5 ms·
1. Nothing in that article makes me more worried about a Chinese company being potentially compromised than I am worried about a US company being potentially co
by geofft 8y ago
1. Nothing in that article makes me more worried about a Chinese company being potentially compromised than I am worried about a US company being potentially compromised. Every single argument there - performative patriotism, military-industrial complex, government expectations of backdoors - would apply equally well to the US.
2. The threat model makes no sense. Why would Google send you to a compromised vendor of cheap devices with weak radios to falsely secure logins to your Google account, when Google already has control over your Google account?
There's a simpler answer, which is that the only vendors that have Android NFC U2F devices are China-based. The YubiKey doesn't support U2F over NFC (at least last I checked). That's why they previously had you get one YubiKey and one Feitian. On that assumption, the most rational thing for Google to do if they have good intentions is to suggest the leading Chinese security key in the short term, and in the medium term, white-label that key's hardware and flash their own firmware (or at least firmware they've audited) onto it and rebrand it, which appears to be exactly what they've done.
- rinon 8y agoI believe they also want to support iOS which requires a BTLE token, not NFC which will work on Android devices.
- NikolaNovak 8y agoDoes that mean that it would support touch-verification on iOS? [I bought half a dozen yubikeys with NFC last year for my family, setup and tested lastpass, extensively tested my android and PC... when it all fell flat on their iPhone. Whopsie!]
- pixl97 8y ago>Nothing in that article makes me more worried about a Chinese company being potentially compromised Unfortunately my anecdotal experience biases me to believe it. After getting hundreds of Microsoft product keys from Dell, and having 20 to 50÷ of them from China being compromised even with the security scratch off intact. Have not ran into an issue with a single us printed one. Ya, no faith here.
- jeremyw 8y ago> The YubiKey doesn't support U2F over NFC (at least last I checked). The Yubikey NEO has since 2015, and I use it with Advanced Protection. Brad Hill's author choice here: https://github.com/hillbrad/U2FReviews#neo https://github.com/hillbrad/U2FReviews#neo Personally, I prefer the flat key profile over something bulbous on the keychain.
- xvector 8y ago> Nothing in that article makes me more worried about a Chinese company being potentially compromised than I am worried about a US company being potentially compromised. I think that this is a terribly naive assumption. Privacy is cheap if not meaningless in China. The government can request access to server private keys and it often does. Anyone that has tried to deploy a service in China knows that it is an absolute security nightmare because of the security allowances you have to make for the government.
- bassman9000 8y agoThe recurring all-state-actors-are-the-same fallacy is getting tiresome. And it's not fear of Google accessing your account, which they already do. Is the Chinese state actor doing so. Which they will.
- geofft 8y ago> And it's not fear of Google accessing your account, which they already do. Is the Chinese state actor doing so. Which they will. Is the claim here that Google is wilfully facilitating China accessing your account? If so, those fears are the same. (If the claim is that Google is unintentionally facilitating this, I think we need a bit more of a story about why Google - which wrote the U2F protocol with Yubico in the first place, and is generally seen to be competent at this - would make this mistake. "They want to make China happy" is the beginning of such a story but not nearly enough.)
- deleted 8y ago[deleted]