One thing I immediately noticed is that apparently it supports exporting full backups of the device? Surely this is a terrible idea? I'm far from a security expert but I'd have thought you'd want to make it so that it is extremely difficult to extract key material from a security key, not offer it as a feature?
OnlyKey: Open-Source Alternative to YubiKey
91–100 of 215 posts
Re: OnlyKey: Open-Source Alternative to YubiKey
#92Security keys are the heart of security and we desperately need open-source solutions on this. Kudos for doing it. Now, I must point out a few things: 1. Please don't call your solution "Open-source", when you do not have not even the schematics uploaded to github. 2. (this item is an open problem without a solution yet) how do I make sure the source code and the (still missing) hardware information actually correspo…
The "security" of this device is a joke, just look at how randomness is derived: unsigned int analog1 = analogRead(ANALOGPIN1); RNG.stir((uint8_t *)analog1, sizeof(analog1), sizeof(analog1)*2); unsigned int analog2 = analogRead(ANALOGPIN2); RNG.stir((uint8_t *)analog2, sizeof(analog2), sizeof(analog2)*2); (See [0] for a comprehensive summary of why this is a terrible thing to do) And yeah, analogRead() is a function…
The linked paper breaks analogRead-based encryption in section 5 at the end.
But I wonder if you could get better randomnes by, instead of naively pulling one low entropy 10-bit value from analogRead, you pulled 128 bits from successive analogReads and only kept the lowest significant bit.
Re: OnlyKey: Open-Source Alternative to YubiKey
#93Earlier quoted context omitted.
The "security" of this device is a joke, just look at how randomness is derived: unsigned int analog1 = analogRead(ANALOGPIN1); RNG.stir((uint8_t *)analog1, sizeof(analog1), sizeof(analog1)*2); unsigned int analog2 = analogRead(ANALOGPIN2); RNG.stir((uint8_t *)analog2, sizeof(analog2), sizeof(analog2)*2); (See [0] for a comprehensive summary of why this is a terrible thing to do) And yeah, analogRead() is a function…
I have to agree with you. What impresses me even more is that they are selling it already, and marketing as “open-source”. I would leave a note here that if anybody is interested in doing something similar, please get some feedback from community before starting commercialization.
There's a dead simple "quack/crank" test for security products. If it hasn't been publicly discussed and analyzed for at least year, but is already for sale as a "usable device" not a "prototype", the seller is either fraud or a fool, and regardless of which, is not to be trusted.
Re: OnlyKey: Open-Source Alternative to YubiKey
#94Security keys are the heart of security and we desperately need open-source solutions on this. Kudos for doing it. Now, I must point out a few things: 1. Please don't call your solution "Open-source", when you do not have not even the schematics uploaded to github. 2. (this item is an open problem without a solution yet) how do I make sure the source code and the (still missing) hardware information actually correspo…
The "security" of this device is a joke, just look at how randomness is derived: unsigned int analog1 = analogRead(ANALOGPIN1); RNG.stir((uint8_t *)analog1, sizeof(analog1), sizeof(analog1)*2); unsigned int analog2 = analogRead(ANALOGPIN2); RNG.stir((uint8_t *)analog2, sizeof(analog2), sizeof(analog2)*2); (See [0] for a comprehensive summary of why this is a terrible thing to do) And yeah, analogRead() is a function…
A very simple hardware entropy source is a noisy diode. I wonder why so few people are using it
Re: OnlyKey: Open-Source Alternative to YubiKey
#95This thing seems fishy to me. If you want something that is mostly under your control to which you can install open source stuff into then buy some smart cards and card readers e.g. from https://www.javacardsdk.com
Re: OnlyKey: Open-Source Alternative to YubiKey
#96I honestly don't understand how a YubiKey is supposed to help me secure my accounts if I get locked out of my accounts when I lose it. I an trivially copy a keepass database anywhere and have dozens of backups. If I want to do the same with a YubiKey I first have to buy multiple YubiKeys and then I have to register each one on each site. This means they cannot be used as a primary authentication method because they a…
What do you do when you lose your house key or car key?
Re: OnlyKey: Open-Source Alternative to YubiKey
#97Thanks for all of the interest in OnlyKey! Full disclosure, I work for CryptoTrust and am on the team that makes OnlyKey. I wanted to try to address the questions/concerns in this thread in one place and provide some useful links for more information. OnlyKey started from a successful kickstarter launch in 2016 and has grown to become a popular product for businesses and individuals. - OPEN SOURCE - If you are lookin…
Any chance that key can be used for windows login? I'm searching for a key that also works as a smartcard for winows on prem active directory authentication, as well as FIDO2 support. Or a key that has software which allows this. edit: changes should be chance
Feitian advertises one here https://www.ftsafe.com/Products/FIDO/NFC and they say you can request a dev version so you can install your own applets, but I can't vouch for it yet personally.
Re: OnlyKey: Open-Source Alternative to YubiKey
#98The price seems ridiculous though. $2700?! Exactly what kind of audience is this geared towards?
Re: OnlyKey: Open-Source Alternative to YubiKey
#99Earlier quoted context omitted.
What services allow U2F security keys but don't provide single-use recovery codes as backup?
I don't know about U2F specifically, but recovery codes are not generally a feature of 2FA. Edit: And let me just add why I think this is relevant. Even though few people have dedicated hardware keys today, many 2FA schemes depend on being in possession of a particular phone. There are typically no backups and no recovery codes. I don't think this would necessarily change if specialised key hardware was used more oft…
I assume your bank has a physical place you can go to in order to get another token and you have a proper business relationship with them and somebody will ID you.
But many other sites have no other alternatives to recover so the recovery codes are a nice solution.
Note that I dislike that my bank gives me their specific hardware token. I am not sure why I couldn't use a 'standard' Yubikey instead.
Re: OnlyKey: Open-Source Alternative to YubiKey
#100I honestly don't understand how a YubiKey is supposed to help me secure my accounts if I get locked out of my accounts when I lose it. I an trivially copy a keepass database anywhere and have dozens of backups. If I want to do the same with a YubiKey I first have to buy multiple YubiKeys and then I have to register each one on each site. This means they cannot be used as a primary authentication method because they a…
What do you do when you lose your house key or car key?
Pay someone to crack the security.
How much would it cost to pay someone to "break open" my GMail account if I lost access to all my second factors? I'm guessing more than the ~$150 a locksmith would charge me to break into my house. Probably a number of zeroes at the end more.