4 ms·

I'm going to take the plunge into using security keys. What are the recommended bluetooth and USB-based keys I should be buying?

shakna 9y ago
Yubikey are probably one of the most available, and most active in fixing bugs as they come up.
moftz 9y ago
I have a Yubico FIDO U2F. It works with tons of sites and services but I usually opt to using 2FA one-time codes since it's quicker (I can pull up the Authy client on my desktop or phone). My key doesn't always work in every computer I have. It works out of the box in Linux but Windows needs to download drivers and the time that takes is more than just doing a one-time code. It is helpful to have, I only need either my keychain or my phone to get into my most important sites and services.
dredmorbius 9y ago
"Google says it supports any keys approved by the FIDO Alliance, a group that manages identity and authentication protocols." -- from the article. This includes USB and Bluetooth LE devices. I'm still getting up to speed on technology, but prefer very near-field chips with a range of < 10cm (4 in), and if possible, < 1cm. Making unintentional / accidental detections, or snooping, as difficult as possible would be a bonus. (It's possible that interactive timing might be a mechanism: a nanosecond-scale time resolution works out to about 10 cm.)
- arnarbi 9y ago
  > It's possible that interactive timing might be a mechanism: a nanosecond-scale time resolution works out to about 10 cm. Unfortunately that requires different radio hardware. Look up Ultra Wide Band.
  - dredmorbius 9y ago
    One of my operating assumptions is that extant systems really aren't suficient. That's going to require some changes and establishment of novel standards. And that means that organisations having sufficient heft to promote and establish such standards need to be involved. As much as I don't trust the current Four Horsemen of the Apocalypse: Google, Amazon, Facebook, and Apple (and the various horse-pages: Microsoft, Oracle, IBM, etc.), they're almost certainly going to be involved. The US government, EU, and possibly interests in China, also. And if you're thinking "but China?!!", remember that they've got their interests in secrets too, and might see a need for a secure and trusted system.
camiller 9y ago
I've been using a (cheap $6) U2F token for a couple years now, but only on desktop, didn't want to spend the money on a NFC one. I'm thinking the feitian ePass one for $16.99 that has both NFC and USB would be good, at least until all computers switch to USB-c only. Of course if you also want RSA key management on top of it your going to spend more money....
- schrectacular 9y ago
  I have the Feitian ePASS FIDO you are talking about. Works great.
  - wakkaflokka 9y ago
    Are there any websites where it doesn't work? Looks like in the comments on Amazon this doesn't work for LastPass. I was looking at getting it instead of a Yubikey. I got their bluetooth/nfc key that Google recommends, but I don't have a bluetooth card on my desktop.
    - schrectacular 9y ago
      It has worked flawlessly everywhere I have tried it (github, Google, Facebook, Dropbox, Fastmail). I don't use lastpass so don't know about that. Not very helpful, I know..
    - camiller 9y ago
      Lastpass says on their FAQ that they wont support Fido U2f until all major browsers do, but that is on them not the key manufacture. https://lastpass.com/support.php?cmd=showfaq&id=8126 https://lastpass.com/support.php?cmd=showfaq&id=8126
dgacmu 9y ago
Why to use security keys: http://fc16.ifca.ai/preproceedings/25_Lang.pdf http://fc16.ifca.ai/preproceedings/25_Lang.pdf (updated from my earlier link to the yubico article about that paper: https://www.yubico.com/2016/02/use-of-fido-u2f-security-keys-focus-of-2-year-google-study/ https://www.yubico.com/2016/02/use-of-fido-u2f-security-keys... ) Review of security keys by Adam Langley: https://www.imperialviolet.org/2017/08/13/securitykeys.html https://www.imperialviolet.org/2017/08/13/securitykeys.html and testing security keys: https://www.imperialviolet.org/2017/10/08/securitykeytest.html https://www.imperialviolet.org/2017/10/08/securitykeytest.ht... tl;dr: Yubikeys are $$ but really solid for USB and NFC; the Feitian is probably the best option for Bluetooth but YMMV there. Those are what I personally use. (Note that Yubico recently announced a problem with their RSA key generation, which they're fixing, but that bug does not affect the security of the device when used as a FIDO authenticator as it is for Google/Github/Dropbox/Vanguard/etc.)
- camiller 9y ago
  I think the Feitian one is NFC
  - dgacmu 9y ago
    You're right. The feitan MultiPass (naming win!) Is the Bluetooth one I use: https://www.amazon.com/Feitian-MultiPass-FIDO-Security-Key/dp/B01LYV6TQM https://www.amazon.com/Feitian-MultiPass-FIDO-Security-Key/d...
- tonyztan 9y ago
  According to Yubico, the RSA vulnerability only affects the YubiKey 4 and "all YubiKey 4 products shipped by Yubico after June 6, 2017 (version 4.3.5 or higher) use" a new implementation that is secure from this. https://www.yubico.com/support/security-advisories/ysa-2017-01/ https://www.yubico.com/support/security-advisories/ysa-2017-...
  - arnarbi 9y ago
    FIDO U2F does not use RSA anyways.
schrectacular 9y ago
To piggyback, I recently bought a couple NFC devices, Feitian ePass FIDO and a Fidesmo Yubikey NEO. I have searched around for information on developing and transferring apps to these devices, but thus far have been unsuccessful. Seems most of the resources are several years old, gpshell appears abandoned and won't compile properly on Ubuntu 16. Any pointers appreciated! I'd love to have PGP support on the Feitian.

