Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FIDO2 security key company releases hardware that's open source and uses Rust

solokeys.com

Post reply on HN
Print view View original

121–130 of 160 posts

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#121

Post by upofadown »

nickray wrote: post #56
_abox wrote: post #46

Nice, I'd love this as an open source yubikey replacement. But it doesn't do OpenPGP, I rely on that way too much sadly. Not just for SSH which supports fido2 now but also for file encryption and my password manager. If they add that in the future I might jump ship.

We hope and think that PIV can replace all the practical use cases for PGP. Specifically among those mentioned, `age` for file encryption, and either FIDO resident keys with hmac-secret for password managers, or something like `passage` (fork of `pass` using, again, `age` for encryption). For SSH you can use FIDO for newer OpenSSH, and either `pivy` or `yubikey-agent` via PIV. Cheers!

>`age` for file encryption,

I can't see why one would bother. OpenPGP works and is a published standard that has been around forever. Age is just pointlessly different with fewer use cases. This has an example of where age is objectively worse:

* https://articles.59.ca/doku.php?id=pgpfan:agevspgp

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#122

Post by sneak »

mightybyte wrote: post #55
t0astbread wrote: post #51

As someone who's not familiar with U2F or comparable standards I have a general question about the topic: When registering a key for multiple accounts (at the same site or at different sites) can website owners link those accounts by some common "key ID"? In the sense of: "Oh, this is Bob's key so this account must belong to Bob".

I think that would be the public key. You can roughly think of it as the hardware key has a private key embedded in it in a way that it (supposedly) can't be gotten off. That private key has a corresponding public key. You can think of the private key as the password and the public key as the username. So I think the public key is the "key ID" you're looking for.

This is not how U2F works. The sites never see the device's long-term public key.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#123

Post by brabel »

From the founder of Solo, I assume:

"I've been working on Solo for almost 3 years now. It started back when I was in college and on a whim, ordered a run of 1000 security keys that I designed and then shipped them all to Amazon. "

Hm... not sure I can trust my keys to something developed on a whim by a college student.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#124

Post by an_ko »

brabel wrote: post #123

From the founder of Solo, I assume: "I've been working on Solo for almost 3 years now. It started back when I was in college and on a whim, ordered a run of 1000 security keys that I designed and then shipped them all to Amazon. " Hm... not sure I can trust my keys to something developed on a whim by a college student.

Linux was designed on a whim by a college student.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#125

Post by lucideer »

godelski wrote: post #104
tialaramex wrote: post #43

Earlier quoted context omitted.

> Some sites will allow you to simultaneously enroll two devices, so you can keep one as a backup For WebAuthn (the actual standard for how to do this which is what you should be rolling out if you have a greenfield authentication environment that doesn't already do U2F today) the specification explicitly says: > Relying Parties SHOULD allow and encourage users to register multiple credentials to the same account. Re…

This has been a thing preventing me from getting one. A key that's supposed to be on you (or locked in a vault) is prone to getting destroyed or damaged. So since my threat model isn't high and this would be more a nerd thing, it doesn't seem worth it. 2FA is good enough I guess

Fwiw, I have 3 of these and I have yet to encounter a service that doesn't support all three, so it hasn't been a issue.

People have mentioned AWS IAMS only supports one at a time, but that's definitely "a nerd thing".

The only "normal" user-facing service I've tried with some unnecessary restrictions is actually Twitch (also an Amazon property), so it sounds like Amazon are just specifically bad at this, rather than most companies having bad implementations.

But in general, it's been fine for the vast majority of services.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#126

Post by eeZah7Ux »

eeZah7Ux wrote: post #66

Reminder: FIDO2 is mostly useless if your browser or your OS is compromised. Also if someone hijacks your account using bruteforced recovery codes and/or email. Also if the servers are compromised or account data leaked. In short, it protects from some forms of phishing. (I'm not trying to criticize FIDO2, just pointing out what to expect from it)

A good bunch of downvotes for this? Congratulations HN crowd.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#127

Post by dandanua »

kelnos wrote: post #79
stouset wrote: post #39

Earlier quoted context omitted.

> Some (like Yubico) let you purchase a "cloned" set of devices Wait, they do? How? I would love to do this, but I can't find anything relevant on their website.

After going through their "what do I need?" quiz, it seemed to indicate that was an option. It's possible that I misunderstood, and they just give you two independent keys.

The existence of a cloned physical key is not possible due to FIDO U2F protocol. Every sign operation increases a counter on the device. It's supposed that services will keep track of this counter and don't accept signatures with an incorrect counter (less than known).

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#129

Post by smarx007 »

als0 wrote: post #128

> releases hardware that's open source and uses Rust This is an LPC55S69. So it's open source firmware, not open source hardware.

Arduino is OSHW but its AVR microcontroller isn't, yet we still regard Arduino boards as OSHW. But I see your point that the crucial component of this OSHW key is not OSHW.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#130

Post by chrisdhal »

godelski wrote: post #104
tialaramex wrote: post #43

Earlier quoted context omitted.

> Some sites will allow you to simultaneously enroll two devices, so you can keep one as a backup For WebAuthn (the actual standard for how to do this which is what you should be rolling out if you have a greenfield authentication environment that doesn't already do U2F today) the specification explicitly says: > Relying Parties SHOULD allow and encourage users to register multiple credentials to the same account. Re…

This has been a thing preventing me from getting one. A key that's supposed to be on you (or locked in a vault) is prone to getting destroyed or damaged. So since my threat model isn't high and this would be more a nerd thing, it doesn't seem worth it. 2FA is good enough I guess

I've had a Yubikey for about 3 years that is on my car keys keychain which goes with me everywhere. It's been all over the US and into Costa Rica all in my pocket or haphazardly thrown into my backpack (with a bunch of other random things).

There is zero evidence of any wear or anything. They are meant to be carried around, you don't need to baby them. I'm more worried about it being lost than damaged.

Post reply on HN