5 ms·

Conor sold U2F Zero's for less than 10 dollars (years ago) and has a kick starter now to fund his new Solo keys: https://www.kickstarter.com/projects/conorpatr

by _wldu 6y ago

Conor sold U2F Zero's for less than 10 dollars (years ago) and has a kick starter now to fund his new Solo keys: https://www.kickstarter.com/projects/conorpatrick/solo-the-first-open-source-fido2-security-key-usb/ https://www.kickstarter.com/projects/conorpatrick/solo-the-f... https://u2fzero.com/ https://u2fzero.com/ I have a few U2F Zeros and they have been working fine for years. These are simple devices. You don't need to overpay for them. Edit: Conor was building the U2F Zero tokens for $2.26 USD per unit. Read more here: https://www.conorpp.com/u2f-zero-year-in-review/ https://www.conorpp.com/u2f-zero-year-in-review/

gnufx 6y ago
I don't think the kickstarter is relevant now. You just buy them from solokeys.com. There's been Somu since that, and Solo2 is in the offing, with plenty of storage, apparently. I bought Somu partly for convenience, and partly for the promise of PGP support, which unfortunately hasn't been added yet (though there is a development version). In answer to the expense question, two Solo keys appear to set you back 38 quid at the current exchange rate. I don't know how they compare with HYPERFIDO, which I don't think I'd come across before.
- ecesena 6y ago
  I can confirm what you and _wldu are saying and yes, the latest project is https://solokeys.com/v2 https://solokeys.com/v2 and is launching end of this month. From an economic perspective, unfortunately, it's really hard to focus on reducing the cost, there's simply no incentive. First, consider that the biggest cost in the customer getting a security key is basically shipping + packaging. Imagine a key that costs <$3... even packaging with a polybag + printed label + padded envelop gets to a cost that has a significant % of the production cost. Next, it's features. To stay on par with competition, people expect the same features (see, e.g., openpgp mentioned above - the code currently doesn't fit in the stm32l4 flash), both firmware and hardware. As a result we have to look at the latest & greatest micro, but of course that alone has a significant cost. And finally, there's the overall viability. We all know that open source projects die without a business model. The numbers in the U2FZero review simply don't add up, that was clearly unsustainable and that's why we made SoloKeys. A business has expenses other than manufacturing and if you don't account for that, the business dies together with your dream project. Anyway, thank you both (and all others) for the great support. One step at a time, we'll get to a stronger and eventually also cheaper product!
  - gnufx 6y ago
    Ah, I didn't know about the PGP code size. Point taken about the cost, and I hope you can sell to organizations. I'm surprised I can buy a competitor for £8, but then I can't run the proprietary programming software or, I assume, re-flash it. I'm happy to support a free software project anyhow. I wish I could register my Somu with the work Duo system rather than the display-a-number-you-type HOTP keys they reluctantly issue as the expensive alternative to expecting us to use personal phones for such purposes. Phishing, we've heard of it.
  - smartbit 6y ago
    Nice try, but I will never attach an usb device for frequent usage that sticks out like the Solokeys v2. The size of the Somu * is fine, as it doesn't need to removed when transporting a laptop. Integrated in to the laptop it would be great, like an Apple Watch allows https://support.apple.com/guide/imac/unlock-and-approve-with-apple-watch-apda4d638ecf/mac https://support.apple.com/guide/imac/unlock-and-approve-with... * https://solokeys.com/collections/all/products/somu-tiny-security-key-two-factor-authentication-u2f-and-fido2-usb-a https://solokeys.com/collections/all/products/somu-tiny-secu...
    - ecesena 6y ago
      I hear you. The stm32 used in v1 was 3x3mm, while the new nxp lpc55s6x used in v2 is 5x5mm. Plus we added 2mb of flash, though it's optional. If anyone wants to try to packing the components into a somu v2, that'd be a nice addition to the *omu family [1] and we'd be more than happy to help with manufacturing. Same for a somu for usb-c. [1] https://tomu.im https://tomu.im
- bsder 6y ago
  > I bought Somu partly for convenience, and partly for the promise of PGP support, which unfortunately hasn't been added yet (though there is a development version). It is sad that with PGP being so horribly broken, it still casts its shadow over security products. PGP should have been dead and buried eons ago.
  - gnufx 6y ago
    > It is sad that with PGP being so horribly broken, it still casts its shadow over security products. How is ssh with a PGP key horribly broken? There's no shadow over Solo/Somu from where I'm standing.
    - bsder 6y ago
      The key is fine. PGP--not so much. https://latacora.micro.blog/2019/07/16/the-pgp-problem.html https://latacora.micro.blog/2019/07/16/the-pgp-problem.html
      - gnufx 6y ago
        So what's the problem, and what's the alternative anyway (in the absence of FIDO support in the case of ssh)?