shakna 9y ago

Yubikey are probably one of the most available, and most active in fixing bugs as they come up.

moftz 9y ago

I have a Yubico FIDO U2F. It works with tons of sites and services but I usually opt to using 2FA one-time codes since it's quicker (I can pull up the Authy client on my desktop or phone). My key doesn't always work in every computer I have. It works out of the box in Linux but Windows needs to download drivers and the time that takes is more than just doing a one-time code. It is helpful to have, I only need either my keychain or my phone to get into my most important sites and services.

dredmorbius 9y ago

"Google says it supports any keys approved by the FIDO Alliance, a group that manages identity and authentication protocols." -- from the article. This includes USB and Bluetooth LE devices. I'm still getting up to speed on technology, but prefer very near-field chips with a range of < 10cm (4 in), and if possible, < 1cm. Making unintentional / accidental detections, or snooping, as difficult as possible would be a bonus. (It's possible that interactive timing might be a mechanism: a nanosecond-scale time resolution works out to about 10 cm.)

arnarbi 9y ago
> It's possible that interactive timing might be a mechanism: a nanosecond-scale time resolution works out to about 10 cm. Unfortunately that requires different radio hardware. Look up Ultra Wide Band.
- dredmorbius 9y ago
  One of my operating assumptions is that extant systems really aren't suficient. That's going to require some changes and establishment of novel standards. And that means that organisations having sufficient heft to promote and establish such standards need to be involved. As much as I don't trust the current Four Horsemen of the Apocalypse: Google, Amazon, Facebook, and Apple (and the various horse-pages: Microsoft, Oracle, IBM, etc.), they're almost certainly going to be involved. The US government, EU, and possibly interests in China, also. And if you're thinking "but China?!!", remember that they've got their interests in secrets too, and might see a need for a secure and trusted system.

camiller 9y ago

I've been using a (cheap $6) U2F token for a couple years now, but only on desktop, didn't want to spend the money on a NFC one. I'm thinking the feitian ePass one for $16.99 that has both NFC and USB would be good, at least until all computers switch to USB-c only. Of course if you also want RSA key management on top of it your going to spend more money....

schrectacular 9y ago
I have the Feitian ePASS FIDO you are talking about. Works great.
- wakkaflokka 9y ago
  Are there any websites where it doesn't work? Looks like in the comments on Amazon this doesn't work for LastPass. I was looking at getting it instead of a Yubikey. I got their bluetooth/nfc key that Google recommends, but I don't have a bluetooth card on my desktop.
  - schrectacular 9y ago
    It has worked flawlessly everywhere I have tried it (github, Google, Facebook, Dropbox, Fastmail). I don't use lastpass so don't know about that. Not very helpful, I know..
  - camiller 9y ago
    Lastpass says on their FAQ that they wont support Fido U2f until all major browsers do, but that is on them not the key manufacture. https://lastpass.com/support.php?cmd=showfaq&id=8126 https://lastpass.com/support.php?cmd=showfaq&id=8126

dgacmu 9y ago

Why to use security keys: http://fc16.ifca.ai/preproceedings/25_Lang.pdf http://fc16.ifca.ai/preproceedings/25_Lang.pdf (updated from my earlier link to the yubico article about that paper: https://www.yubico.com/2016/02/use-of-fido-u2f-security-keys-focus-of-2-year-google-study/ https://www.yubico.com/2016/02/use-of-fido-u2f-security-keys... ) Review of security keys by Adam Langley: https://www.imperialviolet.org/2017/08/13/securitykeys.html https://www.imperialviolet.org/2017/08/13/securitykeys.html and testing security keys: https://www.imperialviolet.org/2017/10/08/securitykeytest.html https://www.imperialviolet.org/2017/10/08/securitykeytest.ht... tl;dr: Yubikeys are $$ but really solid for USB and NFC; the Feitian is probably the best option for Bluetooth but YMMV there. Those are what I personally use. (Note that Yubico recently announced a problem with their RSA key generation, which they're fixing, but that bug does not affect the security of the device when used as a FIDO authenticator as it is for Google/Github/Dropbox/Vanguard/etc.)

camiller 9y ago
I think the Feitian one is NFC
- dgacmu 9y ago
  You're right. The feitan MultiPass (naming win!) Is the Bluetooth one I use: https://www.amazon.com/Feitian-MultiPass-FIDO-Security-Key/dp/B01LYV6TQM https://www.amazon.com/Feitian-MultiPass-FIDO-Security-Key/d...
tonyztan 9y ago
According to Yubico, the RSA vulnerability only affects the YubiKey 4 and "all YubiKey 4 products shipped by Yubico after June 6, 2017 (version 4.3.5 or higher) use" a new implementation that is secure from this. https://www.yubico.com/support/security-advisories/ysa-2017-01/ https://www.yubico.com/support/security-advisories/ysa-2017-...
- arnarbi 9y ago
  FIDO U2F does not use RSA anyways.

schrectacular 9y ago

To piggyback, I recently bought a couple NFC devices, Feitian ePass FIDO and a Fidesmo Yubikey NEO. I have searched around for information on developing and transferring apps to these devices, but thus far have been unsuccessful. Seems most of the resources are several years old, gpshell appears abandoned and won't compile properly on Ubuntu 16. Any pointers appreciated! I'd love to have PGP support on the Feitian.