Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Solo – Open-source FIDO2 security key

solokeys.com

Post reply on HN
Print view View original

61–65 of 65 posts

Re: Solo – Open-source FIDO2 security key

#61

Post by nbraud »

emacsen wrote: post #48
ecesena wrote: post #3

Earlier quoted context omitted.

First version will be fido2 only, thought the firmware is open, so easy to extend. We'll just have to verify which features are copiable vs proprietary for yubikeys. To be honest I don't know at this point, I mostly use my keys for auth, rarely otp, but no gpg/ssh/etc. Do you have any primary use case that you're interested in?

I've just switched over to using the Yubikey Neo, so I'd love to chime in here. My first and primary use of my key is that I use HMAC hashing on the Yubikey to unlock my KeepPassCX database. This solution works very well for me because it works seamlessly on multiple platforms (Linux and Windows) and is also compatible with Keepass2Android for my phone. I've looked into GPG only solutions and the ones I looked at did…

Regarding password storage with GPG, there is pass(1) (https://passwordstore.org) which is a wrapper around Git and GnuPG, and there are a number of front-ends for it. :)

Re: Solo – Open-source FIDO2 security key

#62

Post by nbraud »

ecesena wrote: post #3
m-p-3 wrote: post #2

Is it U2F only or can it also do some of Yubikey stuff like storing GPG keys, etc?

First version will be fido2 only, thought the firmware is open, so easy to extend. We'll just have to verify which features are copiable vs proprietary for yubikeys. To be honest I don't know at this point, I mostly use my keys for auth, rarely otp, but no gpg/ssh/etc. Do you have any primary use case that you're interested in?

You mentioned the firmware is open, but I couldn't find it anywhere. Could you post a link, ideally to the Git repository where it's developed?

Re: Solo – Open-source FIDO2 security key

#63

Post by dsl »

tptacek wrote: post #5

What processor parts will this be using? A major benefit of the Yubikey U2F parts is that they're almost indestructible. I've heard over and over again about how flimsy the Feitian parts are, and from people who have run over their Yubikeys with cars and still had them work. How resilient (in particular: waterproof) will these be?

Having been a part of a few large Yubikey rollouts I can say while the individual/SMB perspective is that they are "indestructible", large fleets see hardware failure rates above what you would expect from similar types of devices.

I don't setup hardware 2FA on personal accounts with less than 3 enrolled devices (and from 2 different vendors).

Re: Solo – Open-source FIDO2 security key

#64

Post by eeZah7Ux »

scott00 wrote: post #54
eeZah7Ux wrote: post #49

> It protects against phishing Not so much. U2F proves only that the user tapped the device when asked to do so. You still have to trust your browser and your entire desktop that the tap will be used to log in to the service you are browsing instead of e.g. quietly logging to your home banking. To prevent "tap hijacking" we need a display on the U2F key to show the URL/service you are really authenticating to.

What you're describing is a different attack vector than phishing. I would describe it as malware. The classic phishing attack is to convince a target to visit a web page with a subtly different URL than the real thing, where they enter their credentials, which could include most second factors (OTP codes or push notifications). With U2F however, the browser will pass the URL of the requesting site to the U2F token,…

No: the phishing attack leads the browser to parse and run malicious javascript and HTML.

If the phishing page is then able to compromise the browser the security is breached.

For example it could trick the browser into presenting the legitimate URL to the U2F token, or wait for the user to log on the home banking site for real and then perform transaction, or many other attacks.

Post reply on HN