10 ms·

Solo – Open-source FIDO2 security key

74 points by ecesena 8y ago

zaarn 8y ago
That's great to see that this is going kickstarter, I'll throw in something for a solo key later. Seems this is also a lot cheaper than a yubikey while also being fairly hackable. Great job <3
- ecesena 8y ago
  Thank you so much! It's been an adventure... it's incredibly exciting to be live. And the support we've received is beyond any expectation, we reached the goal in 19 minutes!
- tanderson92 8y ago
  I don't see any mention of smartcard/PGP features (or rsa4096), which makes this a non-starter for me. Sometimes the extra cost is associated with extra features.
  - ecesena 8y ago
    We're working on it, it's been the top feature request. We didn't want to over promise in the Kickstarter, but we support firmware upgrade, so it'll be easy to add as soon as it's ready.
    - tanderson92 8y ago
      Thanks! That’s awesome to hear.
lhlmgr 8y ago
already pledged! Was looking forward to it! Keep up!
nimbius 8y ago
pledged 50! looking forward to seeing a little openPGP on this guy!
ecesena 8y ago
For those interested, this is the open source code: https://github.com/SoloKeysSec/solo https://github.com/SoloKeysSec/solo
craftyguy 8y ago
Does the 'solo tap' require additional software on an Android device? For example, would this work with LineageOS or does it require some google blob crap?
- ecesena 8y ago
  FIDO2 is standardized and backward compatible with U2F, so any browser (or app) with this support should work. Specifically, they should support CTAP1/2 over NFC (or USB). I asked in the team, we're not really familiar with LineageOS, but we'll try to do some tests.
  - craftyguy 8y ago
    Thanks for the response. LineageOS is just a fork of AOSP, and doesn't ship any google blobs that you would find in the android images from google and most manufacturers.
hiven 8y ago
Awesome! Pledged
madjam002 8y ago
Looks awesome. One thing though regarding iOS - I hope Apple don't just open up NFC more, but implement FIDO2 (CTAP2 and Webauthn) utilizing the secure enclave on the device with Face ID. I don't know enough about it, but surely it should be possible and it would make for a great user experience if they did!
- tstevens 8y ago
  They are implementing Webauthn in webkit (including iOS) https://bugs.webkit.org/show_bug.cgi?id=181943 https://bugs.webkit.org/show_bug.cgi?id=181943 Looks like NFC support may be coming as well https://bugs.webkit.org/show_bug.cgi?id=188624 https://bugs.webkit.org/show_bug.cgi?id=188624
  - madjam002 8y ago
    Oh wow I had no idea, I will be keeping an eye out for those! Thanks for the links!
- maltalex 8y ago
  In May Yubico announced IOS support for their nfc keys: https://www.yubico.com/2018/05/yubikey-comes-to-iphone-with-mobile-sdk-for-ios-and-lastpass-support/ https://www.yubico.com/2018/05/yubikey-comes-to-iphone-with-...
red_admiral 8y ago
If any FIDO experts are reading this, two technical questions: 1. Is there anything in the standard about proving to the server that you have a genuine FIDO device that meets certain standards, and not say a piece of software that is merely pretending to be a hardware security module? If so, I presume the Solo will come with whatever certification / digital signature is required? 2. My understanding of FIDO (v1) is that the only function a device has to offer is authentication through digital signature, so a FIDO v1 device is no use as an extra authentication factor to unlock a password manager without "cloud" support (such as pwsafe) as it doesn't provide you with anything that a hacker couldn't work around - as opposed to a token that stores a cryptographic key and releases it when you press the button (which you can set up a yubikey to do). Is this correct, and does FIDO2 change this situation?
- bsder 8y ago
  From looking at the design docs, Solo doesn't use the ARM TrustZone, yet, so it can't validate firmware.
- agl 8y ago
  > Is there anything in the standard about proving to the server that you have a genuine FIDO device Yes. When registering a credential you can request[1] attestation information. Generally this will come in the form of an X.509 certificate[2] per batch of 100,000 devices which is signed by the manufacturer and which signs the generated key. FIDO is planning on running a central registry[3] of devices which should include their certifications and manufacturer public keys etc. For more details, see [4]. > My understanding of FIDO (v1) is that the only function a device has to offer is authentication through digital signature. That's correct: CTAP1 just signs things. You can prove to a remote service that the credential is in live use right now because it signs over a server-provided nonce to show freshness, but that's all. With CTAP2, devices can store keys themselves and they can provide a random oracle (i.e. HMAC) for unlocking locally encrypted data[5]. FIDO2 devices can also require a PIN to be provided before keys are released. (Or have a local fingerprint reader, although I don't know of any such devices yet.) [1] https://www.w3.org/TR/webauthn/#attestation-convey https://www.w3.org/TR/webauthn/#attestation-convey [2] https://www.w3.org/TR/webauthn/#fido-u2f-attestation https://www.w3.org/TR/webauthn/#fido-u2f-attestation [3] https://fidoalliance.org/mds/ https://fidoalliance.org/mds/ [4] https://www.imperialviolet.org/2018/03/27/webauthn.html#attestation https://www.imperialviolet.org/2018/03/27/webauthn.html#atte... [5] https://fidoalliance.org/specs/fido-v2.0-rd-20180702/fido-client-to-authenticator-protocol-v2.0-rd-20180702.html#sctn-hmac-secret-extension https://fidoalliance.org/specs/fido-v2.0-rd-20180702/fido-cl...
Bedon292 8y ago
Why would I choose this over the Yubikey, or even Google's offering? And I didn't see on the kickstarter (I may have missed it), where are these being produced? I know people were not interested in Google's because they were being made in China.
- red_admiral 8y ago
  I think "open source" is the key selling point, along with being able to hack on the hardware and reflash the firmware. I'm 5/5 happy with my current yubikeys, but I'm also really glad that there's competition in this area and not a monoculture.
