8 ms·

There are plenty of fingerprint readers on the market, doesn't really excite me because it just makes it 2-in-1. What does excite me? Smart rings like https://

by xaduha 6y ago

There are plenty of fingerprint readers on the market, doesn't really excite me because it just makes it 2-in-1. What does excite me? Smart rings like https://store.nfcring.com/products/omni https://store.nfcring.com/products/omni

paxys 6y ago
Funny enough their own demo (from the parent article) is on a MacBook Air with built-in Touch ID.
- OJFord 6y ago
  Yes but any MacBook Air, not just one you've previously provisioned to recognise your fingerprint. The selling point here isn't 'yet another external fingerprint reader', it's 'portable fingerprint-authenticated OpenPGP smart card'.
  - Boulth6 6y ago
    The press release mentions only FIDO2. Where did you get the OpenPGP smart card bit?
    - michaelt 6y ago
      If they're releasing a fingerprint-scanning version, I'd be surprised if it wasn't available with all the capabilities of the YubiKey 5 (which has OpenPGP support) for people willing to pay.
    - OJFord 6y ago
      I just assumed, but I think you're right that it doesn't. (Though I wouldn't be surprised if it followed, Yubikey's first FIDO key was also just that, but now they all do it.) My main point though was that it's not a device-specific authentication, or even an external reader for unlocking a secret provisioned onto one or many devices, it is the sole thing needed, so you can walk up to a new device and use it without provisioning it with secrets. An OpenPGP one would be cool though - replace passphrase with fingerprint.
- tiziano88 6y ago
  this is a "roaming authenticator", meaning it is meant to be used across devices. After enrolling it, it may be stored away safely, e.g. in a safe, or used on other devices to log in (or perform crypto operations) with the same credentials.
ryukafalz 6y ago
I have been very tempted to get one of those. Two reasons I haven't yet: - It's a Type B card, and apparently most devices refuse to operate with Type B cards as FIDO2 authenticators: https://github.com/LedgerHQ/ledger-u2f-javacard/issues/12 https://github.com/LedgerHQ/ledger-u2f-javacard/issues/12 - I'd otherwise like to use it as a GPG card, but it's unclear if NFC-only GPG cards work with desktop gnupg. Maybe they do and I'm just missing the documentation for it.
- xaduha 6y ago
  > it's unclear if NFC-only GPG cards work with desktop gnupg If you mean this applet https://developers.yubico.com/ykneo-openpgp/Releases https://developers.yubico.com/ykneo-openpgp/Releases then it would work just fine, you just need a proper contactless PC/SC reader. I don't have this ring, but I did use a smartcard with the applet to login to a server via the phone with https://play.google.com/store/apps/details?id=org.sufficientlysecure.termbot https://play.google.com/store/apps/details?id=org.sufficient...
  - ryukafalz 6y ago
    How does gnupg interact with contactless cards? I know for a contact smartcard if I try to perform an operation with the card not present, I get a prompt to insert the card, and then I get a prompt to enter the PIN when inserting the card and continuing. A contactless card in a ring form-factor is unlikely to be on the reader for long, though... is gnupg aware of contactless readers and will it e.g. ask for your PIN without the card being present and then prompt you to tap the card? I'm aware that's what Android apps like OpenKeychain do, but I haven't been able to find much information on how gnupg/pinentry/etc behave with contactless cards.
    - xaduha 6y ago
      If you have experience with contact cards, then it's all the same as far as end applications are concerned, it's abstracted away. > is gnupg aware of contactless readers and will it e.g. ask for your PIN without the card being present and then prompt you to tap the card? No, it will behave as if there's no card/ring if you don't have it around the reader. Software polish is a weak point, e.g things like `ssh-add -s /usr/lib/opensc-pkcs11.so` can be used to 'cache' the PIN for a session as far as `ssh -A` connection is concerned, but that's not exactly the height of usability.
iam-TJ 6y ago
Thanks for the link - this is an ideal solution to the problem of forgetting to carry, or mislaying, tokens. I was about to press the Buy button for the McLear payment-enabled ring priced at £89.99 https://mclear.com/product/payment-ring/# https://mclear.com/product/payment-ring/# but paused for thought after reading the terms and conditions (it's a PrePay Visa account) and finding this gem: "Your McLEAR Product(s) will be valid for 24 months from date of registration, after which your Product(s) will no longer be able to make contactless payments or have any funds available into your Account." and less severe but annoying opt-out not opt-in: "You can tell us if you don’t want to receive any marketing materials from us in accordance with the GDPR 2018, by emailing dpo@mclear.com." https://mclear.com/about/ring-terms-conditions/ https://mclear.com/about/ring-terms-conditions/
- xaduha 6y ago
  Well I wasn't linking the payment ring, but rather a smartcard in a ring formfactor. As for payments, you can go this daring route https://www.instructables.com/RFID-NFC-Tap-and-Go-Ring-for-Credit-Card-Payment https://www.instructables.com/RFID-NFC-Tap-and-Go-Ring-for-C...
  - iam-TJ 6y ago
    I realised that, but I was side-tracked by the novelty of the payment ring. That 'daring route' looks like an ideal project for our maker-space -thanks!
- StavrosK 6y ago
  Wait, so the ring just stops working two years later for no reason?
  - xaduha 6y ago
    Think of it as a temporary Visa card. It's not under their control.
    - StavrosK 6y ago

by xaduha 6y ago

paxys 6y ago

Funny enough their own demo (from the parent article) is on a MacBook Air with built-in Touch ID.

