181–190 of 215 posts
This thing seems fishy to me. If you want something that is mostly under your control to which you can install open source stuff into then buy some smart cards and card readers e.g. from https://www.javacardsdk.com
Earlier quoted context omitted.
FYI OnlyKey already supports TOTP for up to 24 accounts. No apps required OnlyKey types the 6 digit code for you.
How does it know which OTP to type?
To watch setup videos see https://onlykey.io/watch
Earlier quoted context omitted.
SoloKey doesn't support everything this does. It is primarily a U2F key, and OpenPGP support is still WIP[0] [0]: https://github.com/solokeys/openpgp
Yeah, I've been happy with my SoloKey, but OnlyKey's integration with a software password manager + OpenPGP + SSH keys is really enticing. I'm on the same boat as a lot of others here, however, that the lack of open hardware is a deal breaker.
This thing seems fishy to me. If you want something that is mostly under your control to which you can install open source stuff into then buy some smart cards and card readers e.g. from https://www.javacardsdk.com
Carrying your own smart cards and smart card reader may work for some use cases but I'm sure you can see why a small key attached to your key chain is a better solution in most cases.
I've owned and used an OnlyKey for around a year and a half now and have had a really positive experience using mine. There is one issue, unfortunately the LED lights do not work when the key is plugged into a USB 3 port. The key itself works, but you do not get any LED feedback which can make unlocking and using it a little difficult. Be sure to keep this in mind if you're thinking about purchasing one.
Earlier quoted context omitted.
...there are other 2fa methods that don't disable at least one "personal" factors, whether that's a password or using finger/face/whatever. Not that great against cops, but stands a chance against many abusers, recent exes and terrible flatmates. And the yubikey is, theoretically, worn on you. Are you going to carry around all the printouts?
I'm having a hard time figuring out what kind of scenarios you are securing against. The recovery code, just like the hardware 2fa, does not work unless you know the password. So you want to secure against people that live with you, know your password and from whom you cannot hide anything anywhere? The printout is the size of a business card. You could put it in your Bible as a booksign an nobody would find them. Or…
Also no, you're not genuinely curious, you're trying to waste someone else's time.
Earlier quoted context omitted.
It seems this is literally written in the horrible Arduino "everything in one huge file" style: https://github.com/trustcrypto/OnlyKey-Firmware/blob/master/... The funny thing is they have a "Source code reviewed by Codacy" badge on the readme claiming the code is grade A... but if you actually click through, of course Codacy didn't pick up the .ino file at all, so in fact nothing of substance is being reviewed. That…
I can safely say that a lot of proprietary crypto code (as in, stuff that is in very widespread use and costs $$$) is not unlike this either. In some ways this is actually more straightforward to read and understand since it's in one file and not wrapped in a dozen layers of abstraction.
Earlier quoted context omitted.
> None of this inspires confidence that the code can be trusted. It's a shame this code isn't so good out of the box, but for all we know there are proprietary devices purporting to do the same job which also have poor code. The difference between the devices is we can review, edit/improve, share, and run the improved code for this device. The software freedom is a feature unto itself. So one is still better off with…
You have no access to hardware schematics. You have no idea what hardware defects are present that may compromise security no matter how much code you write. FLOSS means shit here.
Earlier quoted context omitted.
You might want to check out this - https://docs.crp.to/security.html#cryptographically-secure-r... If you read further into the source you will see that analog read is only one of the sources of entropy, it uses capacitive touch from a user's skin and this TRNG passed dieharder tests - https://webhome.phy.duke.edu/~rgb/General/dieharder.php
According to the K2x family guide, some devices have an hardware RNG available -- is it right this project uses a K20 without this? It seems pretty bad that merely grounding 8 pins on this device will reduces its entropy to basically to a handful of noise bits from the ADC?
https://docs.crp.to/security.html#cryptographically-secure-r...
Open source is the only way to security in most cases.
Most of the security benefits come from giving the vendor an incentive to update their software quickly. I've often seen proprietary companies delay security critical patches until the next release or sue well meaning people who are reporting vulnerabilities (to the companies) as hackers to hide evidence of vulnerabilities. There is a reason why so many vulnerabilities are found and reported in Linux compared to e.g.…
Good point that the security of FLOSS stems from the culture surrounding FLOSS...