4 ms·

Arch Linux partners with Nitrokey to equip its staff with USB keys

26 points by Foxboron 6y ago

deleted 6y ago
[deleted]
quesera 6y ago
This would have stronger endorsement value, if the style was toned down from "Nitrokey press release" to "Arch Linux announcement". I have never used Nitrokey products. I want to believe that the Arch team vetted them before agreeing to use their mailing list for advertising. But the vibe here could equally be "Coca-cola coupons for Arch team members" -- i.e. "The corp contacted us with a product marketing agenda, and offered us something in exchange for advertising". I don't mean to be cynical. I'm trying to help. :-/
andrey_utkin 6y ago
Nice to see all of this. Nice to see Nitrokey afloat - a small company serving to the demands of us, FOSS centric folks. Nice so see them striking good deals with organizations which deliver FOSS. Was nice to get my own Nitrokey free of charge from a similar deal with Gentoo Linux 2 years ago :)
- Foxboron 6y ago
  >Was nice to get my own Nitrokey free of charge from a similar deal with Gentoo Linux 2 years ago :) Yep, Gentoo was the reason we wanted to seek out a similar deal :)
dmayle 6y ago
I've been tracking Nitrokey for a couple of years now, and am really impressed with the products they offer. If you want an HSM (secure key storage), their Nitrokey HSM is available for only 70 euros (compare to YubiKey HSM at 600 euros). If you wanted tiny (e.g. leave-in keys) YubiKey was the only option, but the Nitrokey 3 is supposed to be coming soon with leave-in for USB-A at least
- rckoepke 6y ago
  I thought these numbers must be off but the YubiKey HSM really is $650 [0]. What justified that price? Can someone walk me through the typical use case/application for these? 0: https://www.yubico.com/product/yubihsm-2/ https://www.yubico.com/product/yubihsm-2/
  - dmayle 6y ago
    An HSM is a device that's meant to hold keys, allow you to use them, but never allow you to access them. In other words, it's a true digital 'key' that can't be copied. If you truly care about the encryption on your servers, for example, then normally your server can't boot/decrypt the drive without an HSM (which you aren't supposed to leave plugged in). You give one to your CEO, your CTO, and your CFO, for example, and you require that at least two of them are present to boot your servers (to prevent attack by theft). There are more fault-tolerant possibilities out there (e.g. Hashicorp Vault), but they're generally bootstrapped from HSMs.
opwieurposiu 6y ago
For those who use usb security keys, what happens when I lose it? Do I need to buy two of them and keep them synced somehow?
- aendruk 6y ago
  When storing a GnuPG private key on it, yes you still need a backup. The backup can be a second similarly provisioned USB device, or any storage device that you trust to be secure, such as a paper key in a fire safe.
- deleted 6y ago
  [deleted]

26 points by Foxboron 6y ago

deleted 6y ago

[deleted]

This would have stronger endorsement value, if the style was toned down from "Nitrokey press release" to "Arch Linux announcement". I have never used Nitrokey products. I want to believe that the Arch team vetted them before agreeing to use their mailing list for advertising. But the vibe here could equally be "Coca-cola coupons for Arch team members" -- i.e. "The corp contacted us with a product marketing agenda, and offered us something in exchange for advertising". I don't mean to be cynical. I'm trying to help. :-/

andrey_utkin 6y ago

Nice to see all of this. Nice to see Nitrokey afloat - a small company serving to the demands of us, FOSS centric folks. Nice so see them striking good deals with organizations which deliver FOSS. Was nice to get my own Nitrokey free of charge from a similar deal with Gentoo Linux 2 years ago :)

Foxboron 6y ago
>Was nice to get my own Nitrokey free of charge from a similar deal with Gentoo Linux 2 years ago :) Yep, Gentoo was the reason we wanted to seek out a similar deal :)

dmayle 6y ago

I've been tracking Nitrokey for a couple of years now, and am really impressed with the products they offer. If you want an HSM (secure key storage), their Nitrokey HSM is available for only 70 euros (compare to YubiKey HSM at 600 euros). If you wanted tiny (e.g. leave-in keys) YubiKey was the only option, but the Nitrokey 3 is supposed to be coming soon with leave-in for USB-A at least

rckoepke 6y ago
I thought these numbers must be off but the YubiKey HSM really is $650 [0]. What justified that price? Can someone walk me through the typical use case/application for these? 0: https://www.yubico.com/product/yubihsm-2/ https://www.yubico.com/product/yubihsm-2/
- dmayle 6y ago
  An HSM is a device that's meant to hold keys, allow you to use them, but never allow you to access them. In other words, it's a true digital 'key' that can't be copied. If you truly care about the encryption on your servers, for example, then normally your server can't boot/decrypt the drive without an HSM (which you aren't supposed to leave plugged in). You give one to your CEO, your CTO, and your CFO, for example, and you require that at least two of them are present to boot your servers (to prevent attack by theft). There are more fault-tolerant possibilities out there (e.g. Hashicorp Vault), but they're generally bootstrapped from HSMs.

opwieurposiu 6y ago

For those who use usb security keys, what happens when I lose it? Do I need to buy two of them and keep them synced somehow?

aendruk 6y ago
When storing a GnuPG private key on it, yes you still need a backup. The backup can be a second similarly provisioned USB device, or any storage device that you trust to be secure, such as a paper key in a fire safe.
deleted 6y ago
[deleted]