11–20 of 47 posts
That's great to see that this is going kickstarter, I'll throw in something for a solo key later. Seems this is also a lot cheaper than a yubikey while also being fairly hackable. Great job <3
That's great to see that this is going kickstarter, I'll throw in something for a solo key later. Seems this is also a lot cheaper than a yubikey while also being fairly hackable. Great job <3
I don't see any mention of smartcard/PGP features (or rsa4096), which makes this a non-starter for me. Sometimes the extra cost is associated with extra features.
1. Is there anything in the standard about proving to the server that you have a genuine FIDO device that meets certain standards, and not say a piece of software that is merely pretending to be a hardware security module? If so, I presume the Solo will come with whatever certification / digital signature is required?
2. My understanding of FIDO (v1) is that the only function a device has to offer is authentication through digital signature, so a FIDO v1 device is no use as an extra authentication factor to unlock a password manager without "cloud" support (such as pwsafe) as it doesn't provide you with anything that a hacker couldn't work around - as opposed to a token that stores a cryptographic key and releases it when you press the button (which you can set up a yubikey to do). Is this correct, and does FIDO2 change this situation?
Does the 'solo tap' require additional software on an Android device? For example, would this work with LineageOS or does it require some google blob crap?
FIDO2 is standardized and backward compatible with U2F, so any browser (or app) with this support should work. Specifically, they should support CTAP1/2 over NFC (or USB). I asked in the team, we're not really familiar with LineageOS, but we'll try to do some tests.
Looks awesome. One thing though regarding iOS - I hope Apple don't just open up NFC more, but implement FIDO2 (CTAP2 and Webauthn) utilizing the secure enclave on the device with Face ID. I don't know enough about it, but surely it should be possible and it would make for a great user experience if they did!
Looks like NFC support may be coming as well https://bugs.webkit.org/show_bug.cgi?id=188624
I'm not sure how much I like an open source security appliance coming with a "hidden surprise".
Why would I choose this over the Yubikey, or even Google's offering? And I didn't see on the kickstarter (I may have missed it), where are these being produced? I know people were not interested in Google's because they were being made in China.
I'm 5/5 happy with my current yubikeys, but I'm also really glad that there's competition in this area and not a monoculture.
If any FIDO experts are reading this, two technical questions: 1. Is there anything in the standard about proving to the server that you have a genuine FIDO device that meets certain standards, and not say a piece of software that is merely pretending to be a hardware security module? If so, I presume the Solo will come with whatever certification / digital signature is required? 2. My understanding of FIDO (v1) is t…