Google Titan Security Key

I assume this project was spun-off from Project Vault, or at least they re-used some of the ideas/code from that, but it's still a shame we won't be getting the microSD "HSM" anymore. I guess that idea died when Google and other manufacturers decided to kill support for microSD in their devices altogether.

https://techcrunch.com/2015/05/29/googles-project-vault-is-a...

This is Yubico's response to the Titan Key announcement, if you care to read it:

https://www.yubico.com/2018/07/the-key-to-trust/

Re: Google Titan Security Key

#5

Post by lodyb » Thu, Jul 26, 2018, 9:15 AM UTC

They need to do better at explaining what this is.

Is it a physical device like in the pictures, or a piece of software? It does not make it clear. I can make a best guess, but from this landing page it is uncertain.

Re: Google Titan Security Key

#6

Post by ckocagil » Thu, Jul 26, 2018, 9:21 AM UTC

lodyb wrote: post #5

They need to do better at explaining what this is. Is it a physical device like in the pictures, or a piece of software? It does not make it clear. I can make a best guess, but from this landing page it is uncertain.

My understanding is that it's a FIDO U2F key, like the ones from Yubico.

Re: Google Titan Security Key

#7

Post by gonvaled » Thu, Jul 26, 2018, 9:24 AM UTC

mtgx wrote: post #4

I think Google uses this same Titan chip for it: https://cloudplatform.googleblog.com/2017/08/Titan-in-depth-... I'm not sure if this is the "hardware security module" they've been touting for Pixel 2 devices, too. I assume this project was spun-off from Project Vault, or at least they re-used some of the ideas/code from that, but it's still a shame we won't be getting the microSD "HSM" anymore. I guess that idea die…

regarding yubico: they talk open, global standards, but then say security can only be met by producing in the USA (and Sweden!).

Why should I trust USA produced products?

Re: Google Titan Security Key

#8

Post by aichi » Thu, Jul 26, 2018, 9:27 AM UTC

Why Google 'sell' this as an advantage over 2FA over mobile phone? In this case it works on computer only, or you have to be at some computer, with mobile app, you can be anywhere? I see that as huge disadvantage.

Re: Google Titan Security Key

#9

Post by simias » Thu, Jul 26, 2018, 9:28 AM UTC

ckocagil wrote: post #6

lodyb wrote: post #5

They need to do better at explaining what this is. Is it a physical device like in the pictures, or a piece of software? It does not make it clear. I can make a best guess, but from this landing page it is uncertain.

My understanding is that it's a FIDO U2F key, like the ones from Yubico.

Judging by the drawings it looks exactly like a yubikey[1]. Did they partner in some way or did they just use the same design?

[1] https://www.yubico.com/wp-content/uploads/2015/12/YubiKey-4-...

Re: Google Titan Security Key

#10

Post by caiob » Thu, Jul 26, 2018, 9:28 AM UTC

lodyb wrote: post #5

They need to do better at explaining what this is. Is it a physical device like in the pictures, or a piece of software? It does not make it clear. I can make a best guess, but from this landing page it is uncertain.

Funny how this climbed to the top on HN, without anyone knowing what this is exactly.