5 ms·

Very. They are a tiny Swedish company that pay for top talent, are quite active and hands-on in the netsec community. It's not a faceless corporation with a Chi

Very. They are a tiny Swedish company that pay for top talent, are quite active and hands-on in the netsec community. It's not a faceless corporation with a Chinese PO Box.

gonesilent 4y ago
US government had a nice little swedish cryptography company there for a bit too...
- bschne 4y ago
  Do you mean Swiss (classic!) or was there another one? https://en.wikipedia.org/wiki/Crypto_AG https://en.wikipedia.org/wiki/Crypto_AG
  - JoachimS 4y ago
    Though started by the Swede Boris Hagelin. https://en.wikipedia.org/wiki/Boris_Hagelin https://en.wikipedia.org/wiki/Boris_Hagelin
    - bschne 4y ago
      Ah, true, I forgot!
steve1977 4y ago
They were a tiny Swedish company…
Namidairo 4y ago
> It's not a faceless corporation with a Chinese PO Box. On this note, are Feitian still the OEM for the Google Titan keys?
JoachimS 4y ago
Tiny is a bit misleading. The turnover is about 100 MUSD. The company has about 300 employees, with offices in all regions of the world and a lot of R&D in the USA.
- bberrry 4y ago
  I wasn't aware they had grown that much. Thanks for the correction
JoachimS 4y ago
If you are looking for a tiny, Swedish company working in a similar area as Yubico, there is Tillits AB. Tillitis is a spin off from the Swedish VPN provider Mullvad. In contrast to Yubikeys, The Tillitis TKey as well as tools, device verification etc is 100% open source. https://tillitis.se/ https://tillitis.se/ https://github.com/tillitis https://github.com/tillitis https://mullvad.net/en https://mullvad.net/en (Full disclosure: I work for Tillitis.)
- FeistySkink 4y ago
  Is the TKey tamper-proof?
  - JoachimS 4y ago
    No, not yet. Physical attacks are out of scope for the TKey1, even if we have some mechanisms in play which try to extend the time and effort required to perform a successful evil maid-attack extracting the Unique Device Secret (UDS). See the threat model for the release: https://github.com/tillitis/tillitis-key1/blob/main/doc/threat_model/threat_model.md https://github.com/tillitis/tillitis-key1/blob/main/doc/thre... The current casing is fairly tamper evident (it will break), but we do not yet use real, tamper evident sealing. We are looking at tamper sealing for future versions. And ways to further protect against physical attacks.
    - belter 4y ago
      When you do, please think about a special price for existing customers ;-)
- jtvjan 4y ago
  The key costs 880 SEK. That's about 78 euros or 85 dollars. It's designed to be future proof, with applications being uploaded to the device by the host. The website feels a bit cramped with all the large text on desktop, like it was only tested on phones
  - 4y ago
aborsy 4y ago
Thanks for the info! The construction quality of Yubikeys has been good in my experience. I was just worried about the closed source proprietary firmware in a security product (including the random number generators, where issues were discovered in the past). But Yubikeys are used in various companies and apparently in some branches of governments too, thus must have been vetted by their security teams (though there could be different lines of firmware or products for different clients. People say there is not much benefit to purchasing FIPS-compliant Yubikeys. Neglecting the approved algorithms and features, is the firmware the same as that in non-FIPS security keys?)

Very. They are a tiny Swedish company that pay for top talent, are quite active and hands-on in the netsec community. It's not a faceless corporation with a Chinese PO Box.

gonesilent 4y ago

US government had a nice little swedish cryptography company there for a bit too...

bschne 4y ago
Do you mean Swiss (classic!) or was there another one? https://en.wikipedia.org/wiki/Crypto_AG https://en.wikipedia.org/wiki/Crypto_AG
- JoachimS 4y ago
  Though started by the Swede Boris Hagelin. https://en.wikipedia.org/wiki/Boris_Hagelin https://en.wikipedia.org/wiki/Boris_Hagelin
  - bschne 4y ago
    Ah, true, I forgot!

steve1977 4y ago

They were a tiny Swedish company…

Namidairo 4y ago

> It's not a faceless corporation with a Chinese PO Box. On this note, are Feitian still the OEM for the Google Titan keys?

JoachimS 4y ago

Tiny is a bit misleading. The turnover is about 100 MUSD. The company has about 300 employees, with offices in all regions of the world and a lot of R&D in the USA.

bberrry 4y ago
I wasn't aware they had grown that much. Thanks for the correction

JoachimS 4y ago

If you are looking for a tiny, Swedish company working in a similar area as Yubico, there is Tillits AB. Tillitis is a spin off from the Swedish VPN provider Mullvad. In contrast to Yubikeys, The Tillitis TKey as well as tools, device verification etc is 100% open source. https://tillitis.se/ https://tillitis.se/ https://github.com/tillitis https://github.com/tillitis https://mullvad.net/en https://mullvad.net/en (Full disclosure: I work for Tillitis.)

FeistySkink 4y ago
Is the TKey tamper-proof?
- JoachimS 4y ago
  No, not yet. Physical attacks are out of scope for the TKey1, even if we have some mechanisms in play which try to extend the time and effort required to perform a successful evil maid-attack extracting the Unique Device Secret (UDS). See the threat model for the release: https://github.com/tillitis/tillitis-key1/blob/main/doc/threat_model/threat_model.md https://github.com/tillitis/tillitis-key1/blob/main/doc/thre... The current casing is fairly tamper evident (it will break), but we do not yet use real, tamper evident sealing. We are looking at tamper sealing for future versions. And ways to further protect against physical attacks.
  - belter 4y ago
    When you do, please think about a special price for existing customers ;-)
jtvjan 4y ago
The key costs 880 SEK. That's about 78 euros or 85 dollars. It's designed to be future proof, with applications being uploaded to the device by the host. The website feels a bit cramped with all the large text on desktop, like it was only tested on phones
- 4y ago

aborsy 4y ago

Thanks for the info! The construction quality of Yubikeys has been good in my experience. I was just worried about the closed source proprietary firmware in a security product (including the random number generators, where issues were discovered in the past). But Yubikeys are used in various companies and apparently in some branches of governments too, thus must have been vetted by their security teams (though there could be different lines of firmware or products for different clients. People say there is not much benefit to purchasing FIPS-compliant Yubikeys. Neglecting the approved algorithms and features, is the firmware the same as that in non-FIPS security keys?)