8 ms·

Reminder: Yubico doesn't have a monopoly on security keys. Make sure your software/tutorials support the open-source alternatives like OnlyKey and NitroKey.

sedatk 4y ago
or SoloKey
- ptman 4y ago
  Unfortunately my solokey2 is buggy even with latest firmware. Hw is much better than solokey1. But there are indeed alternatives to yubikey. Anyone have experience with https://www.token2.com/shop/product/token2-t2f2-fido2-and-u2f-security-key https://www.token2.com/shop/product/token2-t2f2-fido2-and-u2... ? 128 resident keys is much better than 25/50
- sowbug 4y ago
  Unfortunately SoloKey doesn't work as an OpenPGP smart card, which means it's not a real substitute for a Yubikey. I haven't had any luck with resident FIDO2, either. The Solo team believes that other functionality such as PIV overlaps with GnuPG use cases, so that OpenPGP isn't a priority, and their work on that functionality appears to have stopped in 2021. That's too bad, because OpenPGP's network effects far outweigh its pure functionality, which means a technical substitute isn't a substitute. https://github.com/solokeys/openpgp https://github.com/solokeys/openpgp
- aareet 4y ago
  I've found Solokey to be unreliable. Recently, for example, I learned that the Solokey 2 can't be added to iCloud as a security key
  - pmw 4y ago
    I have multiple Solo Key 2 devices. (I bought a Kickstarter 4-pack.) I use one of them regularly, and I successfully added it to iCloud as a security key. It has been 100% reliable. In August 2022 they released a major firmware update. Maybe that addressed the iCloud incompatibility and reliability issues?
manmal 4y ago
Safari seems to have its own implementation of a virtual security key also. Before I plugged in my Yubico recently, Safari asked me for my fingerprint as a fallback.
- ojkelly 4y ago
  That’s part of WebAuthN[0]. Some services like AWS will not allow virtual U2F keys to be registered, but most places do. [0] https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API https://developer.mozilla.org/en-US/docs/Web/API/Web_Authent...
  - lxgr 4y ago
    Not exactly – WebAuthN is the browser/JavaScript API, which can be provided by both platform authenticators (such as Safari on iOS and macOS, Chrome on Android and macOS etc.) and hardware/"roaming" CTAP2-compliant authenticators. WebAuthN specifices the browser API, CTAP2 specifies the interface between an authenticator device/software implementation and a browser or other client, and FIDO specifies the behavior of the authenticator itself (including certification of attestation-capable authenticators).
  - zikduruqe 4y ago
    It works for Safari. For AWS, I use Firefox and a FIDO key, and have a backup MFA as Safari using U2F.
    - manmal 4y ago
      If Secure Enclave is as secure as Apple claims it to be, Safari‘s option might actually be the safest one. Of course you can’t use that on anything other than a Mac or iPhone, so in some situations you need another key.
      - vladvasiliu 4y ago
        It's a bit more specific than that, no? You can't use Safari's option on anything other than that particular Mac or iPhone. It's my understanding that you can't extract the secret key from the secure enclave.
fsflover 4y ago
Or Librem Key.
nyolfen 4y ago
do any other keys have feature sets on par with yubikeys? last i checked they were ahead by a mile, the others i looked at were just fido2 keys
- evil-olive 4y ago
  so far, Yubikeys are the only ones I've found that support both FIDO2 / WebAuthn as well as GPG smart card functionality for use with pass(1). they also support ed25519 FIDO SSH keys, whereas all the cheapo FIDO keys I've tested only support ecdsa-nistp256, but that's a relatively minor difference. Nitrokey 3 claims that GPG smart card support is planned in an upcoming firmware update. once that's released I may bite the bullet on shipping costs and order one. 55€ shipping to the US for a 49€ key is cost-prohibitive for the most part.
  - meepmorp 4y ago
    Also, yubikey works as a PIV smartcard
    - Borealid 4y ago
      If you get a smartcard, you can install https://github.com/BryanJacobs/FIDO2Applet https://github.com/BryanJacobs/FIDO2Applet on it to make it into a FIDO2 authenticator. You can install a GPG and a PIV applet too. A Yubikey is just a proprietary smartcard with a bunch of apps installed and some HID emulation (pretending to be a keyboard, which you likely do not want).
      - password4321 4y ago
        I think the keyboard aspect was wanted back when smart card readers and extra software drivers were needed, but there are USB "smart cards" now and operating system support is solid.
        meepmorp 4y ago
        The HID support also lets you set a static string to send when you touch the button. Their homemade OTP uses it, too.
hsbauauvhabzb 4y ago
I’m unclear as to why we can’t use some sort of tpm for webauthn and distributed encrypted passwords for synchronisation. Hell, even software based implementations which force domain checking would solve 99% of the problem…
- ilyt 4y ago
  Technically, we can just use client certs, YK supports them (via smartcard emulation, you can also use that to auth via SSH), just it wasn't really there, ever, on UI front...
hnarn 4y ago
Mullvad VPN has announced that their sister company "Tillitis"[1] is working on a really interesting key and it looks like it's releasing pretty soon (2023-03-23). From the website: >The TKey™ is a new kind of USB security key inspired by measured boot and DICE. >TKey™s design encourages developers to experiment with new security key applications and models in a way that makes adoption easier and less risky forend-users. >TKey™ is and always will be open source hardware and software. Schematics, PCB design and FPGA design source as well as all software source code can be found on GitHub. [1]: https://www.tillitis.se/ https://www.tillitis.se/ -- also "tillit" is Swedish for "trust" and "mullvad" is Swedish for "mole" (the animal).
lxgr 4y ago
There are definitely alternatives, but OnlyKey doesn't seem to use secure hardware and has a few other problems too: https://news.ycombinator.com/item?id=21884184 https://news.ycombinator.com/item?id=21884184 The backup functionality (which requires encryption password entry on a computer, i.e. not the device itself) looks especially concerning.

