Hacker News Reader

Comment by zitterbewegung | Hacker News Reader

This is a pretty compelling U2F solution. It matches the price of a Yubikey but you really get a Bluetooth key and a USB version in the box (with a USB C adaptor ?). EDIT : child comment says the USB key also has NFC.

View on HN

> This is a pretty compelling U2F solution. It matches the price of a Yubikey

Not really. The $50 Yubikey does a lot more than these (e.g. storing PGP keys, etc). If you only want U2F, Yubico sells their blue key for only $20 (or a 2-pack for $36):

https://www.yubico.com/product/security-key-by-yubico/#secur...

I've been using them for years and see no reason to switch.

Comparing 2 Yubico Security Keys to the Titan Security Key pack is the correct comparison.

Looks like the Titan Security Key (USB) has NFC and the Yubico Security Key does not. And the Titan Security pack has two adapters.

I call it a draw.

You trade NFC for Bluetooth, but get a back-up key instead of purchasing it separately for another $20.

Edit: it seems like the USB key supports NFC, but not the Bluetooth key. From the website:

USB Security Key

For use with your computer. You can also connect to most Android devices that support USB or NFC.

> This is a pretty compelling U2F solution

No it's not. It's manufacturered in China, a state devoted to spying on its own citizens to a degree higher than the NSA (social credit scores, etc) and preventing the free flow of information. I wouldn't trust this thing to store my zip code securely, much less a private key.

Thanks for informing me I appreciate it (I’m a happy user of a Yubikey).

Since the key doesn't have wifi or anything, how can the private key flow back to China? (This is a serious question - is there enough wiggle room in the U2F protocol to allow the device to reveal the private key to a Chinese website, if they can trick you into visiting it, or something?)

It's a USB device, it already has the ability to do terrible things[0] when you plug it in.

0. https://www.wired.com/2014/07/usb-security/

OK, "the device is secretly a USB Rubber Ducky-style device that will send keyboard shortcuts to open a new tab, send data, and close it" is definitely a potential attack, sure. It would almost certainly be super noticeable (unless everyone else's browsers are much faster at opening and closing tabs than I am) so it seems like the sort of thing you'd only deploy against a couple of high-value targets at some single opportune moment, but that's arguably within Advanced Protection's threat model I guess.

That's easy: The Chinese government could infiltrate the factory and keep a record of the on-chip private key, then kill anyone who doesn't agree to go along with it. Or bug the programming devices. Chinese courts are far from independent - they do as they are ordered by the Communist party, and rulings highly depend on guanxi or connections (family, party, or both).

The whole security key thing relies on a chain of trust. Unless you are designing your own chips (and verifying samples of them to ensure nothing has been added), you can't ever really know if some bad actor or state actor has compromised the chain somewhere along the way.

So far in the US, such things are not legally required and where ordered by lower courts the appeals courts have overruled them. As it stands today the government can't require anyone outside of a telephone company to implement any technological measure to assist them in spying (telcos are required to assist with wiretaps). Companies might go along with a request of course.

I'm not saying there is a perfect solution here, but in general I trust chips and devices manufactured in the US and Sweden to a much higher degree than devices made in China.

> Since the key doesn't have wifi or anything, how can the private key flow back to China?

The bluetooth one has a bluetooth radio (obviously). I suppose it's conceivable that the firmware could have a backdoor that allowed exfiltration of the private keys via that radio. Such a backdoor could probably be used in a targeted way against particular people in public places like a airports or cafes.

Given that Google is marketing these things towards high-value targets such as journalists, campaign advisors, and Google engineers; building such a backdoor would be very tempting. It wouldn't even have to be present in stock keys, if the shipments could be intercepted in the mail on their way to particular targets.

>how can the private key flow back to China?

You're assuming the key needs to flow back.

It's also manufactured by Google, which is equally adept in spying and probably more unworthy of trust.

But more importantly, it's just a bad deal. A yubikey neo can do GPG, PIV, OATH, OTP, HMAC challenge response, and a few other things in addition to NFC U2F for the same price. The Titan dongles package just does U2F, and U2F isn't even that great.

And you can't use BLE with your laptop

The Titan (& the Feitian) have a usb cable.

Digipass Secure Click sells with a ble2usb dongle, that let you use ble with your laptop (I have it fixed into my external monitor for example).

Note that it's not a limitation of the security key, it's more the browsers that only implement fido2/u2f (ctap) over usb.

Reply on news.ycombinator.com