Live data from Hacker News

FIDO2 security key company releases hardware that's open source and uses Rust

solokeys.com

31–40 of 160 posts

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#31
post #11

As someone who is comfortable with TOTP but hasn't tried FIDO-/Yubikey-style devices, I have a few questions: - Are drivers for this already installed as part of desktop Ubuntu 20.10/Windows 10? Any driver installation will absolutely make this a no-go for family members. - Is additional software required for anything non-techies might reasonably want to do with this device, including resetting it, adding an entry or…

Others have answered most of your questions, but there's something I think deserves emphasizing:

In general, you cannot (by design) back up these devices; if you could, that would defeat a lot of the security they provide. That means that if you lose it, you will have to find a way to get 2FA disabled for each and every account you enabled it for. Some orgs will have pretty onerous (but necessary!) processes for doing so, like having to provide government ID or physically visiting a brick-and-mortar location to prove your identity and ownership of the account.

Some sites will allow you to simultaneously enroll two devices, so you can keep one as a backup, safe somewhere (though not too safe; if you were to, say, put it in a bank safe deposit box, it'd be a pain to fetch it any time you want to add a new account). But many sites only allow a single device to be enrolled.

Some (like Yubico) let you purchase a "cloned" set of devices, where you can get two (or more) devices with the same keys on them, so you could actually put one of them in a safe deposit box as soon as it comes in the mail to act as a backup. That also solves the issue of some sites only supporting one device, as all of the devices in the set are effectively the same device. However, it doesn't appear that this is an option with the Solo keys (not certain of this; happy to be wrong about it; it's possible that you might be able to wipe the key material off new Solo keys and put identical copies of new self-generated material onto more than one key). On the flip side, if someone steals your backup key, it becomes harder to deal with the situation; with distinct keys, you can just revoke access to the stolen key. But with cloned keys, revoking access to the stolen key will also revoke the key you use daily.

I just wanted to bring this aspect up, because people unfamiliar with these devices need to understand the consequences if they lose their key; it can be a huge pain in the ass to rectify that situation. This might be an understandably big turn-off to non-techies who are just looking to add a little extra security, but not a big maintenance burden and difficult failure modes.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#32
post #28

Earlier quoted context omitted.

Some Linux distributions require adding udev rules for applications to have USB device access but other then that, it's pretty much plug and play. A bit more convenient than having to use the YubiKey apps for TOTP and such.

My now-defunct u2f-hidraw-policy package did this in a generic manner. The code was subsequently ported into the upstream udev code, so any up to date distro should automatically detect and handle U2F devices. If they don’t, file an issue with upstream systemd and it’ll get fixed. Feel free to file an issue on u2f-hidraw-policy too if you want my attention.

Was not aware. Thank you!

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#33
post #20
post #19

Earlier quoted context omitted.

> - The ideal backup for this is to have a separate key, both authorized. This in particular is important. Security is only as strong as your weakest link, so any backup methods (e.g. "forgot password" flows) might as well be your primary method, if you actually care to strongly secure things. Adding another (or more) key gets you same-security redundancy if one fails or is lost. Nothing else will achieve this. Degra…

This is one thing I hate about these keys though - some services only support one key, and for ones that support multiple, I struggle to figure out a storage system for my backup key. I don't want to keep it with me (because then I am at risk of losing both), but if I keep it separate, I need to remember to add it to new accounts - there's no way to see a list of accounts a key has been associated with. I'm curious h…

Completely agreed. I don't have a good solution for that either, aside from "try harder". Which puts them in a fairly specific niche of reasonable use, tbh. And any site without the ability to set up multiple emails / keys / etc is not taking basic steps to allow its users to maintain access their account, so I think it's fair to rule them out simply as "bad sites" (though they're quite numerous, sadly).

For corporate purposes, they're pretty decent. If one is lost or fails or whatever, they can get you a new one, because the company can quite-strongly verify that you are you - much better than your average website. A bank or something might also be reasonable.

For general personal use... I dunno. You really don't want to be locked out permanently if you lose the key, which tends to mean they degrade to your email security, and they're just convenience tools. Which is more than nothing! Convenience that emails you when it is bypassed is better than no email when bypassed! But it's very far from the security claims that tend to go along with these keys.

Personally I'd like these keys to be a "fast login" convenience, and for email-reset to be delayed by a day or three with an easy "revoke" button. It's exceedingly rare that I truly need backup access immediately, and allowing it all the time is definitely opening the door to bulk theft of accounts.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#34
post #20

Earlier quoted context omitted.

