OnlyKey's ability to type passwords differentiates it for my use cases. I can use OnlyKey to type long BIOS, disc, user and root passwords without worrying about people around or security cameras.
YubiKey can also do this:
OnlyKey: Open-Source Alternative to YubiKey
41–50 of 215 posts
Re: OnlyKey: Open-Source Alternative to YubiKey
#42Earlier quoted context omitted.
You might want to check out this - https://docs.crp.to/security.html#cryptographically-secure-r... If you read further into the source you will see that analog read is only one of the sources of entropy, it uses capacitive touch from a user's skin and this TRNG passed dieharder tests - https://webhome.phy.duke.edu/~rgb/General/dieharder.php
Passing dieharder doesn't mean anything at all with respect to cryptographic security. It's trivial to define a random bit generator that passes randomness tests and has no real security.
I would like to learn more about practical cryptographic issues, and I need some help: what are the tests that can prove or disprove stronger guarantees for cryptographic security of a PRG than diehard? A wikipedia page doesn't give me much info about which one provides stronger guarantee and in which criteria:
https://en.wikipedia.org/wiki/Randomness_tests
Also, which level of security of a PRG is sufficient for keys like this?
Re: OnlyKey: Open-Source Alternative to YubiKey
#43OnlyKey's ability to type passwords differentiates it for my use cases. I can use OnlyKey to type long BIOS, disc, user and root passwords without worrying about people around or security cameras.
YubiKey does it too. I use it to unlock GELI.
Re: OnlyKey: Open-Source Alternative to YubiKey
#44Can this device function as an SSD, holding, for example, a Keepass2Android APK file and a KeePass database -- as well as being able to open said datanbase via one of the stored profiles? It doesn't need to have a lot of storage... 640 MB ought to be enough for anyone's KeePass databases.
No it doesn't store files directly, but if you are looking for KeePass support it is now supported directly by KeePassXC - https://keepassxc.org/blog/2019-10-26-2.5.0-released/
I use KeePassXC on macOS, Windows, and Linux and copying the database to the machines in question is easy enough. I was specifically thinking for iOS and Android without going through iCloud.
Re: OnlyKey: Open-Source Alternative to YubiKey
#45Earlier quoted context omitted.
Passing dieharder doesn't mean anything at all with respect to cryptographic security. It's trivial to define a random bit generator that passes randomness tests and has no real security.
I would like to learn more about practical cryptographic issues, and I need some help: what are the tests that can prove or disprove stronger guarantees for cryptographic security of a PRG than diehard? A wikipedia page doesn't give me much info about which one provides stronger guarantee and in which criteria: https://en.wikipedia.org/wiki/Randomness_tests Also, which level of security of a PRG is sufficient for key…
There aren't such tests, at least not that work like dieharder. You analyze a CSPRNG the same way you'd analyze a cipher construction (they are essentially the same thing, and often we draw our conclusions about the strength of a CSPRNG by noticing that it's built on and thus inherits the formal security commitments of ciphers and hashes run in modes and constructions that themselves have been shown to be trustworthy).
Re: OnlyKey: Open-Source Alternative to YubiKey
#46Earlier quoted context omitted.
Also, you guys should definitely do some research about side-channel attacks. I quickly inspect the source code and did not find any counter-measure.
Countermeasures listed here - https://docs.crp.to/security.html#technical-specifications
Sorry that your account was being rate-limited. HN's software filters that do that, based on past activity by trolls. Unfortunately it also sometimes prevents project creators from showing up to discuss their work. I hate that!
We've marked your account legit so this won't happen again.
Re: OnlyKey: Open-Source Alternative to YubiKey
#47Earlier quoted context omitted.
Passing dieharder doesn't mean anything at all with respect to cryptographic security. It's trivial to define a random bit generator that passes randomness tests and has no real security.
I would like to learn more about practical cryptographic issues, and I need some help: what are the tests that can prove or disprove stronger guarantees for cryptographic security of a PRG than diehard? A wikipedia page doesn't give me much info about which one provides stronger guarantee and in which criteria: https://en.wikipedia.org/wiki/Randomness_tests Also, which level of security of a PRG is sufficient for key…
There are no automated tests for this, since cryptographic randomness requires unpredictability. A statistical test can only tell you when a random number generator is broken, but no statistical test can tell you whether a random number generator is cryptographically sound.
Re: OnlyKey: Open-Source Alternative to YubiKey
#48Earlier quoted context omitted.
There's currently an issue (and an open PR) in to add dvorak support, though, I'm not sure if/when it'll be merged. https://github.com/trustcrypto/OnlyKey-Firmware/issues/85
There are many, many keyboard layouts out there. Maybe it's time for an input standard that acknowledges this fact, instead of endlessly putting the onus on OS developers and users. Maybe keyboards should output UTF8 instead of messy keycodes.
This would require new hardware.
If one is already going to be purchasing new hardware, one may as well get a QMK keyboard. This way you can program it with any keyboard layout you would like, and it will work on any computer without having to change the system defaults.
Clearly this doesn't help with built-in keyboards such as found on laptops; the clear workaround for this specific product is to allow it to import keyboard layouts in the various OS-specific forms they exist in.
Re: OnlyKey: Open-Source Alternative to YubiKey
#49Thanks for all of the interest in OnlyKey! Full disclosure, I work for CryptoTrust and am on the team that makes OnlyKey. I wanted to try to address the questions/concerns in this thread in one place and provide some useful links for more information. OnlyKey started from a successful kickstarter launch in 2016 and has grown to become a popular product for businesses and individuals.
- OPEN SOURCE - If you are looking for OnlyKey source you will find it here https://github.com/trustcrypto all of our apps and firmware is open source. OnlyKey is not open hardware, however the hardware design is very transparent, literally. The device has a clear protective coating on the hardware which in addition to adding durability allows visually verifying everything.
- ABOUT SECURITY - Security documentation is here https://docs.crp.to/security.html and provides information on how OnlyKey random number generator works, supply chain, side-channel attacks etc. One thing that you will notice about OnlyKey that differentiates it from other security keys is the on key PIN entry. While no device is immune to hacking, this feature mitigates many traditional threat models. We are always open to discussing specific threat models openly on our support forum.
- WHERE TO GO FOR MORE INFO Get started - https://onlykey.io/start General documentation - https://docs.crp.to/ FAQs - https://docs.crp.to/faq.html Compare to Yubikey - https://crp.to/p/ Setup and User's Guide - https://docs.crp.to/usersguide.html Features - https://docs.crp.to/features.html Support - https://forum.onlykey.io/ List of supported services - https://onlykey.io/pages/works-with-onlykey
Re: OnlyKey: Open-Source Alternative to YubiKey
#50Open source is the only way to security in most cases.
If its auditable by anyone.
For one meaning of 'auditable by anyone', this is definitional for open-source systems.
Perhaps you mean 'if there's anyone with the domain-specific knowledge to audit the software successfully', well, the first kind of audit should determine that. If there isn't anyone who can evaluate the security claims, that's a pretty strong signal not to use it, no?