Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OnlyKey: Open-Source Alternative to YubiKey

onlykey.io

Post reply on HN
Print view View original

161–170 of 215 posts

Re: OnlyKey: Open-Source Alternative to YubiKey

#161

Post by thinkloop »

delfinom wrote: post #130
cr7pt0 wrote: post #25

Earlier quoted context omitted.

It is open source, not to be confused with open hardware which it is not. The hardware is transparent, literally, it has a clear protective coating on the hardware which allows visually verifying everything. For security things check out https://docs.crp.to/security.html - TL;DR Before you enter the PIN its not doing any crypto which means lots of side-channel attacks don't apply, you would have to know the PIN to ev…

> The hardware is transparent, literally, it has a clear protective coating on the hardware which allows visually verifying everything Right and that's bullshit. How do I know you aren't embedding a advanced joule thiefing silicon die disguised as a pull-up resistor to manipulate usb communication or even interface with the micro in a backdoor?

I don't think humanity has been able to solve that problem. There's isn't an md5 checksum for hardware yet.

Re: OnlyKey: Open-Source Alternative to YubiKey

#162

Post by stinos »

jandeboevrie wrote: post #21

The only true open hardware and open source key is the Nitrokey Start, running Gnuk firmware. Other nitrokeys are open hardware but run a smartcard (hsm or pgpcard) and those firmwares are not fully open. Yubikey is closed source and this posts bugger is closed as well. Go for a Nitrokey if you value true openness.

It's indeed rather 'open'.. https://old.reddit.com/r/crypto/comments/bis3pf/extract_pgp_...

Kidding aside: I'm sure there are many more prodcuts having problems like this. Just goes to show there's no such thing as 100% secure I guess. At least this is open so can be fixed with some effort.

Re: OnlyKey: Open-Source Alternative to YubiKey

#163

Post by fierarul »

LaGrange wrote: post #108
fierarul wrote: post #101

Earlier quoted context omitted.

The whole idea of having a hardware token is to separate what's at hand. Having the recovery codes in the password manager seems like a bad idea. Google recommends printing them.

...oh yes, having your passwords printed out is such a great improvement. Considering how likely the "hacker" is to be a person sharing your household, you might as well put them on a post-it note and stick them to the screen. Recovery codes go straight into the password manager, right next to my mother's maiden name, ASuTeil7quoongak2aeniVar.

Nonsense, the household hacker can also find your YubiKey. Much easier than a single piece of paper.

Re: OnlyKey: Open-Source Alternative to YubiKey

#164

Post by jandeboevrie »

stinos wrote: post #162
jandeboevrie wrote: post #21

The only true open hardware and open source key is the Nitrokey Start, running Gnuk firmware. Other nitrokeys are open hardware but run a smartcard (hsm or pgpcard) and those firmwares are not fully open. Yubikey is closed source and this posts bugger is closed as well. Go for a Nitrokey if you value true openness.

It's indeed rather 'open'.. https://old.reddit.com/r/crypto/comments/bis3pf/extract_pgp_... Kidding aside: I'm sure there are many more prodcuts having problems like this. Just goes to show there's no such thing as 100% secure I guess. At least this is open so can be fixed with some effort.

The Nitrokey HSM also has sort of a private key extraction, but that is by design: https://raymii.org/s/articles/Decrypt_NitroKey_HSM_or_SmartC...

Re: OnlyKey: Open-Source Alternative to YubiKey

#165

Post by dbrgn »

91iejrj20310 wrote: post #82
idlewords wrote: post #77

Earlier quoted context omitted.

Use TOTP (like Google Authenticator) as a backup method as well. It's helpful for scenarios like having to log in on a phone.

Is Google Authenticator tied to your smartphone, to your account, or a combination of both? Can you transfer it to another smartphone? Is it being backupped automatically? We're amongst a very technologically educated part of the population here, and honestly, I'm not sure about the scope of Google Authenticator. Quite sure that many aren't.

Google Authenticator implements TOTP, which is actually a very simple standard: https://pthree.org/2014/04/15/time-based-one-time-passwords-...

If you can extract the private key, you can transfer it to another phone or device.