  - ecesena 8y ago
    I'm also 5/5 happy with my yubikeys! Yubico is also a very open company. What is closed today is the industry of secure processors, and this is what we hope we can change. Plus, with more and more open source, we can expect more and more adoption of the standard. Ten years ago there was spam, now it's gone. Now there's phishing, maybe in a few years it'll be gone too.
- ecesena 8y ago
  Openness? Price? Colors? NFC+USB-C? I guess it depends, we're just offering more choice. For the production. The ST processor is fabricated in Europe. The PCBs are assembled in China. The programming and testing is done in the US.
ChairBending 8y ago
Solo has some sexual connotation that’s difficult to justify. Too late to change it I guess?
- klez 8y ago
  "Solo" is also a term used in music and the last name of a popular science fiction character. Should those be changed too?
subway 8y ago
$200K - Hidden Surprise! I'm not sure how much I like an open source security appliance coming with a "hidden surprise".
- ecesena 8y ago
  Thank you for the feedback - Just to clarify, stretch goals won't touch hardware/security, just special offers that everybody can benefit from. Examples more colors, free upgrade to usb-c.
maltalex 8y ago
Congrats for launching! The kickstarter page mentions that Solo supports U2F and Fido2. What else does it support? Is it like the Yubico "security key" with just U2F and fido2 or does it support OTP, OpenPGP, Smart cards, PKCS11? How long are the keys it stores? Oh, and if it doesn't support some or any of that stuff, is it a software or a hardware limitation?
- red_admiral 8y ago
  "By having singed code we can offer firmware upgrade, to release new features such as OpenPGP ..." I read this as they don't support OpenPGP yet, but they do say "256 KB of memory to support hardened crypto implementations and OpenPGP" so I'd guess it's on the to-do list.
  - ecesena 8y ago
    Yes, correct. Top feature request so far. We're just really busy with the Kickstarter now, so we can't commit on a date yet.
jxcl 8y ago
Right now the killer feature of yubikeys for me is the fact that they're waterproof and have no physical buttons to wear out, making them effectively indestructible on my keychain. I'm still waiting for another manufacturer to even come close to the physical design of yubikeys.
- ecesena 8y ago
  For the button we explicitly wanted to do something different because some people like the physical feedback. But being open, you can take the design, change the button to be a touch sensor, and make your own. If anyone does it, please keep us posted, we want to support you!
mike-cardwell 8y ago
Looks good, but the form factor of the Yubikey Nano is much nicer for laptops. Once it's in, you just leave it in there, and you don't need to worry about knocking/bending/snapping it. I could see one of these living in my desktop, but then I'd choose a Yubikey over it again for the OpenPGP support. I'm already using a separate Yubikey with my phone over NFC. I'm pretty sure that wont work when I get my librem 5 though. I don't even think that's coming with NFC. But my new option for Librem will probably end up being another Yubikey instead of this. Specifically the 4C Nano, as I will hopefully be able to stick it in the phones USB-C port and let it live there whilst it's not charging. So, looks good, but not for me. Hopefully you're a success and are able to bring out some different form factors at some point in the future.
- hoos97 8y ago
  You only have to leave the key in by choice. For example, I use my Solo to authenticate login for google. But, I only need it on login....which really doesn't happen very often from my laptop. So, I am not leaving my key embedded in my laptop, which presents a problem if you actually have your laptop lifted at Starbucks!
  - mike-cardwell 8y ago
    Yeah, I choose to leave it in there, so I don't have to think about it. For me, that's the thing that finally switched using 2FA from being a burden, to neutral. I have multiple Yubikeys, and fall back to TOTP on my phone and watch, so if my laptop is lifted, I will care about the financial/inconvenience loss of the laptop, but not the Yubikey.
sctb 8y ago
We've removed “Show HN” on account of a previous one: https://news.ycombinator.com/item?id=18035079 https://news.ycombinator.com/item?id=18035079 also discussed here: https://news.ycombinator.com/item?id=17778262 https://news.ycombinator.com/item?id=17778262
- ecesena 8y ago
  I’ve originally put Show because this is the product, the previous was the firmware, but ok. Did you also apply a penalty? We jumped from #4 to #50, and we have more votes, comments, and are newer than nyt currently in fp.
- itp 8y ago
  That's a shame, since this one is announcing the kickstarter, and those weren't. And there was obvious interest, as well as interesting discussion, on this post.
  - ecesena 8y ago
    Actually, we've received a clarification. 1) fundraisers are excluded from Show HN, it's in the FAQ, and sorry I missed that. 2) the community is generally sensitive to being marketed, and as much as we were enjoying the discussion, others flagged/reported this post. Everything considered, this is a fair decision.
liuw 8y ago
I'm really excited to see this project. Looking forward to receiving my two Solo Tap keys! P.S. OpenPGP is a must for me. Hope to see update for that soon.
ac29 8y ago
"Note that to reflash a regular Solo key you have to connect via the debug interface, as for security reasons our firmware only allows signed code upgrade" Which debug interface is this? JTAG? Something else?
- ecesena 8y ago
  Conor wrote a post about this: https://conorpp.com/3d-printing-a-programming-jig-and-embedding-pogo-pins-using-eagle-and-fusion-360 https://conorpp.com/3d-printing-a-programming-jig-and-embedd... We're planning to release the Solo for Hackers "unlocked", meaning we'll disable the check for signed upgrade, so it'll be easier to flash also via usb.

