Live data from Hacker News

Tell HN: Somu is live. Tiny, FIDO2, open source security key

news.ycombinator.com

1–10 of 15 posts

Tell HN: Somu is live. Tiny, FIDO2, open source security key

#1
Somu is live on Crowd Supply [1].

Somu is the micro version of Solo [2]. We were inspired to make a secure Tomu [3], so we took its tiny form factor, we added the secure microcontroller and firmware of Solo, et voilà! Here we have Somu.

(clickable links in comment)

Re: Tell HN: Somu is live. Tiny, FIDO2, open source security key

#5
Hmm, that $100K stretch goal is pretty much required for me to be able to use this instead of a yubikey. I wonder how likely it is to be met?

The whole "we have to avoid GPL3 code so we're able to keep 'normal' people 'safe'" angle feels pretty icky. But I know lots of people believe in the whole 'trusted' movement. And I suppose having a 'hacker' version /available/ is at least a bit better than what yubico offers.

Re: Tell HN: Somu is live. Tiny, FIDO2, open source security key

#7
post #5

Hmm, that $100K stretch goal is pretty much required for me to be able to use this instead of a yubikey. I wonder how likely it is to be met? The whole "we have to avoid GPL3 code so we're able to keep 'normal' people 'safe'" angle feels pretty icky. But I know lots of people believe in the whole 'trusted' movement. And I suppose having a 'hacker' version /available/ is at least a bit better than what yubico offers.

FYI, openpgp and ssh are already in progress. The stretch goal is mostly to carve out money for ft development.

https://github.com/solokeys/openpgp

Re: Tell HN: Somu is live. Tiny, FIDO2, open source security key

#10
post #5

Hmm, that $100K stretch goal is pretty much required for me to be able to use this instead of a yubikey. I wonder how likely it is to be met? The whole "we have to avoid GPL3 code so we're able to keep 'normal' people 'safe'" angle feels pretty icky. But I know lots of people believe in the whole 'trusted' movement. And I suppose having a 'hacker' version /available/ is at least a bit better than what yubico offers.

Unfortunately, it’s not totally nuts. Designing a system that has replaceable firmware and retains the security properties one would want is nontrivial. Malicious software should not be able to reflash the device without genuine user consent, and any reflagging should wipe all key material. They could do a JavaCard like thing where different apps have different security domains, but that needs either hardware help or complicated software.

IIRC Chromium OS has a little washer that can be physically removed to allow end-user rekeying. Without that washer removed, if you put it in dev mode, you get a warning on the display. Doing this for a reasonable price in the tiny form factor would be tough.

Post reply on HN