OJFord 6y ago
Yes but any MacBook Air, not just one you've previously provisioned to recognise your fingerprint. The selling point here isn't 'yet another external fingerprint reader', it's 'portable fingerprint-authenticated OpenPGP smart card'.
- Boulth6 6y ago
  The press release mentions only FIDO2. Where did you get the OpenPGP smart card bit?
  - michaelt 6y ago
    If they're releasing a fingerprint-scanning version, I'd be surprised if it wasn't available with all the capabilities of the YubiKey 5 (which has OpenPGP support) for people willing to pay.
  - OJFord 6y ago
    I just assumed, but I think you're right that it doesn't. (Though I wouldn't be surprised if it followed, Yubikey's first FIDO key was also just that, but now they all do it.) My main point though was that it's not a device-specific authentication, or even an external reader for unlocking a secret provisioned onto one or many devices, it is the sole thing needed, so you can walk up to a new device and use it without provisioning it with secrets. An OpenPGP one would be cool though - replace passphrase with fingerprint.
tiziano88 6y ago
this is a "roaming authenticator", meaning it is meant to be used across devices. After enrolling it, it may be stored away safely, e.g. in a safe, or used on other devices to log in (or perform crypto operations) with the same credentials.

ryukafalz 6y ago

I have been very tempted to get one of those. Two reasons I haven't yet: - It's a Type B card, and apparently most devices refuse to operate with Type B cards as FIDO2 authenticators: https://github.com/LedgerHQ/ledger-u2f-javacard/issues/12 https://github.com/LedgerHQ/ledger-u2f-javacard/issues/12 - I'd otherwise like to use it as a GPG card, but it's unclear if NFC-only GPG cards work with desktop gnupg. Maybe they do and I'm just missing the documentation for it.

xaduha 6y ago
> it's unclear if NFC-only GPG cards work with desktop gnupg If you mean this applet https://developers.yubico.com/ykneo-openpgp/Releases https://developers.yubico.com/ykneo-openpgp/Releases then it would work just fine, you just need a proper contactless PC/SC reader. I don't have this ring, but I did use a smartcard with the applet to login to a server via the phone with https://play.google.com/store/apps/details?id=org.sufficientlysecure.termbot https://play.google.com/store/apps/details?id=org.sufficient...
- ryukafalz 6y ago
  How does gnupg interact with contactless cards? I know for a contact smartcard if I try to perform an operation with the card not present, I get a prompt to insert the card, and then I get a prompt to enter the PIN when inserting the card and continuing. A contactless card in a ring form-factor is unlikely to be on the reader for long, though... is gnupg aware of contactless readers and will it e.g. ask for your PIN without the card being present and then prompt you to tap the card? I'm aware that's what Android apps like OpenKeychain do, but I haven't been able to find much information on how gnupg/pinentry/etc behave with contactless cards.
  - xaduha 6y ago
    If you have experience with contact cards, then it's all the same as far as end applications are concerned, it's abstracted away. > is gnupg aware of contactless readers and will it e.g. ask for your PIN without the card being present and then prompt you to tap the card? No, it will behave as if there's no card/ring if you don't have it around the reader. Software polish is a weak point, e.g things like `ssh-add -s /usr/lib/opensc-pkcs11.so` can be used to 'cache' the PIN for a session as far as `ssh -A` connection is concerned, but that's not exactly the height of usability.

iam-TJ 6y ago

Thanks for the link - this is an ideal solution to the problem of forgetting to carry, or mislaying, tokens. I was about to press the Buy button for the McLear payment-enabled ring priced at £89.99 https://mclear.com/product/payment-ring/# https://mclear.com/product/payment-ring/# but paused for thought after reading the terms and conditions (it's a PrePay Visa account) and finding this gem: "Your McLEAR Product(s) will be valid for 24 months from date of registration, after which your Product(s) will no longer be able to make contactless payments or have any funds available into your Account." and less severe but annoying opt-out not opt-in: "You can tell us if you don’t want to receive any marketing materials from us in accordance with the GDPR 2018, by emailing dpo@mclear.com." https://mclear.com/about/ring-terms-conditions/ https://mclear.com/about/ring-terms-conditions/

xaduha 6y ago
Well I wasn't linking the payment ring, but rather a smartcard in a ring formfactor. As for payments, you can go this daring route https://www.instructables.com/RFID-NFC-Tap-and-Go-Ring-for-Credit-Card-Payment https://www.instructables.com/RFID-NFC-Tap-and-Go-Ring-for-C...
- iam-TJ 6y ago
  I realised that, but I was side-tracked by the novelty of the payment ring. That 'daring route' looks like an ideal project for our maker-space -thanks!
StavrosK 6y ago
Wait, so the ring just stops working two years later for no reason?
- xaduha 6y ago
  Think of it as a temporary Visa card. It's not under their control.
  - StavrosK 6y ago