This is one thing I hate about these keys though - some services only support one key, and for ones that support multiple, I struggle to figure out a storage system for my backup key. I don't want to keep it with me (because then I am at risk of losing both), but if I keep it separate, I need to remember to add it to new accounts - there's no way to see a list of accounts a key has been associated with. I'm curious h…

My threat model is focused on remote attacks, I consider physical access to my workstation game over. So one stays on my keys, one on my wife’s keys, and one stays plugged into my workstation. If I’m enrolling the keys with a given service I make sure to add or remove all three at the same time so I don’t have to track which is associated with different accounts.

This isn't really an adequate threat model today though, where everyone has laptops. Having a workstation stolen for most us is actually extremely likely - probably more likely then someone trying to attack our credentials.

In this case though, full-disk encryption and TPM usage is the mitigation - provided the disk goes dead when anyone short of a nation-state tries to manipulate it, you're good.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#35
post #19
post #12

Earlier quoted context omitted.

Can't speak for this thing specifically, but FIDO2 keys in general: - Yes, you have everything you need on every major OS/browser - These devices are zeroconf; resetting it actually kills a security feature (key use increments) aiming at cloned devices - The ideal backup for this is to have a separate key, both authorized. They don't need to have the same material, in fact, cloning it would be considered a weakness (…

> - The ideal backup for this is to have a separate key, both authorized. This in particular is important. Security is only as strong as your weakest link, so any backup methods (e.g. "forgot password" flows) might as well be your primary method, if you actually care to strongly secure things. Adding another (or more) key gets you same-security redundancy if one fails or is lost. Nothing else will achieve this. Degra…

Backups with lower grade technical security are possible if you’re willing to compromise speed. For example an offline process where you have to present yourself, in person, and show N forms of ID, to the service provider or their agent with a mandatory M day delay. Or where you can have X other users, who can log in, vouch for you to reset your access token.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#36
post #2

I'm still curious how the key is tamper resistent when filling it with transparent epoxy. I asked when the article was published on lobste.rs but never got an answer. It seems to me it should be fairly easy to remove the epoxy and refill after tampering. I should probably email them about this at this point, but I think it's weird they haven't explained the "tampering resistent" part in their marketing material in an…

have you ever tried to remove epoxy from a PCB? it's definitely possible, but it's annoying and makes a mess. i'm not sure how you'd remove epoxy without it being blindingly obvious that the epoxy had been removed and replaced.

they're claiming tamper-resistant, not tamper-proof. and counting on the epoxy for that seems reasonable to me.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#38
post #4

Earlier quoted context omitted.

Then it would be tamper evident, not resistent?

Tamper evident is the correct description of what the parent comment is talking about. You can Google “tamper evident stickers” to see it’s how the phrase is widely used. I would say the epoxy in question is both tamper resistant and evident though. Because it’s both difficult to remove and you’d risk breaking the device if you tried it, and those seem like obvious tamper resistance controls to me.

Yes, 2 birds, 1 stone.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#39
post #31
post #11

As someone who is comfortable with TOTP but hasn't tried FIDO-/Yubikey-style devices, I have a few questions: - Are drivers for this already installed as part of desktop Ubuntu 20.10/Windows 10? Any driver installation will absolutely make this a no-go for family members. - Is additional software required for anything non-techies might reasonably want to do with this device, including resetting it, adding an entry or…

Others have answered most of your questions, but there's something I think deserves emphasizing: In general, you cannot (by design) back up these devices; if you could, that would defeat a lot of the security they provide. That means that if you lose it, you will have to find a way to get 2FA disabled for each and every account you enabled it for. Some orgs will have pretty onerous (but necessary!) processes for doin…

> Some (like Yubico) let you purchase a "cloned" set of devices

Wait, they do? How?

I would love to do this, but I can't find anything relevant on their website.

Re: FIDO2 security key company releases hardware that's open source and uses Rust

#40
post #31
post #11

As someone who is comfortable with TOTP but hasn't tried FIDO-/Yubikey-style devices, I have a few questions: - Are drivers for this already installed as part of desktop Ubuntu 20.10/Windows 10? Any driver installation will absolutely make this a no-go for family members. - Is additional software required for anything non-techies might reasonably want to do with this device, including resetting it, adding an entry or…

Others have answered most of your questions, but there's something I think deserves emphasizing: In general, you cannot (by design) back up these devices; if you could, that would defeat a lot of the security they provide. That means that if you lose it, you will have to find a way to get 2FA disabled for each and every account you enabled it for. Some orgs will have pretty onerous (but necessary!) processes for doin…

> On the flip side, if someone steals your backup key, it becomes harder to deal with the situation; with distinct keys, you can just revoke access to the stolen key. But with cloned keys, revoking access to the stolen key will also revoke the key you use daily.

Get a new key, revoke old key, switch to new one?

Post reply on HN