sedatk 4y ago

or SoloKey

ptman 4y ago
Unfortunately my solokey2 is buggy even with latest firmware. Hw is much better than solokey1. But there are indeed alternatives to yubikey. Anyone have experience with https://www.token2.com/shop/product/token2-t2f2-fido2-and-u2f-security-key https://www.token2.com/shop/product/token2-t2f2-fido2-and-u2... ? 128 resident keys is much better than 25/50
sowbug 4y ago
Unfortunately SoloKey doesn't work as an OpenPGP smart card, which means it's not a real substitute for a Yubikey. I haven't had any luck with resident FIDO2, either. The Solo team believes that other functionality such as PIV overlaps with GnuPG use cases, so that OpenPGP isn't a priority, and their work on that functionality appears to have stopped in 2021. That's too bad, because OpenPGP's network effects far outweigh its pure functionality, which means a technical substitute isn't a substitute. https://github.com/solokeys/openpgp https://github.com/solokeys/openpgp
aareet 4y ago
I've found Solokey to be unreliable. Recently, for example, I learned that the Solokey 2 can't be added to iCloud as a security key
- pmw 4y ago
  I have multiple Solo Key 2 devices. (I bought a Kickstarter 4-pack.) I use one of them regularly, and I successfully added it to iCloud as a security key. It has been 100% reliable. In August 2022 they released a major firmware update. Maybe that addressed the iCloud incompatibility and reliability issues?

manmal 4y ago

Safari seems to have its own implementation of a virtual security key also. Before I plugged in my Yubico recently, Safari asked me for my fingerprint as a fallback.

