Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FIDO2 security key company releases hardware that's open source and uses Rust

solokeys.com

Post reply on HN
Print view View original

151–160 of 160 posts

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#151

Post by damnyou »

baq wrote: post #140
damnyou wrote: post #54

Earlier quoted context omitted.

The moment you lose your key, WebAuthN becomes terrible and the UX is atrocious. You may literally have to go to an office (in the middle of a pandemic!) to restore access to your account. This is bananas. We absolutely should not be recommending them to normal people until security researchers come to their senses and fix this problem.

Nonono. We absolutely should recommend having at least 2. See also: car keys, house keys, any other physical lock you can get comes with at least 2 keys. The default product sold should be a two key bundle.

With your house keys you can walk into any hardware store and get as many duplicates as you like. With a U2F key that is prohibited.

U2F desperately needs a layer of indirection that doesn't currently exist.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#152

Post by xur17 »

Arainach wrote: post #118
xur17 wrote: post #20

Earlier quoted context omitted.

This is one thing I hate about these keys though - some services only support one key, and for ones that support multiple, I struggle to figure out a storage system for my backup key. I don't want to keep it with me (because then I am at risk of losing both), but if I keep it separate, I need to remember to add it to new accounts - there's no way to see a list of accounts a key has been associated with. I'm curious h…

I keep one backup key in a fire safe at my residence (in case I lose my primary key somehow) and one with a trusted party in a different state (in case Mt. Rainier explodes and the entire state of Washington is lost - though at that point I have bigger concerns)

How do you update the copy that is with a trusted party in a different state (and how do you track which accounts are stored on each)?

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#153

Post by urza »

meirelles wrote: post #137
l0b0 wrote: post #11

As someone who is comfortable with TOTP but hasn't tried FIDO-/Yubikey-style devices, I have a few questions: - Are drivers for this already installed as part of desktop Ubuntu 20.10/Windows 10? Any driver installation will absolutely make this a no-go for family members. - Is additional software required for anything non-techies might reasonably want to do with this device, including resetting it, adding an entry or…

Trezor is great as an U2F device because it uses the same crypto seed to initialize all internal keys, including the U2F feature. So you only have to backup the seed phrase offline (paper is one of the safest medium when correctly secured, or you can buy a cryptosteel plates to really long-term storage). Crypto fan or not, those devices are amazingly secure, and certainly hold billions out there. I think it is open s…

The advantage of seed backup + hierarchical deterministic keys is greatly underapreciated.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#154

Post by ptman »

fsflover wrote: post #113
_abox wrote: post #46

Nice, I'd love this as an open source yubikey replacement. But it doesn't do OpenPGP, I rely on that way too much sadly. Not just for SSH which supports fido2 now but also for file encryption and my password manager. If they add that in the future I might jump ship.

Librem Key can do OpenPGP and uses FLOSS: https://puri.sm/posts/introducing-the-librem-key/

Librem Key is just a branded Nitrokey https://www.nitrokey.com/news/2018/nitrokey-partners-purism-...

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#155

Post by Arainach »

xur17 wrote: post #152
Arainach wrote: post #118

Earlier quoted context omitted.

I keep one backup key in a fire safe at my residence (in case I lose my primary key somehow) and one with a trusted party in a different state (in case Mt. Rainier explodes and the entire state of Washington is lost - though at that point I have bigger concerns)

How do you update the copy that is with a trusted party in a different state (and how do you track which accounts are stored on each)?

In non-pandemic times, I visit at least once a year and update things then.

At the end of the day, so long as I can get access to my email and at least one bank, I'm confident that I can recover everything else in time. As such, if I have some recent account that isn't covered by that key I'm not particularly concerned.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#156

Post by chaz6 »

Foxboron wrote: post #2

I'm still curious how the key is tamper resistent when filling it with transparent epoxy. I asked when the article was published on lobste.rs but never got an answer. It seems to me it should be fairly easy to remove the epoxy and refill after tampering. I should probably email them about this at this point, but I think it's weird they haven't explained the "tampering resistent" part in their marketing material in an…

My biggest concern is that the key's software is updatable. I would have preferred to have an efuse I could blow to make the keys completely read-only.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#157

Post by sowbug »

gorgoiler wrote: post #105

In life, every so often one hears of a concept that is so simple and so elegant that the fact that one had not heard of it before today makes one’s jaw drop in disbelief: > Reversible USB-A. Well this maybe wasn't the most critical feature anyone expected, but, consequence of our new PCB & case combined construction, it was easy to make USB-A reversible. So why not!

This is a good discussion of how it works: https://electronics.stackexchange.com/questions/209941/two-s...

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#158

Post by Avamander »

GekkePrutser wrote: post #134
Avamander wrote: post #120

Earlier quoted context omitted.

Because it has a shitton of issues. The implementations aren't great, cryptographic issues, memory safety issues, stable API/ABI issues. It's still not supported well by software that could use these features.

Most of the security issues are mitigated by using a hardware token to do the actual encryption anyway.

Those are expensive

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#159

Post by georgyo »

Avamander wrote: post #158
GekkePrutser wrote: post #134

Earlier quoted context omitted.

Most of the security issues are mitigated by using a hardware token to do the actual encryption anyway.

Those are expensive

You do realize that the solokey is a hardware token....

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#160

Post by Avamander »

georgyo wrote: post #159
Avamander wrote: post #158

Earlier quoted context omitted.

Those are expensive

You do realize that the solokey is a hardware token....

Yes, but a Solokey is half the price of a Yubikey that could do the encryption implied by OP. And to be fair, even Solokey is too expensive for most.
Post reply on HN