74 points by ecesena 8y ago

That's great to see that this is going kickstarter, I'll throw in something for a solo key later. Seems this is also a lot cheaper than a yubikey while also being fairly hackable. Great job <3

ecesena 8y ago
Thank you so much! It's been an adventure... it's incredibly exciting to be live. And the support we've received is beyond any expectation, we reached the goal in 19 minutes!
tanderson92 8y ago
I don't see any mention of smartcard/PGP features (or rsa4096), which makes this a non-starter for me. Sometimes the extra cost is associated with extra features.
- ecesena 8y ago
  We're working on it, it's been the top feature request. We didn't want to over promise in the Kickstarter, but we support firmware upgrade, so it'll be easy to add as soon as it's ready.
  - tanderson92 8y ago
    Thanks! That’s awesome to hear.

lhlmgr 8y ago

already pledged! Was looking forward to it! Keep up!

nimbius 8y ago

pledged 50! looking forward to seeing a little openPGP on this guy!

ecesena 8y ago

For those interested, this is the open source code: https://github.com/SoloKeysSec/solo https://github.com/SoloKeysSec/solo

craftyguy 8y ago

Does the 'solo tap' require additional software on an Android device? For example, would this work with LineageOS or does it require some google blob crap?

ecesena 8y ago
FIDO2 is standardized and backward compatible with U2F, so any browser (or app) with this support should work. Specifically, they should support CTAP1/2 over NFC (or USB). I asked in the team, we're not really familiar with LineageOS, but we'll try to do some tests.
- craftyguy 8y ago
  Thanks for the response. LineageOS is just a fork of AOSP, and doesn't ship any google blobs that you would find in the android images from google and most manufacturers.

hiven 8y ago

Awesome! Pledged

madjam002 8y ago

Looks awesome. One thing though regarding iOS - I hope Apple don't just open up NFC more, but implement FIDO2 (CTAP2 and Webauthn) utilizing the secure enclave on the device with Face ID. I don't know enough about it, but surely it should be possible and it would make for a great user experience if they did!

