Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OnlyKey: Open-Source Alternative to YubiKey

onlykey.io

Post reply on HN
Print view View original

81–90 of 215 posts

Re: OnlyKey: Open-Source Alternative to YubiKey

#81

Post by michaelt »

hanniabu wrote: post #60
dehugewe1209 wrote: post #15

Security keys are the heart of security and we desperately need open-source solutions on this. Kudos for doing it. Now, I must point out a few things: 1. Please don't call your solution "Open-source", when you do not have not even the schematics uploaded to github. 2. (this item is an open problem without a solution yet) how do I make sure the source code and the (still missing) hardware information actually correspo…

For #2, it'd be nice if there were kits sold to create your own physical keys. You can flash code from github to it yourself, and then assembly the casing together. Optionally for first line of defense, the assembly could be fastened with some less common like a torx or square screw head and it could come with a pack of small holographic security stickers to place over the screw. Edit: You'd want it to be an unassemb…

There’s the U2F Zero https://github.com/conorpp/u2f-zero/wiki/Building-a-U2F-Toke... but of course there’s always a reflections-on-trusting-trust issue: you’ve got to get your CPU, CPU design, compiler, firmware and chip programmer somewhere!

Of course, an accidental software bug is probably more likely than intentionally backdoored hardware targeting you personally...

Re: OnlyKey: Open-Source Alternative to YubiKey

#82

Post by 91iejrj20310 »

idlewords wrote: post #77
cal5k wrote: post #65

Earlier quoted context omitted.

A lot of services, like GSuite and LastPass, allow you to register multiple hardware keys. The best bet is to register several of them with these sites, then put one or two offsite (e.g. in a safety deposit box) just in case. Then, use GSuite to sign into other services (like Slack) wherever supported to minimize how often you need to do this.

Use TOTP (like Google Authenticator) as a backup method as well. It's helpful for scenarios like having to log in on a phone.

Is Google Authenticator tied to your smartphone, to your account, or a combination of both? Can you transfer it to another smartphone? Is it being backupped automatically?

We're amongst a very technologically educated part of the population here, and honestly, I'm not sure about the scope of Google Authenticator. Quite sure that many aren't.

Re: OnlyKey: Open-Source Alternative to YubiKey

#83

Post by ncmncm »

hanniabu wrote: post #60
dehugewe1209 wrote: post #15

Security keys are the heart of security and we desperately need open-source solutions on this. Kudos for doing it. Now, I must point out a few things: 1. Please don't call your solution "Open-source", when you do not have not even the schematics uploaded to github. 2. (this item is an open problem without a solution yet) how do I make sure the source code and the (still missing) hardware information actually correspo…

For #2, it'd be nice if there were kits sold to create your own physical keys. You can flash code from github to it yourself, and then assembly the casing together. Optionally for first line of defense, the assembly could be fastened with some less common like a torx or square screw head and it could come with a pack of small holographic security stickers to place over the screw. Edit: You'd want it to be an unassemb…

That all sounds to me like security theater. It would not increase my confidence in the device, its firmware, or its design.

Re: OnlyKey: Open-Source Alternative to YubiKey

#84

Post by fauigerzigerk »

idlewords wrote: post #75
fauigerzigerk wrote: post #73

Earlier quoted context omitted.

All depending on the discretion of the various services. Of all the services that force me to use 2FA only a tiny minority provides recovery codes.

What services allow U2F security keys but don't provide single-use recovery codes as backup?

I don't know about U2F specifically, but recovery codes are not generally a feature of 2FA.

Edit: And let me just add why I think this is relevant. Even though few people have dedicated hardware keys today, many 2FA schemes depend on being in possession of a particular phone. There are typically no backups and no recovery codes.

I don't think this would necessarily change if specialised key hardware was used more often. In fact, my business bank account and a broker I previously used both require hardware keys and do not provide recovery codes.

Re: OnlyKey: Open-Source Alternative to YubiKey

#85

Post by prophesi »

91iejrj20310 wrote: post #78
fierarul wrote: post #67

Earlier quoted context omitted.

The way two factor auth works is that you register your hardware key and you also get 10 one-time-usage recovery codes which you can use instead. So, if you lose your YubiKey, you can still login 10 times using a recovery code. Presumably during those 10 times you either disable 2FA or register a new YubiKey.

I guess those recovery codes are the new security questions - yes theoretically they are there to recover your account, but in practice, you won't have them at hand unless you stored them in your password manager.

It's still a little better than security questions in that the layman's recovery codes won't be publicly available or easily guessable personal information.

Re: OnlyKey: Open-Source Alternative to YubiKey

#86

Post by arthurwilliams »

Playa Del Carmen real estate listings by BuyPlaya Realty Advisors-- your one-stop location for finding incredible beachfront properties in the Riviera Maya. We are a family-owned and operated company with more than 13 years experience in this Mexico realty sector. Our specialty is providing professional and expert brokerage services to both investors and getaway property buyers from Canada, the United States, the United Kingdom and worldwide. We are dedicated to helping with the trading of exclusive properties in Playa del Carmen and the Riviera Maya area in Mexico that will never be advertised anywhere except online. Delivering an unmatched level of professionalism and customer service is our supreme goal. Visit https://www.buyplaya.com

Re: OnlyKey: Open-Source Alternative to YubiKey

#87

Post by qertoip »

groby_b wrote: post #55
qertoip wrote: post #52

Trezor T is vastly superior solution for U2F / WebAuthn and also fully open source. The main advantage is super mature backup (Shamir's secret sharing) and PIN-locking with exponential escape. Being a Bitcoin hardware wallet, security is very well tested.

> Being a Bitcoin hardware wallet, security is very well tested Given the history of the cryptocurrency field, A is very far from implying B. And there's at the very least the Ledger analysis[1], which reveals several vulnerabilities. (The core issue for me is the order->backdoor->return issue - it doesn't seem there's a way to verify integrity of device or supply chain) [1] https://www.ledger.com/our-shared-security…

Given the history of reputable Bitcoin hardware wallets, A actually does imply B. Hardware wallets are the only viable way to store cryptocurrency securely, with great track record since inception in 2014.

Regarding the supply chain, there is very little that can be done, and yubikey-like solutions certainly do not excel here. Trezor T at least comes with no firmware (to be installed by the user) and holographic sticker. Basic, but better than Yubikey et al.

Re: OnlyKey: Open-Source Alternative to YubiKey

#88

Post by spockz »

91iejrj20310 wrote: post #82
idlewords wrote: post #77

Earlier quoted context omitted.

Use TOTP (like Google Authenticator) as a backup method as well. It's helpful for scenarios like having to log in on a phone.

Is Google Authenticator tied to your smartphone, to your account, or a combination of both? Can you transfer it to another smartphone? Is it being backupped automatically? We're amongst a very technologically educated part of the population here, and honestly, I'm not sure about the scope of Google Authenticator. Quite sure that many aren't.

With Authy, a Google Authenticator, on iOS the codes are backed up in iCloud and protected with a pass code. I’m not sure whether the pass code is used to actually encrypt things or just as a soft lock.

Re: OnlyKey: Open-Source Alternative to YubiKey

#90

Post by scumbert »

ComodoHacker wrote: post #80

Setting aside problems with this particular device, the whole "trust the open-source hardware" model is inherently flawed. Every useful security hardware will be commoditized, then faked and/or trojaned. We can't take the open-source software approach and rely on many volunteer eyes catching vulnerabilities and backdoors. First, there just aren't enough skilled professionals capable of proper hardware review. And sec…

To do something about this requires supply chain security that you won't find outside governments that are able to realize economies of scale.
Post reply on HN