Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Alternatives to Yubikey?

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 91 posts

Re: Ask HN: Alternatives to Yubikey?

#31

Post by j_s »

voidz wrote: post #23
cafogleman wrote: post #19

I recommend the OnlyKey: https://www.amazon.com/OnlyKey-Color-Password-Manager-Obsole... The device uses strong encryption (where legal), and goes beyond U2F to include password management, certificate storage, OTP/Google Auth, and plausible deniability. The hardware is teensy-based, and the firmware is open source. The devs have released fairly regular updates, and even encourage hacking on it to meet custom needs.

Does not ship to the Netherlands... Meh!

You can buy the international edition with PayPal and re-flash it.

https://crp.to/p/

I am interested to find out more info on the tamper-resistance of the hardware.

Re: Ask HN: Alternatives to Yubikey?

#33

Post by tmikaeld »

dsl wrote: post #11

NitroKey ( https://www.nitrokey.com/ ) is the non-crappy version of YubiKey.

+ It is (fully) open source

- Doesn't support U2F (yet)

- Supports only one password manager [1]

- Recommends using their own password manager (That has a limit of 16 passwords)

[1] https://www.nitrokey.com/documentation/applications#a:passwo...

Re: Ask HN: Alternatives to Yubikey?

#34

Post by funkaster »

cafogleman wrote: post #19

I recommend the OnlyKey: https://www.amazon.com/OnlyKey-Color-Password-Manager-Obsole... The device uses strong encryption (where legal), and goes beyond U2F to include password management, certificate storage, OTP/Google Auth, and plausible deniability. The hardware is teensy-based, and the firmware is open source. The devs have released fairly regular updates, and even encourage hacking on it to meet custom needs.

Thanks! I didn't know about the OnlyKey, being a Teensy fan and looking for a yubikey alternative, this looks really good. I already ordered one :)

Re: Ask HN: Alternatives to Yubikey?

#35

Post by cafogleman »

voidz wrote: post #23
cafogleman wrote: post #19

I recommend the OnlyKey: https://www.amazon.com/OnlyKey-Color-Password-Manager-Obsole... The device uses strong encryption (where legal), and goes beyond U2F to include password management, certificate storage, OTP/Google Auth, and plausible deniability. The hardware is teensy-based, and the firmware is open source. The devs have released fairly regular updates, and even encourage hacking on it to meet custom needs.

Does not ship to the Netherlands... Meh!

They have an international version that does not ship with encryption of the data stored on the device, to deal with the various laws around encryption in other countries. However, there's no hardware difference, and since it's all open-source, there's nothing stopping you from loading the "US" firmware on the "International" version.

More info at their site: https://crp.to/

Re: Ask HN: Alternatives to Yubikey?

#37

Post by travisby »

tmikaeld wrote: post #33
dsl wrote: post #11

NitroKey ( https://www.nitrokey.com/ ) is the non-crappy version of YubiKey.

+ It is (fully) open source - Doesn't support U2F (yet) - Supports only one password manager [1] - Recommends using their own password manager (That has a limit of 16 passwords) [1] https://www.nitrokey.com/documentation/applications#a:passwo...

Unfortunately it's not _fully_ open source. They don't say it anywhere on their webpage, but they use an [OpenPGP Smart Card](https://www.g10code.com/p-card.html) internally, where some of the implementation by ZeitControl isn't open source. g10 has a reference implementation that is fully open source, but there's some additional (timing?) attacks that Zeitcontrol has implemented and cannot release.

Note the NitroKey start is a gnuk implementation and is fully open source. The tamper-resistant models are using the BasicCard with Zeitcontrol software.

Re: Ask HN: Alternatives to Yubikey?

#38

Post by AdmiralAsshat »

rbjorklin wrote: post #36

The DIY open source alternative: https://u2fzero.com/

Is...that...safe?

I'm all for the a DIY solution, but considering how much of a pickle I'd be in if all of my 2FA tokens were inaccessible, wouldn't the average person want some kind of case or shielding around the exposed board?

Give me an enclosure like Samsung's metal flash drives[0], and then I'd be sold.

[0]https://www.amazon.com/Samsung-METAL-Flash-MUF-32BA-AM/dp/B0...

Re: Ask HN: Alternatives to Yubikey?

#39

Post by ams6110 »

cafogleman wrote: post #19

I recommend the OnlyKey: https://www.amazon.com/OnlyKey-Color-Password-Manager-Obsole... The device uses strong encryption (where legal), and goes beyond U2F to include password management, certificate storage, OTP/Google Auth, and plausible deniability. The hardware is teensy-based, and the firmware is open source. The devs have released fairly regular updates, and even encourage hacking on it to meet custom needs.

Given Amazon's problems with counterfeit items, I'm not sure I'd buy something like that from them.

Re: Ask HN: Alternatives to Yubikey?

#40

Post by rbjorklin »

AdmiralAsshat wrote: post #38
rbjorklin wrote: post #36

The DIY open source alternative: https://u2fzero.com/

Is...that...safe? I'm all for the a DIY solution, but considering how much of a pickle I'd be in if all of my 2FA tokens were inaccessible, wouldn't the average person want some kind of case or shielding around the exposed board? Give me an enclosure like Samsung's metal flash drives[0], and then I'd be sold. [0] https://www.amazon.com/Samsung-METAL-Flash-MUF-32BA-AM/dp/B0...

The Github page has this to say: "The token should be durable enough to survive on a key chain for years, even after going through the wash." [0] I'd guess covering it all with hot glue would provide sufficient protection.

[0] https://github.com/conorpp/u2f-zero/

Post reply on HN