Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FIDO2 security key company releases hardware that's open source and uses Rust

solokeys.com

Post reply on HN
Print view View original

141–150 of 160 posts

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#141

Post by fullstop »

smichel17 wrote: post #49
kelnos wrote: post #31

Earlier quoted context omitted.

Others have answered most of your questions, but there's something I think deserves emphasizing: In general, you cannot (by design) back up these devices; if you could, that would defeat a lot of the security they provide. That means that if you lose it, you will have to find a way to get 2FA disabled for each and every account you enabled it for. Some orgs will have pretty onerous (but necessary!) processes for doin…

> But many sites only allow a single device to be enrolled. Ugh, I hate these. I want to use u2f, but I am not willing to risk being locked out of my account if I lose the key. So I only enable it if there is some other 2fa I can enable (either adding a second key or totp).

Google won't let you enable "enhanced security" unless you have more than one u2f key.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#142

Post by baq »

brabel wrote: post #123

From the founder of Solo, I assume: "I've been working on Solo for almost 3 years now. It started back when I was in college and on a whim, ordered a run of 1000 security keys that I designed and then shipped them all to Amazon. " Hm... not sure I can trust my keys to something developed on a whim by a college student.

I have multiple solo v1s from the first Kickstarter. Still work like a charm. Haven’t used the nfc version.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#143

Post by JunkDNA »

gorgoiler wrote: post #105

In life, every so often one hears of a concept that is so simple and so elegant that the fact that one had not heard of it before today makes one’s jaw drop in disbelief: > Reversible USB-A. Well this maybe wasn't the most critical feature anyone expected, but, consequence of our new PCB & case combined construction, it was easy to make USB-A reversible. So why not!

USB remains the only connector I use where I routinely get the orientation wrong 3 times.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#144

Post by sufficient »

g_p wrote: post #26
asnelt wrote: post #25

Earlier quoted context omitted.

Regarding support on Android, if you are using a custom rom like LineageOS without Google Play Services then it won't work currently. Unfortunately, Google implemented FIDO2 in the play services, not in AOSP: https://bugs.chromium.org/p/chromium/issues/detail?id=997538

Interesting and disappointingly. In this case I was testing it with play services, using the nextcloud app. I believe they are using something slightly custom from an open SDK, and suspect the outdoor was at their end. It seems strange Google put fido2 into play services, but that's certainly what they seem to "need" to do to get things shipped, given the lack of prompt Android release updates (don't even start me on…

Yep, Nextcloud is using our SDK from https://hwsecurity.dev/. We provide dual licensing for closed source and GPLv3 projects.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#145

Post by mastax »

mNovak wrote: post #107
gorgoiler wrote: post #105

In life, every so often one hears of a concept that is so simple and so elegant that the fact that one had not heard of it before today makes one’s jaw drop in disbelief: > Reversible USB-A. Well this maybe wasn't the most critical feature anyone expected, but, consequence of our new PCB & case combined construction, it was easy to make USB-A reversible. So why not!

I'm more impressed by the cavity PCB construction--fill with epoxy and boom dead simple waterproofing! I've never encountered this before; wonder if it's available with the batch fabs.

The difficult part is the step milling for the cavity. Its unusual so you need to work with the fab to get it right. Bunny Huang had a good post about it.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#146

Post by ozim »

chrisdhal wrote: post #130
godelski wrote: post #104

Earlier quoted context omitted.

This has been a thing preventing me from getting one. A key that's supposed to be on you (or locked in a vault) is prone to getting destroyed or damaged. So since my threat model isn't high and this would be more a nerd thing, it doesn't seem worth it. 2FA is good enough I guess

I've had a Yubikey for about 3 years that is on my car keys keychain which goes with me everywhere. It's been all over the US and into Costa Rica all in my pocket or haphazardly thrown into my backpack (with a bunch of other random things). There is zero evidence of any wear or anything. They are meant to be carried around, you don't need to baby them. I'm more worried about it being lost than damaged.

My friend was like "why would I pay for this when Android phone can act as one as well".

I am more concerned with losing my phone or that my phone will die that something happening to my ybk.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#147

Post by ericseppanen »

Dylan16807 wrote: post #100
ericseppanen wrote: post #78

Earlier quoted context omitted.

I don't think this is true in the general case. Most Solokeys come in a "locked" form-- they will only accept firmware updates that are signed by the manufacturer. You can buy a "hacker" variant that is unlocked (meant for those that want to tinker with the firmware), but if you were to use one of those you're giving up security against someone loading malicious firmware onto your device. This is probably the right t…

> You can buy a "hacker" variant that is unlocked (meant for those that want to tinker with the firmware), but if you were to use one of those you're giving up security against someone loading malicious firmware onto your device. You can't set it to wipe when updated?

I have no firsthand information, but reading https://github.com/solokeys/solo

"Solo Hacker can be converted to a secure version, but normal Solo cannot be converted to a Hacker version."

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#149

Post by xenophonf »

Corrado wrote: post #112
andrewwebber wrote: post #103

Earlier quoted context omitted.

Looking at you AWS cloud.

Just to be clear, AWS SSO supports multiple keys. Yes, AWS IAM only supports a single key and it's very frustrating. If you want multiple key support, I suggest moving to AWS SSO. It's much better in every way.

That doesn't help if you're trying to protect the AWS root account.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#150

Post by baby »

jabbany wrote: post #72
baby wrote: post #61

Earlier quoted context omitted.

Some websites also allow you to disable or rotate your 2FA creds if you're already logged in, without having to re-authenticate with your second authenticator.

This seems a little dangerous since now the logged in state (likely cookies but maybe also hashed with identifiers like IP etc.) becomes considerably more valuable to steal. I actually see the opposite done, where any changes to login related things (passwords, 2fa keys) mandate a 2fa re-auth.

Heh, stealing a logged state is bad no matter what unless you’re requiring re-auth on important operations. The risk of one losing their second factor is much much higher.
Post reply on HN