3 ms·

How do Nitro keys compare with Yubikey 5 NFC? Nitro keys are semi open source. Other than that, any advantage?

by aborsy 4y ago

palata 4y ago
My Yubikey 5 NFC rocks. Just works, does everything I want. I ordered a Nitrokey 3C NFC 2 years ago, never heard from them until a week ago where they said they shipped it (I'll believe it when I receive it). I tried to contact their support once to kindly ask if I still existed in their database, they answered that I should read the blog in a rude way (which did not even answer my question). They were claiming 2 years ago that they had many features (my understanding was "almost compares to Yubikey"), and I realized recently that it was not only not true, but in those 2 years they haven't reached feature parity (not even remotely). So... feel free to order a Nitrokey to support them (I did, and my hope is that it will get better), but if you want something that works today, go for Yubikey.
- aborsy 4y ago
  Thanks for sharing! The main limitation of the Yubikey is that the firmware is closed source and potentially even backdoored. Otherwise the construction and features of Yubikey are pretty good.
  - wkat4242 4y ago
    The Yubikey firmware is open but the problem is that you can't overwrite it anymore. They did this during the Yubikey NEO age, the first ones could still be updated. They say they did it to avoid authentication bypass attacks which makes sense but there should be other ways to do that. And the updatability keeps it current and also allows for verified builds. About a year after they changed it though there was a huge vulnerability in the Yubikey where it failed to actually check the pincode making the security useless. Which proved locking the firmware was a bad idea IMO. They ended up having to replace tons of them which could have been updated. I was hoping they'd bring updatable firmware back but they didn't.
    - aborsy 4y ago
      Yeah, the thought that Yubikey may not require PIN in some cases is scary. It’s like a GPG key without a password in home directory. Not only it will be useless, but actually harmful. For such reasons, I have been searching for alternatives. It seems other products have other issues.
fsflover 4y ago
> Nitro keys are semi open source. And Librem Key fully relies on FLOSS.
- aborsy 4y ago
  Looks like there are usability problems https://forums.puri.sm/t/librem-key-practical-usage-scenarios/6935/14 https://forums.puri.sm/t/librem-key-practical-usage-scenario... Lacks FIDO, and curve 25519.
  - deleted 4y ago
    [deleted]
draven 4y ago
I hesitated between both, but the nitrokey 3 has so many things listed as "planned" that I went for a Yubikey (I bought two, a 5a NFC and a 5c NFC.)

How do Nitro keys compare with Yubikey 5 NFC? Nitro keys are semi open source. Other than that, any advantage?

by aborsy 4y ago

How do Nitro keys compare with Yubikey 5 NFC? Nitro keys are semi open source. Other than that, any advantage?

My Yubikey 5 NFC rocks. Just works, does everything I want. I ordered a Nitrokey 3C NFC 2 years ago, never heard from them until a week ago where they said they shipped it (I'll believe it when I receive it). I tried to contact their support once to kindly ask if I still existed in their database, they answered that I should read the blog in a rude way (which did not even answer my question). They were claiming 2 years ago that they had many features (my understanding was "almost compares to Yubikey"), and I realized recently that it was not only not true, but in those 2 years they haven't reached feature parity (not even remotely). So... feel free to order a Nitrokey to support them (I did, and my hope is that it will get better), but if you want something that works today, go for Yubikey.

aborsy 4y ago
Thanks for sharing! The main limitation of the Yubikey is that the firmware is closed source and potentially even backdoored. Otherwise the construction and features of Yubikey are pretty good.
- wkat4242 4y ago
  The Yubikey firmware is open but the problem is that you can't overwrite it anymore. They did this during the Yubikey NEO age, the first ones could still be updated. They say they did it to avoid authentication bypass attacks which makes sense but there should be other ways to do that. And the updatability keeps it current and also allows for verified builds. About a year after they changed it though there was a huge vulnerability in the Yubikey where it failed to actually check the pincode making the security useless. Which proved locking the firmware was a bad idea IMO. They ended up having to replace tons of them which could have been updated. I was hoping they'd bring updatable firmware back but they didn't.
  - aborsy 4y ago
    Yeah, the thought that Yubikey may not require PIN in some cases is scary. It’s like a GPG key without a password in home directory. Not only it will be useless, but actually harmful. For such reasons, I have been searching for alternatives. It seems other products have other issues.

fsflover 4y ago

> Nitro keys are semi open source. And Librem Key fully relies on FLOSS.

aborsy 4y ago
Looks like there are usability problems https://forums.puri.sm/t/librem-key-practical-usage-scenarios/6935/14 https://forums.puri.sm/t/librem-key-practical-usage-scenario... Lacks FIDO, and curve 25519.
- deleted 4y ago
  [deleted]

draven 4y ago

I hesitated between both, but the nitrokey 3 has so many things listed as "planned" that I went for a Yubikey (I bought two, a 5a NFC and a 5c NFC.)