Hacker News Reader

Comment by Someone1234 | Hacker News Reader

The wireless key is the "Feitian MultiPass FIDO Security Key" I'd caution people to read the Amazon reviews (specifically people found it unreliable and it would break if dropped/roughly handled).

They both seem to be re-branded Feitian, which cost less ($25 + $17 = $42) when purchased under that brand from Amazon than the Google Titan moniker.

View on HN

Given the recent amount of reports of counterfeiting on Amazon (not specifically this product), I'd buy my security keys elsewhere.

That does not make sense in this case.

The key is made by a company called Feitian (Feitian Technologies Co., Ltd), on Amazon. That's the original manufacturer selling directly on Amazon [1]. That's the only one available. Its about as authentic as you can get on Amazon. I'd rather buy it from Gearbest or Banggood but they don't sell this. And Google just sells it rebranded.

Though I won't buy this (I could use the BLE part of it), since for one it doesn't seem to be build strongly (overcome-able but still), it only seems to work with Chrome according to reviews (I use Firefox), and I'm unsure if Bluetooth is secure for this method, nor reliable. NFC should be fine, since its much closer range, and I have a YubiKey NEO but my phone doesn't have NFC, unfortunately.

[1] https://www.amazon.com/Feitian-MultiPass-FIDO-Security-Key/d...

The Feitian works just fine with the latest Firefox builds. The bluetooth functionality is great if you have an iPhone.

I assume everything on Amazon is a counterfeit and plan accordingly. Have you heard anything about Walmart? They have free two day shipping and I haven't heard any counterfeit horror stories (yet)

They allow third party sellers so if it's not a problem now it will become one.

Do they also mix inventory geographically?

Doubt it. Third party seller stuff looks to be shipped by that seller. The way it should be.

That's good. Prevents your customers getting fake products if you, as a seller, don't intent to. (Excluding warehousing mistakes, etc).

This way a reputation system is more effective.

I wouldn't go that far. There is really nothing wrong with offering fulfillment services.

The comingling of products in the binning process isn't good, though.

"Firmware for Titan Security Keys is engineered by Google, to verify the key’s integrity."

That won't resolve many of the negative reviews of the MultiPass key, since they're complaints over the physical design and usage.

Yes. Sorry I should have made it clear I was addressing the second part of your comment, i.e. a reason to pay $50 for hardware you can get for $42 elsewhere

I suspect these keys will be FIDO2, so even if they look the same, even Feitian might raise up its prices a little bit supporting the new standard. I don't know, just guessing.

Also, in Google's $50 there are also 2 cables usb-a2c and c2a. I guess they decided to go the way of the complete package with all you may need.

BTW, we're working on an open source FIDO2 security key, Solo.

We're having a kickstarter soon, and if you're interested you can join the waiting list at https://solokeys.com/

I don't think this is true. Titan seems to be an in-house project. Are you basing this assumption on anything but the exterior looks?

As a person enrolled in Google's Advanced Protection Program, Google recommended that I use the Feitian Multipass Key upon sign up. I bought a few of those, and it looks exactly like the key in that picture. I'm looking at my Feitian right now, and I can promise you it's the same.

https://www.ftsafe.com/article/563.html

(I work at Google).

While I don't know whether or not Feitan manufactures those keys, I believe the answer is that they don't. More importantly though, that article doesn't really provide any detail one way or the other. Advanced Protection works with any FIDO/U2F key. Feitan's keys are valid AP keys. Titan keys are valid AP keys. Yubico keys are valid AP keys.

That a key works with AP doesn't say anything about who made it, and that article just says that you can use Feitan's keys with advanced protection, not that they're Google's key manufacturer. In fact I think that article is from before Google announced the Titan keys, but I'm not 100% on that.

Google provided identical Feitan keys for Advanced Protection as recently as a couple of months ago[0]. AP works with any FIDO key, but that isn't what we're discussing, we're discussing that these are re-badged Feitan keys. Which they most likely are.

[0] https://i.imgur.com/5EWh0jx.png

Yes, Google used to provide Feitan keys. That doesn't really address whether or not these are Feitan keys. (I'm also not sure what you mean by rebadged).

Rebadging is when you primarily change the branding of a product (and some customizable aspects of it). Sometimes these are white label products whose entire purpose is to be rebadged, other times it’s another companies offering.

I read the doc. Seems to be something like a user guide for the Feitan product published a year ago. Never it mentions the hardware/firmware of Titan keys that Google sells today is theirs. Most security keys from various companies look alike.

Sure most security keys look vaguely similar but these are clearly completely identical physical designs. Why would you think they happened to make an extremely detailed clone of the Feitian hardware rather than simply buying it and flashing their in house firmware?

Feitan > Titan

It's only a syllable away.

Reply on news.ycombinator.com