by _wldu 6y ago

gnufx 6y ago

I don't think the kickstarter is relevant now. You just buy them from solokeys.com. There's been Somu since that, and Solo2 is in the offing, with plenty of storage, apparently. I bought Somu partly for convenience, and partly for the promise of PGP support, which unfortunately hasn't been added yet (though there is a development version). In answer to the expense question, two Solo keys appear to set you back 38 quid at the current exchange rate. I don't know how they compare with HYPERFIDO, which I don't think I'd come across before.

ecesena 6y ago
I can confirm what you and _wldu are saying and yes, the latest project is https://solokeys.com/v2 https://solokeys.com/v2 and is launching end of this month. From an economic perspective, unfortunately, it's really hard to focus on reducing the cost, there's simply no incentive. First, consider that the biggest cost in the customer getting a security key is basically shipping + packaging. Imagine a key that costs <$3... even packaging with a polybag + printed label + padded envelop gets to a cost that has a significant % of the production cost. Next, it's features. To stay on par with competition, people expect the same features (see, e.g., openpgp mentioned above - the code currently doesn't fit in the stm32l4 flash), both firmware and hardware. As a result we have to look at the latest & greatest micro, but of course that alone has a significant cost. And finally, there's the overall viability. We all know that open source projects die without a business model. The numbers in the U2FZero review simply don't add up, that was clearly unsustainable and that's why we made SoloKeys. A business has expenses other than manufacturing and if you don't account for that, the business dies together with your dream project. Anyway, thank you both (and all others) for the great support. One step at a time, we'll get to a stronger and eventually also cheaper product!
- gnufx 6y ago
  Ah, I didn't know about the PGP code size. Point taken about the cost, and I hope you can sell to organizations. I'm surprised I can buy a competitor for £8, but then I can't run the proprietary programming software or, I assume, re-flash it. I'm happy to support a free software project anyhow. I wish I could register my Somu with the work Duo system rather than the display-a-number-you-type HOTP keys they reluctantly issue as the expensive alternative to expecting us to use personal phones for such purposes. Phishing, we've heard of it.
- smartbit 6y ago
  Nice try, but I will never attach an usb device for frequent usage that sticks out like the Solokeys v2. The size of the Somu * is fine, as it doesn't need to removed when transporting a laptop. Integrated in to the laptop it would be great, like an Apple Watch allows https://support.apple.com/guide/imac/unlock-and-approve-with-apple-watch-apda4d638ecf/mac https://support.apple.com/guide/imac/unlock-and-approve-with... * https://solokeys.com/collections/all/products/somu-tiny-security-key-two-factor-authentication-u2f-and-fido2-usb-a https://solokeys.com/collections/all/products/somu-tiny-secu...
  - ecesena 6y ago
    I hear you. The stm32 used in v1 was 3x3mm, while the new nxp lpc55s6x used in v2 is 5x5mm. Plus we added 2mb of flash, though it's optional. If anyone wants to try to packing the components into a somu v2, that'd be a nice addition to the *omu family [1] and we'd be more than happy to help with manufacturing. Same for a somu for usb-c. [1] https://tomu.im https://tomu.im
bsder 6y ago
> I bought Somu partly for convenience, and partly for the promise of PGP support, which unfortunately hasn't been added yet (though there is a development version). It is sad that with PGP being so horribly broken, it still casts its shadow over security products. PGP should have been dead and buried eons ago.
- gnufx 6y ago
  > It is sad that with PGP being so horribly broken, it still casts its shadow over security products. How is ssh with a PGP key horribly broken? There's no shadow over Solo/Somu from where I'm standing.
  - bsder 6y ago
    The key is fine. PGP--not so much. https://latacora.micro.blog/2019/07/16/the-pgp-problem.html https://latacora.micro.blog/2019/07/16/the-pgp-problem.html
    - gnufx 6y ago
      So what's the problem, and what's the alternative anyway (in the absence of FIDO support in the case of ssh)?