6 ms·

do any other keys have feature sets on par with yubikeys? last i checked they were ahead by a mile, the others i looked at were just fido2 keys

evil-olive 4y ago
so far, Yubikeys are the only ones I've found that support both FIDO2 / WebAuthn as well as GPG smart card functionality for use with pass(1). they also support ed25519 FIDO SSH keys, whereas all the cheapo FIDO keys I've tested only support ecdsa-nistp256, but that's a relatively minor difference. Nitrokey 3 claims that GPG smart card support is planned in an upcoming firmware update. once that's released I may bite the bullet on shipping costs and order one. 55€ shipping to the US for a 49€ key is cost-prohibitive for the most part.
- meepmorp 4y ago
  Also, yubikey works as a PIV smartcard
  - Borealid 4y ago
    If you get a smartcard, you can install https://github.com/BryanJacobs/FIDO2Applet https://github.com/BryanJacobs/FIDO2Applet on it to make it into a FIDO2 authenticator. You can install a GPG and a PIV applet too. A Yubikey is just a proprietary smartcard with a bunch of apps installed and some HID emulation (pretending to be a keyboard, which you likely do not want).
    - password4321 4y ago
      I think the keyboard aspect was wanted back when smart card readers and extra software drivers were needed, but there are USB "smart cards" now and operating system support is solid.
      - meepmorp 4y ago
        The HID support also lets you set a static string to send when you touch the button. Their homemade OTP uses it, too.
    - piperswe 4y ago
      Where does one acquire a smartcard? I can't find anywhere without a MOQ
      - privacyking 4y ago
        https://www.floss-shop.de/en/security-privacy/smartcards/ https://www.floss-shop.de/en/security-privacy/smartcards/
        Borealid 4y ago
        If you want to run flexible apps, I think you'd probably want a Javacard like those sold by https://www.smartcardfocus.com/shop/ilp/se~71/java-cards/p/index.shtml https://www.smartcardfocus.com/shop/ilp/se~71/java-cards/p/i... , not a special "PGP Card".
- palata 4y ago
  > Nitrokey 3 claims that GPG smart card support is planned in an upcoming firmware update. once that's released I may bite the bullet on shipping costs and order one. 55€ shipping to the US for a 49€ key is cost-prohibitive for the most part. They have been claiming many things. I pre-ordered a Nitrokey 1.5 years ago, still haven't received it, and apparently during this time they have not implemented much. https://www.nitrokey.com/blog/2023/nitrokey-3-status-update-0 https://www.nitrokey.com/blog/2023/nitrokey-3-status-update-...
deleted 4y ago
[deleted]
jrm4 4y ago
If they don't, that's more of a reason to use the OTHERS? You really don't want a monoculture here.
- nyolfen 4y ago
  i would be happy to use the OTHERS if they were comparable products
  - toastal 4y ago
    What if open source is your most-wanted feature? That hardware isn't open.
password4321 4y ago
Not really keys, but hardware wallets like Trezor or Ledger can do a lot of this for ~twice the price.
- idiotsecant 4y ago
  Hardware wallet authentication is really one of the 'web3' technologies that just works and we could be deploying everywhere right now. It's miles better than yubikey spitting out a static password, has plugins for every major browser and mobile device platform, can do identity verification without specific site account setup, and of course the whole pile of (optional) web3 things with crypto.
  - password4321 4y ago
    To be clear, I pointed out that the wallets can do many of the things the Yubikey can do (in addition to what you mentioned).
  - Melatonic 4y ago
    Any that are recommended for longevity? What can a Yubikey do that these wallets cannot?
  - infotogivenm 4y ago
    Counterpoint: it’s miles worse than FIDO/WebAuthn, which most hard keys and modern OSes support. Asking users to install a browser plugin is a disaster waiting to happen for most users. Phishing of cryptocurrency hardware wallets happens all the time, but it is impossible to phish a Passkey. The reason a browser plugin is required is because these devices are made to transact on a blockchain, rather than open APIs intended for domain authentication. Cryptocurrency wallets are horrible for normal security features that do not involve blockchains.
    - idiotsecant 4y ago
      I think the fact that cryptocurrency wallets with millions of dollars still exist and are protected by these wallets is evidence that security is manageable. Proof is in the pudding.

