4 ms·

This is a pretty compelling U2F solution. It matches the price of a Yubikey but you really get a Bluetooth key and a USB version in the box (with a USB C adapto

This is a pretty compelling U2F solution. It matches the price of a Yubikey but you really get a Bluetooth key and a USB version in the box (with a USB C adaptor ?). EDIT : child comment says the USB key also has NFC.

imbusy111 8y ago
You trade NFC for Bluetooth, but get a back-up key instead of purchasing it separately for another $20. Edit: it seems like the USB key supports NFC, but not the Bluetooth key. From the website: USB Security Key For use with your computer. You can also connect to most Android devices that support USB or NFC.
craftyguy 8y ago
> This is a pretty compelling U2F solution No it's not. It's manufacturered in China, a state devoted to spying on its own citizens to a degree higher than the NSA (social credit scores, etc) and preventing the free flow of information. I wouldn't trust this thing to store my zip code securely, much less a private key.
- zitterbewegung 8y ago
  Thanks for informing me I appreciate it (I’m a happy user of a Yubikey).
- geofft 8y ago
  Since the key doesn't have wifi or anything, how can the private key flow back to China? (This is a serious question - is there enough wiggle room in the U2F protocol to allow the device to reveal the private key to a Chinese website, if they can trick you into visiting it, or something?)
  - craftyguy 8y ago
    It's a USB device, it already has the ability to do terrible things[0] when you plug it in. 0. https://www.wired.com/2014/07/usb-security/ https://www.wired.com/2014/07/usb-security/
    - geofft 8y ago
      OK, "the device is secretly a USB Rubber Ducky-style device that will send keyboard shortcuts to open a new tab, send data, and close it" is definitely a potential attack, sure. It would almost certainly be super noticeable (unless everyone else's browsers are much faster at opening and closing tabs than I am) so it seems like the sort of thing you'd only deploy against a couple of high-value targets at some single opportune moment, but that's arguably within Advanced Protection's threat model I guess.
  - xenadu02 8y ago
    That's easy: The Chinese government could infiltrate the factory and keep a record of the on-chip private key, then kill anyone who doesn't agree to go along with it. Or bug the programming devices. Chinese courts are far from independent - they do as they are ordered by the Communist party, and rulings highly depend on guanxi or connections (family, party, or both). The whole security key thing relies on a chain of trust. Unless you are designing your own chips (and verifying samples of them to ensure nothing has been added), you can't ever really know if some bad actor or state actor has compromised the chain somewhere along the way. So far in the US, such things are not legally required and where ordered by lower courts the appeals courts have overruled them. As it stands today the government can't require anyone outside of a telephone company to implement any technological measure to assist them in spying (telcos are required to assist with wiretaps). Companies might go along with a request of course. I'm not saying there is a perfect solution here, but in general I trust chips and devices manufactured in the US and Sweden to a much higher degree than devices made in China.
  - 394549 8y ago
    > Since the key doesn't have wifi or anything, how can the private key flow back to China? The bluetooth one has a bluetooth radio (obviously). I suppose it's conceivable that the firmware could have a backdoor that allowed exfiltration of the private keys via that radio. Such a backdoor could probably be used in a targeted way against particular people in public places like a airports or cafes. Given that Google is marketing these things towards high-value targets such as journalists, campaign advisors, and Google engineers; building such a backdoor would be very tempting. It wouldn't even have to be present in stock keys, if the shipments could be intercepted in the mail on their way to particular targets.
  - danjoc 8y ago
    >how can the private key flow back to China? You're assuming the key needs to flow back.
- danjoc 8y ago
  It's also manufactured by Google, which is equally adept in spying and probably more unworthy of trust. But more importantly, it's just a bad deal. A yubikey neo can do GPG, PIV, OATH, OTP, HMAC challenge response, and a few other things in addition to NFC U2F for the same price. The Titan dongles package just does U2F, and U2F isn't even that great.
amingilani 8y ago
And you can't use BLE with your laptop
- ecesena 8y ago
  The Titan (& the Feitian) have a usb cable. Digipass Secure Click sells with a ble2usb dongle, that let you use ble with your laptop (I have it fixed into my external monitor for example). Note that it's not a limitation of the security key, it's more the browsers that only implement fido2/u2f (ctap) over usb.
394549 8y ago
> This is a pretty compelling U2F solution. It matches the price of a Yubikey Not really. The $50 Yubikey does a lot more than these (e.g. storing PGP keys, etc). If you only want U2F, Yubico sells their blue key for only $20 (or a 2-pack for $36): https://www.yubico.com/product/security-key-by-yubico/#security-key https://www.yubico.com/product/security-key-by-yubico/#secur... I've been using them for years and see no reason to switch.
- kaffee 8y ago
  Comparing 2 Yubico Security Keys to the Titan Security Key pack is the correct comparison. Looks like the Titan Security Key (USB) has NFC and the Yubico Security Key does not. And the Titan Security pack has two adapters. I call it a draw.

