15 ms·
Titan Security Key Available
- kobayashi 8y agoPulled?
- kenhwang 8y agoMight be region locked, but it shows for me (North America).
- rekshaw 8y agonot seeing it
- zitterbewegung 8y agoThis is a pretty compelling U2F solution. It matches the price of a Yubikey but you really get a Bluetooth key and a USB version in the box (with a USB C adaptor ?). EDIT : child comment says the USB key also has NFC.
- imbusy111 8y agoYou trade NFC for Bluetooth, but get a back-up key instead of purchasing it separately for another $20. Edit: it seems like the USB key supports NFC, but not the Bluetooth key. From the website: USB Security Key For use with your computer. You can also connect to most Android devices that support USB or NFC.
- craftyguy 8y ago> This is a pretty compelling U2F solution No it's not. It's manufacturered in China, a state devoted to spying on its own citizens to a degree higher than the NSA (social credit scores, etc) and preventing the free flow of information. I wouldn't trust this thing to store my zip code securely, much less a private key.
- zitterbewegung 8y agoThanks for informing me I appreciate it (I’m a happy user of a Yubikey).
- geofft 8y agoSince the key doesn't have wifi or anything, how can the private key flow back to China? (This is a serious question - is there enough wiggle room in the U2F protocol to allow the device to reveal the private key to a Chinese website, if they can trick you into visiting it, or something?)
- craftyguy 8y agoIt's a USB device, it already has the ability to do terrible things[0] when you plug it in. 0. https://www.wired.com/2014/07/usb-security/ https://www.wired.com/2014/07/usb-security/
- geofft 8y agoOK, "the device is secretly a USB Rubber Ducky-style device that will send keyboard shortcuts to open a new tab, send data, and close it" is definitely a potential attack, sure. It would almost certainly be super noticeable (unless everyone else's browsers are much faster at opening and closing tabs than I am) so it seems like the sort of thing you'd only deploy against a couple of high-value targets at some single opportune moment, but that's arguably within Advanced Protection's threat model I guess.
- xenadu02 8y agoThat's easy: The Chinese government could infiltrate the factory and keep a record of the on-chip private key, then kill anyone who doesn't agree to go along with it. Or bug the programming devices. Chinese courts are far from independent - they do as they are ordered by the Communist party, and rulings highly depend on guanxi or connections (family, party, or both). The whole security key thing relies on a chain of trust. Unless you are designing your own chips (and verifying samples of them to ensure nothing has been added), you can't ever really know if some bad actor or state actor has compromised the chain somewhere along the way. So far in the US, such things are not legally required and where ordered by lower courts the appeals courts have overruled them. As it stands today the government can't require anyone outside of a telephone company to implement any technological measure to assist them in spying (telcos are required to assist with wiretaps). Companies might go along with a request of course. I'm not saying there is a perfect solution here, but in general I trust chips and devices manufactured in the US and Sweden to a much higher degree than devices made in China.
- amingilani 8y agoAnd you can't use BLE with your laptop
- ecesena 8y agoThe Titan (& the Feitian) have a usb cable. Digipass Secure Click sells with a ble2usb dongle, that let you use ble with your laptop (I have it fixed into my external monitor for example). Note that it's not a limitation of the security key, it's more the browsers that only implement fido2/u2f (ctap) over usb.
- 394549 8y ago> This is a pretty compelling U2F solution. It matches the price of a Yubikey Not really. The $50 Yubikey does a lot more than these (e.g. storing PGP keys, etc). If you only want U2F, Yubico sells their blue key for only $20 (or a 2-pack for $36): https://www.yubico.com/product/security-key-by-yubico/#security-key https://www.yubico.com/product/security-key-by-yubico/#secur... I've been using them for years and see no reason to switch.
- kaffee 8y agoComparing 2 Yubico Security Keys to the Titan Security Key pack is the correct comparison. Looks like the Titan Security Key (USB) has NFC and the Yubico Security Key does not. And the Titan Security pack has two adapters. I call it a draw.
- btmiller 8y agoOof, you know there're problems with USB-C when even Google in their official press shots show a dongle being used with their hardware key. Not very elegant, is it.
- deleted 8y ago[deleted]
- refulgentis 8y agoThat's quite a leap. Most people don't have USB C, it makes sense to ship A/B and call attention to that unless you're making accessories for specific laptop models.
- AceJohnny2 8y agoThat's just indicative of the state of the market. Likely it wasn't worth it for Google to also manufacture a separate USB-C version.