evil-olive 4y ago

so far, Yubikeys are the only ones I've found that support both FIDO2 / WebAuthn as well as GPG smart card functionality for use with pass(1). they also support ed25519 FIDO SSH keys, whereas all the cheapo FIDO keys I've tested only support ecdsa-nistp256, but that's a relatively minor difference. Nitrokey 3 claims that GPG smart card support is planned in an upcoming firmware update. once that's released I may bite the bullet on shipping costs and order one. 55€ shipping to the US for a 49€ key is cost-prohibitive for the most part.

meepmorp 4y ago
Also, yubikey works as a PIV smartcard
- Borealid 4y ago
  If you get a smartcard, you can install https://github.com/BryanJacobs/FIDO2Applet https://github.com/BryanJacobs/FIDO2Applet on it to make it into a FIDO2 authenticator. You can install a GPG and a PIV applet too. A Yubikey is just a proprietary smartcard with a bunch of apps installed and some HID emulation (pretending to be a keyboard, which you likely do not want).
  - password4321 4y ago
    I think the keyboard aspect was wanted back when smart card readers and extra software drivers were needed, but there are USB "smart cards" now and operating system support is solid.
    - meepmorp 4y ago
      The HID support also lets you set a static string to send when you touch the button. Their homemade OTP uses it, too.
  - piperswe 4y ago
    Where does one acquire a smartcard? I can't find anywhere without a MOQ
    - privacyking 4y ago
      https://www.floss-shop.de/en/security-privacy/smartcards/ https://www.floss-shop.de/en/security-privacy/smartcards/
      - Borealid 4y ago
        If you want to run flexible apps, I think you'd probably want a Javacard like those sold by https://www.smartcardfocus.com/shop/ilp/se~71/java-cards/p/index.shtml https://www.smartcardfocus.com/shop/ilp/se~71/java-cards/p/i... , not a special "PGP Card".
palata 4y ago
> Nitrokey 3 claims that GPG smart card support is planned in an upcoming firmware update. once that's released I may bite the bullet on shipping costs and order one. 55€ shipping to the US for a 49€ key is cost-prohibitive for the most part. They have been claiming many things. I pre-ordered a Nitrokey 1.5 years ago, still haven't received it, and apparently during this time they have not implemented much. https://www.nitrokey.com/blog/2023/nitrokey-3-status-update-0 https://www.nitrokey.com/blog/2023/nitrokey-3-status-update-...

deleted 4y ago

[deleted]

jrm4 4y ago

If they don't, that's more of a reason to use the OTHERS? You really don't want a monoculture here.

nyolfen 4y ago
i would be happy to use the OTHERS if they were comparable products
- toastal 4y ago
  What if open source is your most-wanted feature? That hardware isn't open.

password4321 4y ago

Not really keys, but hardware wallets like Trezor or Ledger can do a lot of this for ~twice the price.

idiotsecant 4y ago
Hardware wallet authentication is really one of the 'web3' technologies that just works and we could be deploying everywhere right now. It's miles better than yubikey spitting out a static password, has plugins for every major browser and mobile device platform, can do identity verification without specific site account setup, and of course the whole pile of (optional) web3 things with crypto.
- password4321 4y ago
  To be clear, I pointed out that the wallets can do many of the things the Yubikey can do (in addition to what you mentioned).
- Melatonic 4y ago
  Any that are recommended for longevity? What can a Yubikey do that these wallets cannot?
- infotogivenm 4y ago
  Counterpoint: it’s miles worse than FIDO/WebAuthn, which most hard keys and modern OSes support. Asking users to install a browser plugin is a disaster waiting to happen for most users. Phishing of cryptocurrency hardware wallets happens all the time, but it is impossible to phish a Passkey. The reason a browser plugin is required is because these devices are made to transact on a blockchain, rather than open APIs intended for domain authentication. Cryptocurrency wallets are horrible for normal security features that do not involve blockchains.
  - idiotsecant 4y ago
    I think the fact that cryptocurrency wallets with millions of dollars still exist and are protected by these wallets is evidence that security is manageable. Proof is in the pudding.