On Android, AndOTP is open source (available on F-Droid) and allows encrypted backups. As for Google Authenticator, I don't think you can create backups.

Re: OnlyKey: Open-Source Alternative to YubiKey

#166

Post by LaGrange »

fierarul wrote: post #163
LaGrange wrote: post #108

Earlier quoted context omitted.

...oh yes, having your passwords printed out is such a great improvement. Considering how likely the "hacker" is to be a person sharing your household, you might as well put them on a post-it note and stick them to the screen. Recovery codes go straight into the password manager, right next to my mother's maiden name, ASuTeil7quoongak2aeniVar.

Nonsense, the household hacker can also find your YubiKey. Much easier than a single piece of paper.

...there are other 2fa methods that don't disable at least one "personal" factors, whether that's a password or using finger/face/whatever. Not that great against cops, but stands a chance against many abusers, recent exes and terrible flatmates. And the yubikey is, theoretically, worn on you. Are you going to carry around all the printouts?

Re: OnlyKey: Open-Source Alternative to YubiKey

#167

Post by microtonal »

omgbear wrote: post #37
jandeboevrie wrote: post #21

The only true open hardware and open source key is the Nitrokey Start, running Gnuk firmware. Other nitrokeys are open hardware but run a smartcard (hsm or pgpcard) and those firmwares are not fully open. Yubikey is closed source and this posts bugger is closed as well. Go for a Nitrokey if you value true openness.

I've had a great experience with my NitroKey Starts. I'm just bummed that opensc doesn't yet support ed25519 since it seems gnuk does.

I am not sure I follow? I have been using NitroKey Starts with ed25519 and GnuPG for two years without problems?

The NitroKey Start is great! I have switched to YubiKeys, since they are more durable and also support U2F/Fido2 and PIV on the same token. But NitroKey's software being open source and upgradable are great features.

Note that gnuk also works on Blue Pills. So, if a NitroKey is too expensive for you, you can pick up a couple of Blue Pills for a few dollars and flash gnuk on them. [1]

[1] https://blog.dan.drown.org/gnuk-open-source-gpg-ssh-hardware...

Re: OnlyKey: Open-Source Alternative to YubiKey

#168

Post by idlewords »

cr7pt0 wrote: post #145
idlewords wrote: post #77

Earlier quoted context omitted.

Use TOTP (like Google Authenticator) as a backup method as well. It's helpful for scenarios like having to log in on a phone.

FYI OnlyKey already supports TOTP for up to 24 accounts. No apps required OnlyKey types the 6 digit code for you.

You need it for when you lose the key.

Re: OnlyKey: Open-Source Alternative to YubiKey

#169

Post by fierarul »

LaGrange wrote: post #166
fierarul wrote: post #163

Earlier quoted context omitted.

Nonsense, the household hacker can also find your YubiKey. Much easier than a single piece of paper.

...there are other 2fa methods that don't disable at least one "personal" factors, whether that's a password or using finger/face/whatever. Not that great against cops, but stands a chance against many abusers, recent exes and terrible flatmates. And the yubikey is, theoretically, worn on you. Are you going to carry around all the printouts?

I'm having a hard time figuring out what kind of scenarios you are securing against.

The recovery code, just like the hardware 2fa, does not work unless you know the password. So you want to secure against people that live with you, know your password and from whom you cannot hide anything anywhere?

The printout is the size of a business card. You could put it in your Bible as a booksign an nobody would find them. Or if you want you could rot13 them or something basic so they can't be used as-is.

Actually, what are you suggesting instead? I'm genuinely curious what flawless solution you found.

Re: OnlyKey: Open-Source Alternative to YubiKey

#170

Post by stuntkite »

devinl wrote: post #11

This seems to predate FIDO2. https://solokeys.com/ would be a better option if you prefer separate keys for each site (via FIDO2) and open source hardware.

I've got a few SoloKey. This project seems like a joke comparatively as solo is actually open source hardware[0] and this is not. You can look above to see how OnlyKey might be more trouble on the software side than it's worth and potentially is just a liability.

[0] https://github.com/solokeys/solo-hw

Post reply on HN