tstevens 8y ago
They are implementing Webauthn in webkit (including iOS) https://bugs.webkit.org/show_bug.cgi?id=181943 https://bugs.webkit.org/show_bug.cgi?id=181943 Looks like NFC support may be coming as well https://bugs.webkit.org/show_bug.cgi?id=188624 https://bugs.webkit.org/show_bug.cgi?id=188624
- madjam002 8y ago
  Oh wow I had no idea, I will be keeping an eye out for those! Thanks for the links!
maltalex 8y ago
In May Yubico announced IOS support for their nfc keys: https://www.yubico.com/2018/05/yubikey-comes-to-iphone-with-mobile-sdk-for-ios-and-lastpass-support/ https://www.yubico.com/2018/05/yubikey-comes-to-iphone-with-...

red_admiral 8y ago

If any FIDO experts are reading this, two technical questions: 1. Is there anything in the standard about proving to the server that you have a genuine FIDO device that meets certain standards, and not say a piece of software that is merely pretending to be a hardware security module? If so, I presume the Solo will come with whatever certification / digital signature is required? 2. My understanding of FIDO (v1) is that the only function a device has to offer is authentication through digital signature, so a FIDO v1 device is no use as an extra authentication factor to unlock a password manager without "cloud" support (such as pwsafe) as it doesn't provide you with anything that a hacker couldn't work around - as opposed to a token that stores a cryptographic key and releases it when you press the button (which you can set up a yubikey to do). Is this correct, and does FIDO2 change this situation?

bsder 8y ago
From looking at the design docs, Solo doesn't use the ARM TrustZone, yet, so it can't validate firmware.
agl 8y ago
> Is there anything in the standard about proving to the server that you have a genuine FIDO device Yes. When registering a credential you can request[1] attestation information. Generally this will come in the form of an X.509 certificate[2] per batch of 100,000 devices which is signed by the manufacturer and which signs the generated key. FIDO is planning on running a central registry[3] of devices which should include their certifications and manufacturer public keys etc. For more details, see [4]. > My understanding of FIDO (v1) is that the only function a device has to offer is authentication through digital signature. That's correct: CTAP1 just signs things. You can prove to a remote service that the credential is in live use right now because it signs over a server-provided nonce to show freshness, but that's all. With CTAP2, devices can store keys themselves and they can provide a random oracle (i.e. HMAC) for unlocking locally encrypted data[5]. FIDO2 devices can also require a PIN to be provided before keys are released. (Or have a local fingerprint reader, although I don't know of any such devices yet.) [1] https://www.w3.org/TR/webauthn/#attestation-convey https://www.w3.org/TR/webauthn/#attestation-convey [2] https://www.w3.org/TR/webauthn/#fido-u2f-attestation https://www.w3.org/TR/webauthn/#fido-u2f-attestation [3] https://fidoalliance.org/mds/ https://fidoalliance.org/mds/ [4] https://www.imperialviolet.org/2018/03/27/webauthn.html#attestation https://www.imperialviolet.org/2018/03/27/webauthn.html#atte... [5] https://fidoalliance.org/specs/fido-v2.0-rd-20180702/fido-client-to-authenticator-protocol-v2.0-rd-20180702.html#sctn-hmac-secret-extension https://fidoalliance.org/specs/fido-v2.0-rd-20180702/fido-cl...

Bedon292 8y ago

Why would I choose this over the Yubikey, or even Google's offering? And I didn't see on the kickstarter (I may have missed it), where are these being produced? I know people were not interested in Google's because they were being made in China.

red_admiral 8y ago
I think "open source" is the key selling point, along with being able to hack on the hardware and reflash the firmware. I'm 5/5 happy with my current yubikeys, but I'm also really glad that there's competition in this area and not a monoculture.
- ecesena 8y ago
  I'm also 5/5 happy with my yubikeys! Yubico is also a very open company. What is closed today is the industry of secure processors, and this is what we hope we can change. Plus, with more and more open source, we can expect more and more adoption of the standard. Ten years ago there was spam, now it's gone. Now there's phishing, maybe in a few years it'll be gone too.
ecesena 8y ago
Openness? Price? Colors? NFC+USB-C? I guess it depends, we're just offering more choice. For the production. The ST processor is fabricated in Europe. The PCBs are assembled in China. The programming and testing is done in the US.

