5 ms·

Why is Google selling potentially compromised Chinese security keys? https://www.zdnet.com/article/google-launches-titan-security-keys-but-recommends-keys-from

Why is Google selling potentially compromised Chinese security keys? https://www.zdnet.com/article/google-launches-titan-security-keys-but-recommends-keys-from-chinese-firm-with-military-links-in/ https://www.zdnet.com/article/google-launches-titan-security...

slenk 8y ago
That whole article is based on a tweet from an IT Consultant saying the Titan key appears to be the same hardware Feitian keys. No proof is offered...
- RachelF 8y ago
  Take a look here for proof at least from the physical side. https://www.ftsafe.com/products/FIDO/Multi https://www.ftsafe.com/products/FIDO/Multi The case design shape and LED positions are identical. You'll need to check the USB VID and Bluetooth MAC vendor ID's to be sure the hardware inside is the same.
geofft 8y ago
1. Nothing in that article makes me more worried about a Chinese company being potentially compromised than I am worried about a US company being potentially compromised. Every single argument there - performative patriotism, military-industrial complex, government expectations of backdoors - would apply equally well to the US. 2. The threat model makes no sense. Why would Google send you to a compromised vendor of cheap devices with weak radios to falsely secure logins to your Google account, when Google already has control over your Google account? There's a simpler answer, which is that the only vendors that have Android NFC U2F devices are China-based. The YubiKey doesn't support U2F over NFC (at least last I checked). That's why they previously had you get one YubiKey and one Feitian. On that assumption, the most rational thing for Google to do if they have good intentions is to suggest the leading Chinese security key in the short term, and in the medium term, white-label that key's hardware and flash their own firmware (or at least firmware they've audited) onto it and rebrand it, which appears to be exactly what they've done.
- rinon 8y ago
  I believe they also want to support iOS which requires a BTLE token, not NFC which will work on Android devices.
  - NikolaNovak 8y ago
    Does that mean that it would support touch-verification on iOS? [I bought half a dozen yubikeys with NFC last year for my family, setup and tested lastpass, extensively tested my android and PC... when it all fell flat on their iPhone. Whopsie!]
- pixl97 8y ago
  >Nothing in that article makes me more worried about a Chinese company being potentially compromised Unfortunately my anecdotal experience biases me to believe it. After getting hundreds of Microsoft product keys from Dell, and having 20 to 50÷ of them from China being compromised even with the security scratch off intact. Have not ran into an issue with a single us printed one. Ya, no faith here.
- jeremyw 8y ago
  > The YubiKey doesn't support U2F over NFC (at least last I checked). The Yubikey NEO has since 2015, and I use it with Advanced Protection. Brad Hill's author choice here: https://github.com/hillbrad/U2FReviews#neo https://github.com/hillbrad/U2FReviews#neo Personally, I prefer the flat key profile over something bulbous on the keychain.
- xvector 8y ago
  > Nothing in that article makes me more worried about a Chinese company being potentially compromised than I am worried about a US company being potentially compromised. I think that this is a terribly naive assumption. Privacy is cheap if not meaningless in China. The government can request access to server private keys and it often does. Anyone that has tried to deploy a service in China knows that it is an absolute security nightmare because of the security allowances you have to make for the government.
- bassman9000 8y ago
lern_too_spel 8y ago
Why is nearly everyone selling potentially compromised Chinese smartphones?
deleted 8y ago
[deleted]
pvg 8y ago
This article is made up entirely out of innuendo. With the same facts you can write an article about how much Google trusts the design of U2F and this particular hardware to put its name and reputation behind it, ship it to its own Advanced Protection Program customers and hand it out to its own employees.
seppin 8y ago
Everything is made in China, therefore everything is potentially compromised?

slenk 8y ago

That whole article is based on a tweet from an IT Consultant saying the Titan key appears to be the same hardware Feitian keys. No proof is offered...

RachelF 8y ago
Take a look here for proof at least from the physical side. https://www.ftsafe.com/products/FIDO/Multi https://www.ftsafe.com/products/FIDO/Multi The case design shape and LED positions are identical. You'll need to check the USB VID and Bluetooth MAC vendor ID's to be sure the hardware inside is the same.

geofft 8y ago

1. Nothing in that article makes me more worried about a Chinese company being potentially compromised than I am worried about a US company being potentially compromised. Every single argument there - performative patriotism, military-industrial complex, government expectations of backdoors - would apply equally well to the US. 2. The threat model makes no sense. Why would Google send you to a compromised vendor of cheap devices with weak radios to falsely secure logins to your Google account, when Google already has control over your Google account? There's a simpler answer, which is that the only vendors that have Android NFC U2F devices are China-based. The YubiKey doesn't support U2F over NFC (at least last I checked). That's why they previously had you get one YubiKey and one Feitian. On that assumption, the most rational thing for Google to do if they have good intentions is to suggest the leading Chinese security key in the short term, and in the medium term, white-label that key's hardware and flash their own firmware (or at least firmware they've audited) onto it and rebrand it, which appears to be exactly what they've done.

rinon 8y ago
I believe they also want to support iOS which requires a BTLE token, not NFC which will work on Android devices.
- NikolaNovak 8y ago
  Does that mean that it would support touch-verification on iOS? [I bought half a dozen yubikeys with NFC last year for my family, setup and tested lastpass, extensively tested my android and PC... when it all fell flat on their iPhone. Whopsie!]
pixl97 8y ago
>Nothing in that article makes me more worried about a Chinese company being potentially compromised Unfortunately my anecdotal experience biases me to believe it. After getting hundreds of Microsoft product keys from Dell, and having 20 to 50÷ of them from China being compromised even with the security scratch off intact. Have not ran into an issue with a single us printed one. Ya, no faith here.
jeremyw 8y ago
> The YubiKey doesn't support U2F over NFC (at least last I checked). The Yubikey NEO has since 2015, and I use it with Advanced Protection. Brad Hill's author choice here: https://github.com/hillbrad/U2FReviews#neo https://github.com/hillbrad/U2FReviews#neo Personally, I prefer the flat key profile over something bulbous on the keychain.
xvector 8y ago
> Nothing in that article makes me more worried about a Chinese company being potentially compromised than I am worried about a US company being potentially compromised. I think that this is a terribly naive assumption. Privacy is cheap if not meaningless in China. The government can request access to server private keys and it often does. Anyone that has tried to deploy a service in China knows that it is an absolute security nightmare because of the security allowances you have to make for the government.
bassman9000 8y ago

lern_too_spel 8y ago

Why is nearly everyone selling potentially compromised Chinese smartphones?

deleted 8y ago

[deleted]

pvg 8y ago

This article is made up entirely out of innuendo. With the same facts you can write an article about how much Google trusts the design of U2F and this particular hardware to put its name and reputation behind it, ship it to its own Advanced Protection Program customers and hand it out to its own employees.

seppin 8y ago

Everything is made in China, therefore everything is potentially compromised?