- ssambros 8y agoIt might still be coming. I hope. I work at Google but have no internal knowledge of whether USB-C version is being considered for production or not. I personally really need one, since that Pixelbook on the product page is actually standing with the help of the USB port, as adapter is much thicker than the laptop itself.
- hunta2097 8y agoI am quickly losing confidence in Google's ability to do hardware. Google Home is the only bright point on an otherwise terrible landscape of hardware releases. Pixel 1 : Great phone but they just couldn't keep the supply chain filled. Pixel 2 : see above. Android Wear / Wear OS : Version 1.x solved all the problems of early Android handsets, by Google taking control of the firmware. Version 2.x completely crippled existing watches to the point of making them unusable. I think this was in a bid to gain more iPhone users. Pixel 3 : It's not out yet and it's already being slated for having a huge notch. Let's hope they can make enough this time. Google is to hardware what Sony Pictures is to movies. You get the odd great release but generally they're bogus.
- pjmlp 8y agoNot in Germany.
- ecesena 8y agoVery sad. FYI, we're going to launch a Kickstarter for Solo, an open source FIDO2 security key (https://solokeys.com https://solokeys.com), and we're planning to offer free shipping in both US and EU. I'm an Italian living in the US, and I personally care a lot about this aspect. It's incredibly sad to see that companies with unlimited resources still completely ignore non-US markets.
- berbec 8y agoIf it's usb-a, nfc & bluetooth for under $50, I'll take 2.
- ecesena 8y agoUsb-a (or -c), and NFC will be available. Price for NFC should be around $30-35, to be confirmed. Plus various Kickstarter discount. We won't have bluetooth, at least in the first iteration. The chip we chose is pin-compatible with another one with BLE, so it's not excluded in the future. Honestly, I really hope Apple will announce a more open NFC next week.
- AdmiralAsshat 8y agoAnd the initial reviews are not great: https://www.androidpolice.com/2018/09/04/google-titan-security-key-review-50-hardware-2fa-bundle-outdated-connectors/ https://www.androidpolice.com/2018/09/04/google-titan-securi... I'll probably stick with my Yubikey for the time being.
- Buge 8y agoWeird that not a single picture here or in the Google store shows the back of either of the keys, especially since this article says both keys have a Google Titan logo on their backs.
- maxwell 8y agoWhy is Google selling potentially compromised Chinese security keys? https://www.zdnet.com/article/google-launches-titan-security-keys-but-recommends-keys-from-chinese-firm-with-military-links-in/ https://www.zdnet.com/article/google-launches-titan-security...
- slenk 8y agoThat whole article is based on a tweet from an IT Consultant saying the Titan key appears to be the same hardware Feitian keys. No proof is offered...
- RachelF 8y agoTake a look here for proof at least from the physical side. https://www.ftsafe.com/products/FIDO/Multi https://www.ftsafe.com/products/FIDO/Multi The case design shape and LED positions are identical. You'll need to check the USB VID and Bluetooth MAC vendor ID's to be sure the hardware inside is the same.
- geofft 8y ago1. Nothing in that article makes me more worried about a Chinese company being potentially compromised than I am worried about a US company being potentially compromised. Every single argument there - performative patriotism, military-industrial complex, government expectations of backdoors - would apply equally well to the US. 2. The threat model makes no sense. Why would Google send you to a compromised vendor of cheap devices with weak radios to falsely secure logins to your Google account, when Google already has control over your Google account? There's a simpler answer, which is that the only vendors that have Android NFC U2F devices are China-based. The YubiKey doesn't support U2F over NFC (at least last I checked). That's why they previously had you get one YubiKey and one Feitian. On that assumption, the most rational thing for Google to do if they have good intentions is to suggest the leading Chinese security key in the short term, and in the medium term, white-label that key's hardware and flash their own firmware (or at least firmware they've audited) onto it and rebrand it, which appears to be exactly what they've done.
- 8y ago
- AnssiH 8y agoAdd /us to the URL so it works outside US: https://store.google.com/us/product/titan_security_key_kit https://store.google.com/us/product/titan_security_key_kit Otherwise users get redirected to the regional stores that do not have it available.
- dotBen 8y agoI still can't tell if these are just rebranded Feitian Multipass keys [0], which I've already owned for several years. Has Google added something that I've missed? [0] https://smile.amazon.com/Feitian-MultiPass-FIDO-Security-Key/dp/B01LYV6TQM?sa-no-redirect=1 https://smile.amazon.com/Feitian-MultiPass-FIDO-Security-Key...)
