Woohoo! My urge-zero key stopped working mysteriously and I wasn’t happy about that but I’ll give them another chance.
Thanks!! This next should will come with case and be more robust!
Solo – Open-source FIDO2 security key
51–60 of 65 posts
Re: Solo – Open-source FIDO2 security key
#52From the image it doesn't look like it'll be easily hand solderable. I love that about the U2F zero (though I'm still torn on if I should build it or buy it).
Yes :(. I've been soldering with paste, stencil, and air gun and have had a good success rate, but it can be a bit more difficult.
I'm thinking about making a short video showing how to solder one reliably for folks interesting in making their own. Unfortunately newer MCUs these days often don't come in easy-to-solder packages.
Re: Solo – Open-source FIDO2 security key
#53Solo describes itself as "An upgrade to U2F Zero." What does it do better than U2F Zero?
FIDO2, possibly some other extensions.
Also planning to have case, USB-C option, NFC option
Re: Solo – Open-source FIDO2 security key
#54> It protects against phishing Not so much. U2F proves only that the user tapped the device when asked to do so. You still have to trust your browser and your entire desktop that the tap will be used to log in to the service you are browsing instead of e.g. quietly logging to your home banking. To prevent "tap hijacking" we need a display on the U2F key to show the URL/service you are really authenticating to.
What you're describing is a different attack vector than phishing. I would describe it as malware. The classic phishing attack is to convince a target to visit a web page with a subtly different URL than the real thing, where they enter their credentials, which could include most second factors (OTP codes or push notifications). With U2F however, the browser will pass the URL of the requesting site to the U2F token, and that will be signed by the U2F token. The resulting signature cannot be used to login to the real service. You have to own the user's device or browser in order to do a phishing attack with U2F. And if you own the device or browser, it's probably easier to steal the short lived session auth credentials than it is to man in the middle U2F. You are correct, however, that U2F is not resistant to malware. Unfortunately, nothing really is, and it's not an easy problem to solve.
Re: Solo – Open-source FIDO2 security key
#55I wonder where are they going to manufacture it, and what control and visibility will they have into their supply chains, both upstream and downstream? Absent some very serious issue with the crypto implementation, that would be my greatest concern -- how easy would it be for a state-level actor to introduce some sort of backdoor or other vulnerability (even a subtle one, e.g. modification to EM radiation pattern) to…
This is a good point and generally a hard issue to solve completely.
Right now, we plan to do the programming ourselves to at least verify that goes okay. Since we are bootstrapping, we are outsourcing the PCB-A, but hopefully since this is pretty expensive threat for an adversary to invest in, I don't think it would be an issue unless we show to have a large market. By then, we can move more supply chain in house :)
Re: Solo – Open-source FIDO2 security key
#56What processor parts will this be using? A major benefit of the Yubikey U2F parts is that they're almost indestructible. I've heard over and over again about how flimsy the Feitian parts are, and from people who have run over their Yubikeys with cars and still had them work. How resilient (in particular: waterproof) will these be?
We are using a EFM32 Silabs chipset and plan to use some sort of conformal coating to add water/weather resistance. We also plan to have a silicone case. I don't know about getting run over by a car, but they will certainly be resilient to dropping, getting wet, surviving key-chains.
Re: Solo – Open-source FIDO2 security key
#57Earlier quoted context omitted.
That's a better MCU, but aren't they using a secure element to store keys?
Right. Why not add a ATECC608A?
ATECC608A is nice but can't provide total key isolation with the key derivation method most U2F keys use. E.g. it calculates the key using an HMAC, it gets sent back to MCU, the MCU writes it as a private key back to the ATECC608A to be used for signature. Also the ATECC608A requires an NDA.
Given this, I think having a 1 chip solution really simplifies the design and allows more flexibility.
Re: Solo – Open-source FIDO2 security key
#58Earlier quoted context omitted.
Yubikey 4C is very fragile. Mine has quite severe cracks on its plastic casing after 4 months of casual use (nothing extreme!), and I expect it to break in some months. YK4 (non-C) is quite robust, though.
My experience has been the same, I've had a 4 for years and it is still going strong but my 4C died in less than 12 months; the USB-C connector is too flimsy.
The connector itself is okay; it's just that the casing is poor. When it finally breaks apart, I'm going to try to cast the board in epoxy. Either I'll succeed, and it will be (hopefully) durable, or I'll completely ruin it - but it'll be broken by that time anyway.
Re: Solo – Open-source FIDO2 security key
#59Re: Solo – Open-source FIDO2 security key
#60Bit of a tangent, but out of interest, why KickStarter as opposed to CrowdSupply?
Ehm, our ignorance. I’m investigating, though now we’re a bit of in an “advanced stage” with Kickstarter and I’m not sure we can easily swap to CS.