Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FIDO2 security key company releases hardware that's open source and uses Rust

solokeys.com

Post reply on HN
Print view View original

131–140 of 160 posts

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#131

Post by leipert »

brabel wrote: post #123

From the founder of Solo, I assume: "I've been working on Solo for almost 3 years now. It started back when I was in college and on a whim, ordered a run of 1000 security keys that I designed and then shipped them all to Amazon. " Hm... not sure I can trust my keys to something developed on a whim by a college student.

That’s why it is open source. Both hardware and software. You should be able to trust it more than some closed source version because you (or someone else) could verify the security more easily.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#132

Post by nickray »

als0 wrote: post #128

> releases hardware that's open source and uses Rust This is an LPC55S69. So it's open source firmware, not open source hardware.

I see your point too, and we're looking forward to a world in which low-power (to enable NFC) open source chips with security features exist. For instance, https://tropicsquare.com is a project that is working towards that.

For now, what we mean by open source hardware is on the one hand that all components are freely available (without NDAs, which nearly all secure elements entail), and on the other that the schematic of the device is open source and passes OSHWA Certification (the CERN license https://ohwr.org/project/cernohl/wikis/Documents/CERN-OHL-ve... is relevant here). This means that you can in principle build a device yourself. The certification will be done post-campaign (we want to avoid copycat products appearing before ours is available in the open market). Like we did with our three previous keys (e.g., https://certification.oshwa.org/us000155.html and https://github.com/solokeys/solo-hw).

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#133

Post by GekkePrutser »

nickray wrote: post #56
_abox wrote: post #46

Nice, I'd love this as an open source yubikey replacement. But it doesn't do OpenPGP, I rely on that way too much sadly. Not just for SSH which supports fido2 now but also for file encryption and my password manager. If they add that in the future I might jump ship.

We hope and think that PIV can replace all the practical use cases for PGP. Specifically among those mentioned, `age` for file encryption, and either FIDO resident keys with hmac-secret for password managers, or something like `passage` (fork of `pass` using, again, `age` for encryption). For SSH you can use FIDO for newer OpenSSH, and either `pivy` or `yubikey-agent` via PIV. Cheers!

Understood and it probably can but I don't want to replace it :) I like OpenPGP (especially the newer revision which supports elliptic curve).

The GPG toolchain is pretty great for file encryption and I use it for my password manager too (which is indeed ZX2C4 Pass - passwordstore.org ). I don't want to use a fork using 'age' because I rely on the GPG version on my mobile (using the excellent OpenKeyChain app and the passwordstore app which talks to that).

Also, I log in to SSH servers I don't have the ability to install stuff on, like the ILO on my servers. And again on mobile, there's bridges to OpenKeyChain for SSH in e.g. Termux which work great including agent forwarding. But not for PIV. So it's not a complete replacement.

Sorry but without OpenPGP it's a non-starter for me. I understand I could use Solokey if I make a lot of changes in my personal setup and make some compromises especially on mobile. But why would I? I can just continue using Yubikey :) Don't forget you're in a heavily contested market, you should be better than the competition.

I'd like to have an open-source authentication key but in the end it's a tool to me. Open-source is a 'nice to have'. It's not worth it to me to deviate too much from my existing workflow.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#134

Post by GekkePrutser »

Avamander wrote: post #120
IgorPartola wrote: post #74

Earlier quoted context omitted.

Why do people like to hate on PGP? It’s a pretty great project.

Because it has a shitton of issues. The implementations aren't great, cryptographic issues, memory safety issues, stable API/ABI issues. It's still not supported well by software that could use these features.

Most of the security issues are mitigated by using a hardware token to do the actual encryption anyway.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#135

Post by GekkePrutser »

georgyo wrote: post #62
nickray wrote: post #56

Earlier quoted context omitted.

