ecesena

76 ms·

781.
by ecesena 8y ago
Decentralized, especially when there’s a single company behind it.
782.
by ecesena 8y ago
Github pages supports TLS even for custom domains now, via Let's Encrypt. At this point, I don't think there's any excuse anymore for having a static website without TLS. Either use Github pages, or just use your favorite hos
783.
by ecesena 8y ago
To setup the company, you don't need to live in the US. Today IMO your best solution is to register a Delaware corp via Stripe Atlas. It's relatively cheap, but keep in mind you'll have to pay taxes and an accountant, so plan
784.
by ecesena 8y ago
BTW, here are the cases: https://conorpp.com/designing-solo-a-new-u2ffido2-token
785.
by ecesena 8y ago
I personally use medium for the distribution. I also like the distinction between views and reads in their analytics -- I'm sure it's not perfect, but at least you have some metric to say if people are just clicking or not. There
786.
by ecesena 8y ago
Let me try to rephrase. If you have a (too easy) way to backup, i.e. extract, the master key, then an attacker can use the same mechanism to backup your master key without you even knowing that the backup happened. You can, for example, s
787.
by ecesena 8y ago
Firmware. In the blog post there's a section on this, and why.
788.
by ecesena 8y ago
NFC is just more convenient. Also, the support for fido over usb vs nfc vs ble depends on the apps/software implementation. To my knowledge Google supports all of them, but many apps may just choose to implement NFC as it's "
789.
by ecesena 8y ago
We're considering this and similar features (gpg/ssh keys). One minor issue is the memory requirement, as our current chip only has 128KB of flash available. The bigger issue is certainly our time :), we're really pushing to
790.
by ecesena 8y ago
Please let me start by saying that Yubico is NOT the closed/evil. Without Yubico, we wouldn't have security keys, and we probably wouldn't have these standards. They're working since 10+ years on this problem, and they r
791.
by ecesena 8y ago
Independently from the protocol you choose, the final result is that two (or more) devices will share the same private key for, e.g., your google account. The problem that we need to solve securely, is that you as a user must be sure you kn
792.
by ecesena 8y ago
It's still stronger crypto vs passwords and tokens. It has certainly different use cases, and you need to protect your laptop in other ways, for example with a strong enough password to unlock the screen. It's certainly not a prod
793.
by ecesena 8y ago
I showed the prototype yesterday night to my aunt and uncle. They had issues keeping it in their hands, let alone pressing the button. The tomu/yubikey nano are great products for a certain population, and certain use cases. I have a n
794.
by ecesena 8y ago
To echo on Conor's comment, our keys will protect you from online attacks. The one you describe is certainly a threat, but still pretty sophisticate and requires physical contact with the key. To protect from physical attacks you need
795.
by ecesena 8y ago
That's good for a wallet, because misuse would signify loosing money. As these keys are primarily designed for 2fa, the attacker would also need your password to break into your account. Things may change when 1fa will be more widely a
796.
Designing Solo, a new U2F/FIDO2 Token(conorpp.com)
144 points by ecesena 8y ago|93 comments
797.
by ecesena 8y ago
Conor tweeted a few example: https://twitter.com/_conorpp/status/1031731934643269632?s=21 I’m currently on the road, but I’ll let you have the dimensions. The other tricky part is usb-a vs usb-c.
798.
by ecesena 8y ago
Slightly smaller. And we’re planning to have colored silicone cases. Will you be in startup school program, or were you talking at a personal level?
799.
by ecesena 8y ago
Homomorphic encryption and quantum cryptography
800.
by ecesena 8y ago
We’re building Solo, an open source security key that implements the new FIDO2 standard. We’re launching a kickstarter during the school, fingers crossed. If you’d like to join the waitlist: https://solokeys.com/
801.
Pre-announcing Solo: the first, open source, FIDO2 security key(medium.com)
5 points by ecesena 8y ago|0 comments
802.
by ecesena 8y ago
Ehm, our ignorance. I’m investigating, though now we’re a bit of in an “advanced stage” with Kickstarter and I’m not sure we can easily swap to CS.
803.
by ecesena 8y ago
If they have u2f then it should work out of the box. I’ll try to test it, time permitting.
804.
by ecesena 8y ago
It should be fixed, thanks again for catching it. (followed the recommendation -- only for large screens though, it's late and I don't want to make mistakes ehehe)
805.
by ecesena 8y ago
Do you know if Nextcloud supports any form of 2fa?
806.
by ecesena 8y ago
Thank you, I’ll fix it later tonight. Can you confirm your resolution? I mostly tested it on small screens, I wasn’t expecting the front page.
807.
by ecesena 8y ago
The one in the pictures uses a EFM32 Jade/Pearl [1]. More details are in the discussion on github: [2]. [1] https://www.silabs.com/products/mcu/32-bit/efm32-pearl-gecko [2] https://github.com&
808.
by ecesena 8y ago
First version will be fido2 only, thought the firmware is open, so easy to extend. We'll just have to verify which features are copiable vs proprietary for yubikeys. To be honest I don't know at this point, I mostly use my keys fo
809.
by ecesena 8y ago
Got it, this makes sense to me. And sorry, I was rereading the thread, I don't want to think I'm dismissing your whole article, I really appreciate you writing about it. I think the time is a big advantage. As I mentioned, I'
810.
Pre-announcing Solo: the first, open source, FIDO2 security key(medium.com)
4 points by ecesena 8y ago|0 comments

More ›