Arch Linux partners with Nitrokey to equip its staff with USB keys | Hacker News Reader

Arch Linux partners with Nitrokey to equip its staff with USB keys

lists.archlinux.org

26 pointsFoxboron8 comments

This would have stronger endorsement value, if the style was toned down from "Nitrokey press release" to "Arch Linux announcement".

I have never used Nitrokey products. I want to believe that the Arch team vetted them before agreeing to use their mailing list for advertising.

But the vibe here could equally be "Coca-cola coupons for Arch team members" -- i.e. "The corp contacted us with a product marketing agenda, and offered us something in exchange for advertising".

I don't mean to be cynical. I'm trying to help. :-/

Nice to see all of this.

Nice to see Nitrokey afloat - a small company serving to the demands of us, FOSS centric folks. Nice so see them striking good deals with organizations which deliver FOSS.

Was nice to get my own Nitrokey free of charge from a similar deal with Gentoo Linux 2 years ago :)

>Was nice to get my own Nitrokey free of charge from a similar deal with Gentoo Linux 2 years ago :)

Yep, Gentoo was the reason we wanted to seek out a similar deal :)

I've been tracking Nitrokey for a couple of years now, and am really impressed with the products they offer.

If you want an HSM (secure key storage), their Nitrokey HSM is available for only 70 euros (compare to YubiKey HSM at 600 euros).

If you wanted tiny (e.g. leave-in keys) YubiKey was the only option, but the Nitrokey 3 is supposed to be coming soon with leave-in for USB-A at least

I thought these numbers must be off but the YubiKey HSM really is $650 [0]. What justified that price? Can someone walk me through the typical use case/application for these?

0: https://www.yubico.com/product/yubihsm-2/

An HSM is a device that's meant to hold keys, allow you to use them, but never allow you to access them. In other words, it's a true digital 'key' that can't be copied.

If you truly care about the encryption on your servers, for example, then normally your server can't boot/decrypt the drive without an HSM (which you aren't supposed to leave plugged in). You give one to your CEO, your CTO, and your CFO, for example, and you require that at least two of them are present to boot your servers (to prevent attack by theft).

There are more fault-tolerant possibilities out there (e.g. Hashicorp Vault), but they're generally bootstrapped from HSMs.

For those who use usb security keys, what happens when I lose it?

Do I need to buy two of them and keep them synced somehow?

When storing a GnuPG private key on it, yes you still need a backup. The backup can be a second similarly provisioned USB device, or any storage device that you trust to be secure, such as a paper key in a fire safe.

Reply on news.ycombinator.com