ChairBending 8y ago

Solo has some sexual connotation that’s difficult to justify. Too late to change it I guess?

klez 8y ago
"Solo" is also a term used in music and the last name of a popular science fiction character. Should those be changed too?

subway 8y ago

$200K - Hidden Surprise! I'm not sure how much I like an open source security appliance coming with a "hidden surprise".

ecesena 8y ago
Thank you for the feedback - Just to clarify, stretch goals won't touch hardware/security, just special offers that everybody can benefit from. Examples more colors, free upgrade to usb-c.

maltalex 8y ago

Congrats for launching! The kickstarter page mentions that Solo supports U2F and Fido2. What else does it support? Is it like the Yubico "security key" with just U2F and fido2 or does it support OTP, OpenPGP, Smart cards, PKCS11? How long are the keys it stores? Oh, and if it doesn't support some or any of that stuff, is it a software or a hardware limitation?

red_admiral 8y ago
"By having singed code we can offer firmware upgrade, to release new features such as OpenPGP ..." I read this as they don't support OpenPGP yet, but they do say "256 KB of memory to support hardened crypto implementations and OpenPGP" so I'd guess it's on the to-do list.
- ecesena 8y ago
  Yes, correct. Top feature request so far. We're just really busy with the Kickstarter now, so we can't commit on a date yet.

jxcl 8y ago

Right now the killer feature of yubikeys for me is the fact that they're waterproof and have no physical buttons to wear out, making them effectively indestructible on my keychain. I'm still waiting for another manufacturer to even come close to the physical design of yubikeys.

ecesena 8y ago
For the button we explicitly wanted to do something different because some people like the physical feedback. But being open, you can take the design, change the button to be a touch sensor, and make your own. If anyone does it, please keep us posted, we want to support you!

mike-cardwell 8y ago

Looks good, but the form factor of the Yubikey Nano is much nicer for laptops. Once it's in, you just leave it in there, and you don't need to worry about knocking/bending/snapping it. I could see one of these living in my desktop, but then I'd choose a Yubikey over it again for the OpenPGP support. I'm already using a separate Yubikey with my phone over NFC. I'm pretty sure that wont work when I get my librem 5 though. I don't even think that's coming with NFC. But my new option for Librem will probably end up being another Yubikey instead of this. Specifically the 4C Nano, as I will hopefully be able to stick it in the phones USB-C port and let it live there whilst it's not charging. So, looks good, but not for me. Hopefully you're a success and are able to bring out some different form factors at some point in the future.

hoos97 8y ago
You only have to leave the key in by choice. For example, I use my Solo to authenticate login for google. But, I only need it on login....which really doesn't happen very often from my laptop. So, I am not leaving my key embedded in my laptop, which presents a problem if you actually have your laptop lifted at Starbucks!
- mike-cardwell 8y ago
  Yeah, I choose to leave it in there, so I don't have to think about it. For me, that's the thing that finally switched using 2FA from being a burden, to neutral. I have multiple Yubikeys, and fall back to TOTP on my phone and watch, so if my laptop is lifted, I will care about the financial/inconvenience loss of the laptop, but not the Yubikey.

sctb 8y ago

We've removed “Show HN” on account of a previous one: https://news.ycombinator.com/item?id=18035079 https://news.ycombinator.com/item?id=18035079 also discussed here: https://news.ycombinator.com/item?id=17778262 https://news.ycombinator.com/item?id=17778262

ecesena 8y ago
I’ve originally put Show because this is the product, the previous was the firmware, but ok. Did you also apply a penalty? We jumped from #4 to #50, and we have more votes, comments, and are newer than nyt currently in fp.
itp 8y ago
That's a shame, since this one is announcing the kickstarter, and those weren't. And there was obvious interest, as well as interesting discussion, on this post.
- ecesena 8y ago
  Actually, we've received a clarification. 1) fundraisers are excluded from Show HN, it's in the FAQ, and sorry I missed that. 2) the community is generally sensitive to being marketed, and as much as we were enjoying the discussion, others flagged/reported this post. Everything considered, this is a fair decision.

liuw 8y ago

I'm really excited to see this project. Looking forward to receiving my two Solo Tap keys! P.S. OpenPGP is a must for me. Hope to see update for that soon.

ac29 8y ago

"Note that to reflash a regular Solo key you have to connect via the debug interface, as for security reasons our firmware only allows signed code upgrade" Which debug interface is this? JTAG? Something else?

ecesena 8y ago
Conor wrote a post about this: https://conorpp.com/3d-printing-a-programming-jig-and-embedding-pogo-pins-using-eagle-and-fusion-360 https://conorpp.com/3d-printing-a-programming-jig-and-embedd... We're planning to release the Solo for Hackers "unlocked", meaning we'll disable the check for signed upgrade, so it'll be easier to flash also via usb.