Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Solo – Open-source FIDO2 security key

solokeys.com

Post reply on HN
Print view View original

41–50 of 65 posts

Re: Solo – Open-source FIDO2 security key

#41

Post by drdaeman »

tptacek wrote: post #5

What processor parts will this be using? A major benefit of the Yubikey U2F parts is that they're almost indestructible. I've heard over and over again about how flimsy the Feitian parts are, and from people who have run over their Yubikeys with cars and still had them work. How resilient (in particular: waterproof) will these be?

Yubikey 4C is very fragile. Mine has quite severe cracks on its plastic casing after 4 months of casual use (nothing extreme!), and I expect it to break in some months.

YK4 (non-C) is quite robust, though.

Re: Solo – Open-source FIDO2 security key

#43

Post by microtonal »

Boulth wrote: post #37
jmgrosen wrote: post #29

Earlier quoted context omitted.

GnuPG supports Curve 25519: https://gist.github.com/jmgrosen/5e646d6a6624c0d0e45f241be21... However, perhaps you're referring to the OpenPGP Smart Card spec, which does indeed lack support for Curve 25519 and EdDSA.

Even though Gnuk supports them: https://debconf17.debconf.org/talks/162/ I wish the spec would be updated to include them...

Can confirm, I use a NitroKey Start (which is a gnuk token) with that curve. I have used it for GPG signing/encryption and SSH authentication without any issues.

Re: Solo – Open-source FIDO2 security key

#44

Post by floatboth »

Freak_NL wrote: post #33

Does FIDO2 imply WebAuthn? How do the two relate to each other, other than WebAuthn being an 'outgrowth of' FIDO2?

webauthn is the in-browser API that allows using existing U2F keys, new "FIDO2" keys, built-in "secure elements" / TPMs, and whatnot.

FIDO2, according to https://fidoalliance.org/fido2/ , is the overall project that includes both WebAuthn and CTAP — the latter being the new protocol for talking to the keys.

Re: Solo – Open-source FIDO2 security key

#45

Post by lorenzhs »

peterloron wrote: post #14
riquito wrote: post #6

Earlier quoted context omitted.

Of two U2F yubikeys I own, one of them has stopped working when touching it, in less than 2 years. I don't know about other companies, but my personal experience is that they are not that long lasting. (I have them alongside my keys; one is a NEO - still working - the other is (was) U2F only)

My NEO has been on my keyring for several years. Still going strong.

My Yubikey Neo has been on my keyring for over three years, too. No problems at all. They seem pretty rugged.

Re: Solo – Open-source FIDO2 security key

#46

Post by wrboyce »

drdaeman wrote: post #41
tptacek wrote: post #5

What processor parts will this be using? A major benefit of the Yubikey U2F parts is that they're almost indestructible. I've heard over and over again about how flimsy the Feitian parts are, and from people who have run over their Yubikeys with cars and still had them work. How resilient (in particular: waterproof) will these be?

Yubikey 4C is very fragile. Mine has quite severe cracks on its plastic casing after 4 months of casual use (nothing extreme!), and I expect it to break in some months. YK4 (non-C) is quite robust, though.

My experience has been the same, I've had a 4 for years and it is still going strong but my 4C died in less than 12 months; the USB-C connector is too flimsy.

Re: Solo – Open-source FIDO2 security key

#47

Post by Taniwha »

I've spent some time building small open source USB devices, I went through a "let's just use the PCB to make the USB plug" phase but frankly they're not wonderfully reliable, I'm not a fan, and actual USB plugs are cheap and reliable (you do need to use one that has thru-hole lugs to be robust, not just surface mount which is an extra manufacturing step).

I just finished building my first USB-C (for standard USB) board board, it's surprisingly easy, 2 extra resistors - pad tolerances are tight, but it's not hard

Re: Solo – Open-source FIDO2 security key

#48

Post by emacsen »

ecesena wrote: post #3
m-p-3 wrote: post #2

Is it U2F only or can it also do some of Yubikey stuff like storing GPG keys, etc?

First version will be fido2 only, thought the firmware is open, so easy to extend. We'll just have to verify which features are copiable vs proprietary for yubikeys. To be honest I don't know at this point, I mostly use my keys for auth, rarely otp, but no gpg/ssh/etc. Do you have any primary use case that you're interested in?

I've just switched over to using the Yubikey Neo, so I'd love to chime in here.

My first and primary use of my key is that I use HMAC hashing on the Yubikey to unlock my KeepPassCX database. This solution works very well for me because it works seamlessly on multiple platforms (Linux and Windows) and is also compatible with Keepass2Android for my phone. I've looked into GPG only solutions and the ones I looked at didn't offer either the cross-platform compatibility and or browser integration, which is nice. The strong advantage of the Neo (vs the other hardware keys) is the use of NFC, which means less plugging things into my phone. In an ideal world, I'd love to get NFC working with my computers too.

I also use the PGP/SSH smartcard capabilities of my Yubikey on Linux (Ubuntu) and that's been flawless. I don't use SSH on Windows, but I hear the integration there is fairly solid as well.

I've not yet begun to use U2F for authentication, yet. My focus is on my most important services first, which is my passwords and logins. I'll be moving to U2F soon though.

If there was a way to store my passwords easily using PGP instead of HMAC, I'd be interested in that. The issue isn't the storage, but the interface to that storage being easy to use and cross platform (which is not the domain of the hardware, obviously). If I had that, I could consider not needing the HMAC.

I've heard that there is a way to use U2F offline for SSH, but I haven't looked into it. I'm still using SSH keys for things like SSH and Git. Perhaps if there was a solution to that, I might drop the GPG requirement, but I'd need either HMAC or GPG for decryption of my password database, so in any case, FIDO alone isn't enough.

Re: Solo – Open-source FIDO2 security key

#49

Post by eeZah7Ux »

> It protects against phishing

Not so much. U2F proves only that the user tapped the device when asked to do so.

You still have to trust your browser and your entire desktop that the tap will be used to log in to the service you are browsing instead of e.g. quietly logging to your home banking.

To prevent "tap hijacking" we need a display on the U2F key to show the URL/service you are really authenticating to.

Re: Solo – Open-source FIDO2 security key

#50

Post by conorpp »

eeZah7Ux wrote: post #49

> It protects against phishing Not so much. U2F proves only that the user tapped the device when asked to do so. You still have to trust your browser and your entire desktop that the tap will be used to log in to the service you are browsing instead of e.g. quietly logging to your home banking. To prevent "tap hijacking" we need a display on the U2F key to show the URL/service you are really authenticating to.

Assuming valid FIDO2/U2F implementation and same origin policy, this shouldn't be an issue. A browser will enforce that the APP-ID/domain name submitted to the token is the same as the origin requesting it. So in order to be tricked into signing into your bank, it would actually have to be your bank requesting the authentication. HTTPS is also a requirement.
Post reply on HN