We hope and think that PIV can replace all the practical use cases for PGP. Specifically among those mentioned, `age` for file encryption, and either FIDO resident keys with hmac-secret for password managers, or something like `passage` (fork of `pass` using, again, `age` for encryption). For SSH you can use FIDO for newer OpenSSH, and either `pivy` or `yubikey-agent` via PIV. Cheers!

What about code signing? People like to dislike PGP and replace it with a myriad of different solutions. But PGP is everywhere and awesome. It's very wide spread adoption is invaluable. I really don't want to see it replaced with zillions of different bespoke solutions.

Yeah I dislike PGP mainly for email by the way. It's too clumsy there.

For file encryption and signing it's great IMO.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#136

Post by petee »

an_ko wrote: post #124
brabel wrote: post #123

From the founder of Solo, I assume: "I've been working on Solo for almost 3 years now. It started back when I was in college and on a whim, ordered a run of 1000 security keys that I designed and then shipped them all to Amazon. " Hm... not sure I can trust my keys to something developed on a whim by a college student.

Linux was designed on a whim by a college student.

But would you have trusted your secrets on a 3yr old linux?

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#137

Post by meirelles »

l0b0 wrote: post #11

As someone who is comfortable with TOTP but hasn't tried FIDO-/Yubikey-style devices, I have a few questions: - Are drivers for this already installed as part of desktop Ubuntu 20.10/Windows 10? Any driver installation will absolutely make this a no-go for family members. - Is additional software required for anything non-techies might reasonably want to do with this device, including resetting it, adding an entry or…

Trezor is great as an U2F device because it uses the same crypto seed to initialize all internal keys, including the U2F feature. So you only have to backup the seed phrase offline (paper is one of the safest medium when correctly secured, or you can buy a cryptosteel plates to really long-term storage).

Crypto fan or not, those devices are amazingly secure, and certainly hold billions out there. I think it is open source too.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#138

Post by tialaramex »

StavrosK wrote: post #117
tialaramex wrote: post #96

Earlier quoted context omitted.

FIDO (except in resident mode which we'll ignore here) requires the site requesting you authenticate to hand over a large opaque blob called an ID that your authenticator gave it when you enrolled the authenticator. This ID will be different for every time you enrolled an authenticator, and it can recognise its own IDs (using modern cryptography). To prevent you enrolling the same one twice, sites hand over a list of…

I implemented this mode in a Django library [0] (demo on www.pastery.net) because I love the idea of not needing a password manager any more, just simply having a key with you to log in anywhere, but it doesn't seem to have widespread browser support yet. Maybe I made a mistake, but Firefox doesn't seem to work very reliably with it, and mobile support is spotty too. [0] https://pypi.org/project/django-webauthin/

Yes, resident credential (aka "Client discoverable") support in (at least) desktop Firefox is broken and has been for a long time. I believe it's also absent (but at least not broken) in desktop Chrome. :/

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#139

Post by ibotty »

65a wrote: post #102

I'm really hoping they bring GPG to the Solokey V1, but I'm starting to lose confidence

https://github.com/solokeys/kickstarter2021/discussions/26#d...

TLDR: it's not as easy as thought. It will be easier for the new one.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#140

Post by baq »

damnyou wrote: post #54
roblabla wrote: post #17

Earlier quoted context omitted.

I use a yubikey, but I suppose the Solo will be similar. > - Are drivers for this already installed as part of desktop Ubuntu 20.10/Windows 10? Any driver installation will absolutely make this a no-go for family members. On windows10, yes. I haven't tried it on Ubuntu 20.10 yet, but I think FIDO/WebAuthN will Just Work. (PIV will likely need custom software, but if you're using PIV, you probably know what you're doi…

The moment you lose your key, WebAuthN becomes terrible and the UX is atrocious. You may literally have to go to an office (in the middle of a pandemic!) to restore access to your account. This is bananas. We absolutely should not be recommending them to normal people until security researchers come to their senses and fix this problem.

Nonono. We absolutely should recommend having at least 2. See also: car keys, house keys, any other physical lock you can get comes with at least 2 keys.

The default product sold should be a two key bundle.

Post reply on HN