- postalrat 8y agoThe USB one looks just like the ePass https://www.amazon.com/Feitian-ePass-NFC-FIDO-Security/dp/B01M1R5LRD https://www.amazon.com/Feitian-ePass-NFC-FIDO-Security/dp/B0... Is there any reason to believe at least the hardware isn't rebranded?
- advisedwang 8y agoIt appears to have custom Google firmware (https://cloud.google.com/titan-security-key/ https://cloud.google.com/titan-security-key/)
- deleted 8y ago[deleted]
- iambvk 8y agoIs the software and hardware for this device open-source?
- ecesena 8y agoNo. Disclaimer: I'm working on Solo (https://solokeys.com https://solokeys.com), open source FIDO2 security key, which is the successor of U2F Zero (https://u2fzero.com https://u2fzero.com), open source U2F token.
- tflinton 8y agohttps://www.yubico.com/store/ https://www.yubico.com/store/ Not google's branded version.
- mark_l_watson 8y ago“Use your key to protect your sign-in on a variety of apps and online services beyond Google.‘ I would be interested if I knew for sure that it works also with Fastmail, Twitter, my banks, etc. is there a list of compatible services?
- ac29 8y agohttps://www.dongleauth.info/ https://www.dongleauth.info/
- askvictor 8y agoI'm perplexed at the cost of these. I get that they're aimed at the corporate market, and this is probably spare change from their perspective, but does that mean that the education, small-business and personal markets don't deserve the same level of security? The device must cost a couple of dollars (at most) to manufacture, and I highly doubt the development and service costs add up anything close to the amount they're being sold for, so is the price simply what they can get away with? Security-wise, how does this compare against a (free) phone-based 2FA app (be it TOTP or network based)? I'm not against paying the real cost for a product/service, but this seems to be one where it doesn't add up.
- pvg 8y agoThere's two keys here and some adapters. It costs the same, or a bit less than buying your own keys individually. These counter phishing better than TOTP.
- askvictor 8y agoHow do hardware keys counter phishing better than TOTP?
- pvg 8y agoPhishing site has no access to the additional auth info. With regular 2FA mechanisms, you type that into a browser.
- askvictor 8y agoWith a security key, how does it get from the usb device to the browser? The token I used for my last work (I think it was a yubikey) appeared to the computer as a keyboard, and activating the 'button' on it simply sent a bunch of letters into an input field in a browser. This would be susceptible to phishing in the same way, no?
- LammyL 8y ago
- lysp 8y agoPrevious discussion from 7 days ago (~140 comments): https://news.ycombinator.com/item?id=17875658 https://news.ycombinator.com/item?id=17875658
- dang 8y agoWhoops—missed that one. Thanks!
- ams6110 8y agoFifty dollars. Pardon me for falling on the floor laughing.
- afniljl 8y agoDoes feel like Google putting their brand (and support) behind u2f keys will improve public perception of it. Though understand the concern about it being China made. Hope this means other bigco will come out and improve manufacturing options, distribution options, bring the consumer cost down etc? Qn of why are so few companies selling security keys if it's so important? Is Yubikey the ONLY safe option? agree that cost is still prohibitive for small companies, home consumers, those in countries with weaker forex etc. Security should be able to cost less in order to be more widespread. Current it's like a first world luxury for those who can afford it, to be walled off into a harder-to-attack group like how mac users used to be more secure because there so few of them they were not worth general hacking. Am glad to see Google strongly, actively, loudly pushing anti phishing security forward to all consumers through all their channels, which all other companies can do much more of. Eg if Apple sold a $100 u2f key through all their retail stores etc.
- sbr464 8y agoI had a similar question recently about https/ssl certs being so important and why most major ssl vendor ecommerce sites are so seedy/early 2000s design patterns.
- jenhsun 8y agoTry this if you need U2F. Krypton - A software-based U2F Authenticator (Yubikey) on your phone. https://krypt.co/ https://krypt.co/
- zmix 8y agoOne has to say, that Yubico website is Da Crap! Half of my screen filled with informational void, no comparison table of the products, no easy place, to learn why there is so many different keys, why I can not have a Nano with FIDO2 and so on and so on... It made me really aggressive and I was happey, when I left it. Too much sales pitch, too little info.