795087 (not much on HN) https://www.floss-shop.de/en/security-privacy/smartcards/13/…

Fixed link: https://www.floss-shop.de/en/security-privacy/smartcards/13/...

Re: Ask HN: Alternatives to Yubikey?

#28

Post by MichaelGG »

j_s wrote: post #25

This came up last week on the OpenPGP discussion; here's a re-post -- no one else has mentioned the sc4-hsm yet. https://news.ycombinator.com/item?id=14495213 Open source (-ish?) Yubikey alternatives https://sc4.us/hsm/ $75 | https://news.ycombinator.com/item?id=12053181 https://trezor.io/ $99 | https://news.ycombinator.com/item?id=10795087 (not much on HN) https://www.floss-shop.de/en/security-privacy/smartcards/13/…

It's a bit offputting that the SC4 calls itself a "hardware-secure module" which seems to be a unique term (vs hardware security module).

Re: Ask HN: Alternatives to Yubikey?

#29

Post by captainmuon »

epistasis wrote: post #16
captainmuon wrote: post #6

While we're at it, is there one that: - Lets me store certificates and PGP keys - Has two factor authentication (U2F) - Has open hard and software (source-available) Basically, a USB pen drive that allows U2F, and is can be made read only (either by a switch or only writable over a special interface). I don't really need tamper-resistance, pre-generated keys, smart cards or any other advanced features.

The difficulty with PGP keys, is that the most common implementation, GPG, wants complete control of the device and does not let it be shared so that other interfaces, like PKCS# can be used. So if you want something for both GPG and other purposes, it really needs to present as two separate devices, or you need to go hacking a branch of GPG. When I looked into doing this, it seemed that upstream would not be interes…

Huh, interesting. I didn't even know GPG could handle devices as such. I was just looking for a device that holds my key files (like for email, ssh, ...). Would of course be great if you could hand the device some plaintext and it would encrypt it without the key leaving it, but I didn't even think about that to be honest. But it makes sense :-).
Post reply on HN