5 ms·

Nitrokey[1] is about the same price as Yubico but has open source firmware & hardware. You might also know them as CryptoStick[2]. [1] https://www.nitrokey.com

by deno 11y ago

Nitrokey[1] is about the same price as Yubico but has open source firmware & hardware. You might also know them as CryptoStick[2]. [1] https://www.nitrokey.com/ https://www.nitrokey.com/ [2] https://blog.mozilla.org/security/2013/02/13/using-cryptostick-as-an-hsm/ https://blog.mozilla.org/security/2013/02/13/using-cryptosti...

StavrosK 11y ago
That looks very nice, but it's rather more expensive than the Yubikey. The latter has NFC+U2F in a stick costing $50, whereas the former costs $50 for a stick that has neither.
- deno 11y ago
  What’s the use case for NFC?
  - mike-cardwell 11y ago
    Using PGP on your smartphone without giving it access to your PGP key - https://grepular.com/An_NFC_PGP_SmartCard_For_Android https://grepular.com/An_NFC_PGP_SmartCard_For_Android - That's how I use it anyway.
  - justinjlynn 11y ago
    For usage with mobile applications, where NFC is typically available but USB Host is not, I would imagine.
    - JohnTHaller 11y ago
      On Android, you typically have USB host (at least on any phone that someone interested in this tech would buy). On iOS it's moot since NFC is gimped and can't be used by apps.
      - lorenzhs 11y ago
        Most people don't carry the necessary cable around with them, though. NFC doesn't require any additional hardware. I use it for generating 2FA codes, Yubico Authenticator works like Google Authenticator except that it requires touching the YubiKey to the phone before it shows the 2FA codes. The codes are computed on the YubiKey: https://github.com/Yubico/yubioath-android/blob/63387c02a39be5d22e688aa9305a54eed1f40916/app/src/main/java/com/yubico/yubioath/model/YubiKeyNeo.java#L317 https://github.com/Yubico/yubioath-android/blob/63387c02a39b...
peterhadlaw 11y ago
This looks really neat. Anyone also use these? Thoughts? I might get myself one. Edit: Also, does this have gpg-agent / ssh support?
- bruo 11y ago
  I tried the pro model but went back to the FST-01 as it was too slow for RSA 4096 and doesn't support curve25519 for sign/auth. But, yes, it does work with gpg-agent with ssh support.
- mike-cardwell 11y ago
  Can confirm what bruo said. I use my Yubikey Neo with gpg-agent with "--enable-ssh-support" enabled for ssh agent support.
jvehent 11y ago
My colleague Guillaume Destuynder wrote that blog post. We still use CryptoSticks at Mozilla, with sops[1] to securely store backup keys of some of our secrets files. [1] https://github.com/mozilla/sops https://github.com/mozilla/sops

by deno 11y ago

StavrosK 11y ago

That looks very nice, but it's rather more expensive than the Yubikey. The latter has NFC+U2F in a stick costing $50, whereas the former costs $50 for a stick that has neither.

deno 11y ago
What’s the use case for NFC?
- mike-cardwell 11y ago
  Using PGP on your smartphone without giving it access to your PGP key - https://grepular.com/An_NFC_PGP_SmartCard_For_Android https://grepular.com/An_NFC_PGP_SmartCard_For_Android - That's how I use it anyway.
- justinjlynn 11y ago
  For usage with mobile applications, where NFC is typically available but USB Host is not, I would imagine.
  - JohnTHaller 11y ago
    On Android, you typically have USB host (at least on any phone that someone interested in this tech would buy). On iOS it's moot since NFC is gimped and can't be used by apps.
    - lorenzhs 11y ago
      Most people don't carry the necessary cable around with them, though. NFC doesn't require any additional hardware. I use it for generating 2FA codes, Yubico Authenticator works like Google Authenticator except that it requires touching the YubiKey to the phone before it shows the 2FA codes. The codes are computed on the YubiKey: https://github.com/Yubico/yubioath-android/blob/63387c02a39be5d22e688aa9305a54eed1f40916/app/src/main/java/com/yubico/yubioath/model/YubiKeyNeo.java#L317 https://github.com/Yubico/yubioath-android/blob/63387c02a39b...

peterhadlaw 11y ago

This looks really neat. Anyone also use these? Thoughts? I might get myself one. Edit: Also, does this have gpg-agent / ssh support?

bruo 11y ago
I tried the pro model but went back to the FST-01 as it was too slow for RSA 4096 and doesn't support curve25519 for sign/auth. But, yes, it does work with gpg-agent with ssh support.
mike-cardwell 11y ago
Can confirm what bruo said. I use my Yubikey Neo with gpg-agent with "--enable-ssh-support" enabled for ssh agent support.

jvehent 11y ago

My colleague Guillaume Destuynder wrote that blog post. We still use CryptoSticks at Mozilla, with sops[1] to securely store backup keys of some of our secrets files. [1] https://github.com/mozilla/sops https://github.com/mozilla/sops