ojkelly 4y ago
That’s part of WebAuthN[0]. Some services like AWS will not allow virtual U2F keys to be registered, but most places do. [0] https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API https://developer.mozilla.org/en-US/docs/Web/API/Web_Authent...
- lxgr 4y ago
  Not exactly – WebAuthN is the browser/JavaScript API, which can be provided by both platform authenticators (such as Safari on iOS and macOS, Chrome on Android and macOS etc.) and hardware/"roaming" CTAP2-compliant authenticators. WebAuthN specifices the browser API, CTAP2 specifies the interface between an authenticator device/software implementation and a browser or other client, and FIDO specifies the behavior of the authenticator itself (including certification of attestation-capable authenticators).
- zikduruqe 4y ago
  It works for Safari. For AWS, I use Firefox and a FIDO key, and have a backup MFA as Safari using U2F.
  - manmal 4y ago
    If Secure Enclave is as secure as Apple claims it to be, Safari‘s option might actually be the safest one. Of course you can’t use that on anything other than a Mac or iPhone, so in some situations you need another key.
    - vladvasiliu 4y ago
      It's a bit more specific than that, no? You can't use Safari's option on anything other than that particular Mac or iPhone. It's my understanding that you can't extract the secret key from the secure enclave.

fsflover 4y ago

Or Librem Key.

nyolfen 4y ago

do any other keys have feature sets on par with yubikeys? last i checked they were ahead by a mile, the others i looked at were just fido2 keys

evil-olive 4y ago
so far, Yubikeys are the only ones I've found that support both FIDO2 / WebAuthn as well as GPG smart card functionality for use with pass(1). they also support ed25519 FIDO SSH keys, whereas all the cheapo FIDO keys I've tested only support ecdsa-nistp256, but that's a relatively minor difference. Nitrokey 3 claims that GPG smart card support is planned in an upcoming firmware update. once that's released I may bite the bullet on shipping costs and order one. 55€ shipping to the US for a 49€ key is cost-prohibitive for the most part.
- meepmorp 4y ago
  Also, yubikey works as a PIV smartcard
  - Borealid 4y ago
    If you get a smartcard, you can install https://github.com/BryanJacobs/FIDO2Applet https://github.com/BryanJacobs/FIDO2Applet on it to make it into a FIDO2 authenticator. You can install a GPG and a PIV applet too. A Yubikey is just a proprietary smartcard with a bunch of apps installed and some HID emulation (pretending to be a keyboard, which you likely do not want).
    - password4321 4y ago
      I think the keyboard aspect was wanted back when smart card readers and extra software drivers were needed, but there are USB "smart cards" now and operating system support is solid.
      - meepmorp 4y ago
        The HID support also lets you set a static string to send when you touch the button. Their homemade OTP uses it, too.

hsbauauvhabzb 4y ago

I’m unclear as to why we can’t use some sort of tpm for webauthn and distributed encrypted passwords for synchronisation. Hell, even software based implementations which force domain checking would solve 99% of the problem…

ilyt 4y ago
Technically, we can just use client certs, YK supports them (via smartcard emulation, you can also use that to auth via SSH), just it wasn't really there, ever, on UI front...

hnarn 4y ago

Mullvad VPN has announced that their sister company "Tillitis"[1] is working on a really interesting key and it looks like it's releasing pretty soon (2023-03-23). From the website: >The TKey™ is a new kind of USB security key inspired by measured boot and DICE. >TKey™s design encourages developers to experiment with new security key applications and models in a way that makes adoption easier and less risky forend-users. >TKey™ is and always will be open source hardware and software. Schematics, PCB design and FPGA design source as well as all software source code can be found on GitHub. [1]: https://www.tillitis.se/ https://www.tillitis.se/ -- also "tillit" is Swedish for "trust" and "mullvad" is Swedish for "mole" (the animal).

lxgr 4y ago

There are definitely alternatives, but OnlyKey doesn't seem to use secure hardware and has a few other problems too: https://news.ycombinator.com/item?id=21884184 https://news.ycombinator.com/item?id=21884184 The backup functionality (which requires encryption password entry on a computer, i.e. not the device itself) looks especially concerning.