imbusy111 8y ago

You trade NFC for Bluetooth, but get a back-up key instead of purchasing it separately for another $20. Edit: it seems like the USB key supports NFC, but not the Bluetooth key. From the website: USB Security Key For use with your computer. You can also connect to most Android devices that support USB or NFC.

craftyguy 8y ago

> This is a pretty compelling U2F solution No it's not. It's manufacturered in China, a state devoted to spying on its own citizens to a degree higher than the NSA (social credit scores, etc) and preventing the free flow of information. I wouldn't trust this thing to store my zip code securely, much less a private key.

zitterbewegung 8y ago
Thanks for informing me I appreciate it (I’m a happy user of a Yubikey).
geofft 8y ago
Since the key doesn't have wifi or anything, how can the private key flow back to China? (This is a serious question - is there enough wiggle room in the U2F protocol to allow the device to reveal the private key to a Chinese website, if they can trick you into visiting it, or something?)
- craftyguy 8y ago
  It's a USB device, it already has the ability to do terrible things[0] when you plug it in. 0. https://www.wired.com/2014/07/usb-security/ https://www.wired.com/2014/07/usb-security/
  - geofft 8y ago
    OK, "the device is secretly a USB Rubber Ducky-style device that will send keyboard shortcuts to open a new tab, send data, and close it" is definitely a potential attack, sure. It would almost certainly be super noticeable (unless everyone else's browsers are much faster at opening and closing tabs than I am) so it seems like the sort of thing you'd only deploy against a couple of high-value targets at some single opportune moment, but that's arguably within Advanced Protection's threat model I guess.
- xenadu02 8y ago
  That's easy: The Chinese government could infiltrate the factory and keep a record of the on-chip private key, then kill anyone who doesn't agree to go along with it. Or bug the programming devices. Chinese courts are far from independent - they do as they are ordered by the Communist party, and rulings highly depend on guanxi or connections (family, party, or both). The whole security key thing relies on a chain of trust. Unless you are designing your own chips (and verifying samples of them to ensure nothing has been added), you can't ever really know if some bad actor or state actor has compromised the chain somewhere along the way. So far in the US, such things are not legally required and where ordered by lower courts the appeals courts have overruled them. As it stands today the government can't require anyone outside of a telephone company to implement any technological measure to assist them in spying (telcos are required to assist with wiretaps). Companies might go along with a request of course. I'm not saying there is a perfect solution here, but in general I trust chips and devices manufactured in the US and Sweden to a much higher degree than devices made in China.
- 394549 8y ago
  > Since the key doesn't have wifi or anything, how can the private key flow back to China? The bluetooth one has a bluetooth radio (obviously). I suppose it's conceivable that the firmware could have a backdoor that allowed exfiltration of the private keys via that radio. Such a backdoor could probably be used in a targeted way against particular people in public places like a airports or cafes. Given that Google is marketing these things towards high-value targets such as journalists, campaign advisors, and Google engineers; building such a backdoor would be very tempting. It wouldn't even have to be present in stock keys, if the shipments could be intercepted in the mail on their way to particular targets.
- danjoc 8y ago
  >how can the private key flow back to China? You're assuming the key needs to flow back.
danjoc 8y ago
It's also manufactured by Google, which is equally adept in spying and probably more unworthy of trust. But more importantly, it's just a bad deal. A yubikey neo can do GPG, PIV, OATH, OTP, HMAC challenge response, and a few other things in addition to NFC U2F for the same price. The Titan dongles package just does U2F, and U2F isn't even that great.

amingilani 8y ago

And you can't use BLE with your laptop

ecesena 8y ago
The Titan (& the Feitian) have a usb cable. Digipass Secure Click sells with a ble2usb dongle, that let you use ble with your laptop (I have it fixed into my external monitor for example). Note that it's not a limitation of the security key, it's more the browsers that only implement fido2/u2f (ctap) over usb.

394549 8y ago

> This is a pretty compelling U2F solution. It matches the price of a Yubikey Not really. The $50 Yubikey does a lot more than these (e.g. storing PGP keys, etc). If you only want U2F, Yubico sells their blue key for only $20 (or a 2-pack for $36): https://www.yubico.com/product/security-key-by-yubico/#security-key https://www.yubico.com/product/security-key-by-yubico/#secur... I've been using them for years and see no reason to switch.

kaffee 8y ago
Comparing 2 Yubico Security Keys to the Titan Security Key pack is the correct comparison. Looks like the Titan Security Key (USB) has NFC and the Yubico Security Key does not. And the Titan Security pack has two adapters. I call it a draw.