Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FIDO2 security key company releases hardware that's open source and uses Rust

solokeys.com

Post reply on HN
Print view View original

101–110 of 160 posts

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#101

Post by motiejus »

nickray wrote: post #56
_abox wrote: post #46

Nice, I'd love this as an open source yubikey replacement. But it doesn't do OpenPGP, I rely on that way too much sadly. Not just for SSH which supports fido2 now but also for file encryption and my password manager. If they add that in the future I might jump ship.

We hope and think that PIV can replace all the practical use cases for PGP. Specifically among those mentioned, `age` for file encryption, and either FIDO resident keys with hmac-secret for password managers, or something like `passage` (fork of `pass` using, again, `age` for encryption). For SSH you can use FIDO for newer OpenSSH, and either `pivy` or `yubikey-agent` via PIV. Cheers!

Anything similar to https://github.com/drduh/YubiKey-Guide for what you have just described?

I am willing to use what I can understand, backup and operate, and yubikey+gpg seems to be it because of this guide.

Anything practical for what you've mentioned?

Edit: for ssh and encryption.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#103

Post by andrewwebber »

kelnos wrote: post #31
l0b0 wrote: post #11

As someone who is comfortable with TOTP but hasn't tried FIDO-/Yubikey-style devices, I have a few questions: - Are drivers for this already installed as part of desktop Ubuntu 20.10/Windows 10? Any driver installation will absolutely make this a no-go for family members. - Is additional software required for anything non-techies might reasonably want to do with this device, including resetting it, adding an entry or…

Others have answered most of your questions, but there's something I think deserves emphasizing: In general, you cannot (by design) back up these devices; if you could, that would defeat a lot of the security they provide. That means that if you lose it, you will have to find a way to get 2FA disabled for each and every account you enabled it for. Some orgs will have pretty onerous (but necessary!) processes for doin…

Looking at you AWS cloud.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#104

Post by godelski »

tialaramex wrote: post #43
kelnos wrote: post #31

Earlier quoted context omitted.

Others have answered most of your questions, but there's something I think deserves emphasizing: In general, you cannot (by design) back up these devices; if you could, that would defeat a lot of the security they provide. That means that if you lose it, you will have to find a way to get 2FA disabled for each and every account you enabled it for. Some orgs will have pretty onerous (but necessary!) processes for doin…

> Some sites will allow you to simultaneously enroll two devices, so you can keep one as a backup For WebAuthn (the actual standard for how to do this which is what you should be rolling out if you have a greenfield authentication environment that doesn't already do U2F today) the specification explicitly says: > Relying Parties SHOULD allow and encourage users to register multiple credentials to the same account. Re…

This has been a thing preventing me from getting one. A key that's supposed to be on you (or locked in a vault) is prone to getting destroyed or damaged.

So since my threat model isn't high and this would be more a nerd thing, it doesn't seem worth it. 2FA is good enough I guess

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#105

Post by gorgoiler »

In life, every so often one hears of a concept that is so simple and so elegant that the fact that one had not heard of it before today makes one’s jaw drop in disbelief:

> Reversible USB-A. Well this maybe wasn't the most critical feature anyone expected, but, consequence of our new PCB & case combined construction, it was easy to make USB-A reversible. So why not!

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#107

Post by mNovak »

gorgoiler wrote: post #105

In life, every so often one hears of a concept that is so simple and so elegant that the fact that one had not heard of it before today makes one’s jaw drop in disbelief: > Reversible USB-A. Well this maybe wasn't the most critical feature anyone expected, but, consequence of our new PCB & case combined construction, it was easy to make USB-A reversible. So why not!

I'm more impressed by the cavity PCB construction--fill with epoxy and boom dead simple waterproofing! I've never encountered this before; wonder if it's available with the batch fabs.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#108

Post by riedel »

l0b0 wrote: post #11

As someone who is comfortable with TOTP but hasn't tried FIDO-/Yubikey-style devices, I have a few questions: - Are drivers for this already installed as part of desktop Ubuntu 20.10/Windows 10? Any driver installation will absolutely make this a no-go for family members. - Is additional software required for anything non-techies might reasonably want to do with this device, including resetting it, adding an entry or…

A comment towards Windows10. You actually only would need HID support, but Windows takes over control over fido2 to hide it behind the Windows Hello webauthn API for non elevated users. This makes crossplatform implementations terrible. I own a solo somu and it has much less value due to this on Windows. It really discouraged me to put any more work into fido2 implementations. I started a keepassxc integration, which actually worked well based on the HMAC extension. If anyone from Microsoft reads this: please allow hackers to set a security policy to allow non elevated fido access! Otherwise the devices are great!

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#109

Post by SecurityLagoon »

mNovak wrote: post #107
gorgoiler wrote: post #105

In life, every so often one hears of a concept that is so simple and so elegant that the fact that one had not heard of it before today makes one’s jaw drop in disbelief: > Reversible USB-A. Well this maybe wasn't the most critical feature anyone expected, but, consequence of our new PCB & case combined construction, it was easy to make USB-A reversible. So why not!

I'm more impressed by the cavity PCB construction--fill with epoxy and boom dead simple waterproofing! I've never encountered this before; wonder if it's available with the batch fabs.

Pretty common in ruggedized devices. Has the benefit of keeping components stuck down under vibration and tamper evident too.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#110

Post by jononor »

mNovak wrote: post #107
gorgoiler wrote: post #105

In life, every so often one hears of a concept that is so simple and so elegant that the fact that one had not heard of it before today makes one’s jaw drop in disbelief: > Reversible USB-A. Well this maybe wasn't the most critical feature anyone expected, but, consequence of our new PCB & case combined construction, it was easy to make USB-A reversible. So why not!

I'm more impressed by the cavity PCB construction--fill with epoxy and boom dead simple waterproofing! I've never encountered this before; wonder if it's available with the batch fabs.

The technique is called "potting", and is common for small rugged devices. I think nearly all assembly houses will offer it. Some electronics components, such as relays, power converter modules also use it.
Post reply on HN