Hacker News Reader

Comment by toastal | Hacker News Reader

Reminder: Yubico doesn't have a monopoly on security keys. Make sure your software/tutorials support the open-source alternatives like OnlyKey and NitroKey.

View on HN

Mullvad VPN has announced that their sister company "Tillitis"[1] is working on a really interesting key and it looks like it's releasing pretty soon (2023-03-23).

From the website:

>The TKey™ is a new kind of USB security key inspired by measured boot and DICE.

>TKey™s design encourages developers to experiment with new security key applications and models in a way that makes adoption easier and less risky forend-users.

>TKey™ is and always will be open source hardware and software. Schematics, PCB design and FPGA design source as well as all software source code can be found on GitHub.

[1]: https://www.tillitis.se/ -- also "tillit" is Swedish for "trust" and "mullvad" is Swedish for "mole" (the animal).

do any other keys have feature sets on par with yubikeys? last i checked they were ahead by a mile, the others i looked at were just fido2 keys

so far, Yubikeys are the only ones I've found that support both FIDO2 / WebAuthn as well as GPG smart card functionality for use with pass(1).

they also support ed25519 FIDO SSH keys, whereas all the cheapo FIDO keys I've tested only support ecdsa-nistp256, but that's a relatively minor difference.

Nitrokey 3 claims that GPG smart card support is planned in an upcoming firmware update. once that's released I may bite the bullet on shipping costs and order one. 55€ shipping to the US for a 49€ key is cost-prohibitive for the most part.

Also, yubikey works as a PIV smartcard

If you get a smartcard, you can install https://github.com/BryanJacobs/FIDO2Applet on it to make it into a FIDO2 authenticator. You can install a GPG and a PIV applet too.

A Yubikey is just a proprietary smartcard with a bunch of apps installed and some HID emulation (pretending to be a keyboard, which you likely do not want).

I think the keyboard aspect was wanted back when smart card readers and extra software drivers were needed, but there are USB "smart cards" now and operating system support is solid.

The HID support also lets you set a static string to send when you touch the button. Their homemade OTP uses it, too.

Where does one acquire a smartcard? I can't find anywhere without a MOQ

https://www.floss-shop.de/en/security-privacy/smartcards/

If you want to run flexible apps, I think you'd probably want a Javacard like those sold by https://www.smartcardfocus.com/shop/ilp/se~71/java-cards/p/i... , not a special "PGP Card".

> Nitrokey 3 claims that GPG smart card support is planned in an upcoming firmware update. once that's released I may bite the bullet on shipping costs and order one. 55€ shipping to the US for a 49€ key is cost-prohibitive for the most part.

They have been claiming many things. I pre-ordered a Nitrokey 1.5 years ago, still haven't received it, and apparently during this time they have not implemented much.

https://www.nitrokey.com/blog/2023/nitrokey-3-status-update-...

If they don't, that's more of a reason to use the OTHERS? You really don't want a monoculture here.

i would be happy to use the OTHERS if they were comparable products

What if open source is your most-wanted feature? That hardware isn't open.

Not really keys, but hardware wallets like Trezor or Ledger can do a lot of this for ~twice the price.

Hardware wallet authentication is really one of the 'web3' technologies that just works and we could be deploying everywhere right now. It's miles better than yubikey spitting out a static password, has plugins for every major browser and mobile device platform, can do identity verification without specific site account setup, and of course the whole pile of (optional) web3 things with crypto.

To be clear, I pointed out that the wallets can do many of the things the Yubikey can do (in addition to what you mentioned).

Any that are recommended for longevity? What can a Yubikey do that these wallets cannot?

Counterpoint: it’s miles worse than FIDO/WebAuthn, which most hard keys and modern OSes support. Asking users to install a browser plugin is a disaster waiting to happen for most users. Phishing of cryptocurrency hardware wallets happens all the time, but it is impossible to phish a Passkey. The reason a browser plugin is required is because these devices are made to transact on a blockchain, rather than open APIs intended for domain authentication.

Cryptocurrency wallets are horrible for normal security features that do not involve blockchains.

I think the fact that cryptocurrency wallets with millions of dollars still exist and are protected by these wallets is evidence that security is manageable. Proof is in the pudding.

Yeah, file-based keys managing millions of dollars exist in the crypto space too. “Manageable” does not mean “good”. The real pudding is this: hardware wallet users fall prey to phishing scams all the time and lose their life savings. It’s a horrible design for an auth system.

There are so many UX reasons why you would never want to conflate a login token with a key that can mathematically and instantaneously eviscerate your life savings. But to put it simply; there’s no way anyone’s grandma can use this system, wherein with something like browser Passkeys she has a chance.

There are definitely alternatives, but OnlyKey doesn't seem to use secure hardware and has a few other problems too: https://news.ycombinator.com/item?id=21884184

The backup functionality (which requires encryption password entry on a computer, i.e. not the device itself) looks especially concerning.

Safari seems to have its own implementation of a virtual security key also. Before I plugged in my Yubico recently, Safari asked me for my fingerprint as a fallback.

That’s part of WebAuthN[0]. Some services like AWS will not allow virtual U2F keys to be registered, but most places do.

[0] https://developer.mozilla.org/en-US/docs/Web/API/Web_Authent...

Not exactly – WebAuthN is the browser/JavaScript API, which can be provided by both platform authenticators (such as Safari on iOS and macOS, Chrome on Android and macOS etc.) and hardware/"roaming" CTAP2-compliant authenticators.

WebAuthN specifices the browser API, CTAP2 specifies the interface between an authenticator device/software implementation and a browser or other client, and FIDO specifies the behavior of the authenticator itself (including certification of attestation-capable authenticators).

It works for Safari.

For AWS, I use Firefox and a FIDO key, and have a backup MFA as Safari using U2F.

If Secure Enclave is as secure as Apple claims it to be, Safari‘s option might actually be the safest one. Of course you can’t use that on anything other than a Mac or iPhone, so in some situations you need another key.

It's a bit more specific than that, no?

You can't use Safari's option on anything other than that particular Mac or iPhone. It's my understanding that you can't extract the secret key from the secure enclave.

I don't know how this certain feature is implemented. But Pass Keys are synced via iCloud and the private key never leaves any Secure Enclave in unencrypted form. Maybe these virtual security keys are different in that they are never synced via iCloud, but principally they could be.

I’m unclear as to why we can’t use some sort of tpm for webauthn and distributed encrypted passwords for synchronisation.

Hell, even software based implementations which force domain checking would solve 99% of the problem…

Technically, we can just use client certs, YK supports them (via smartcard emulation, you can also use that to auth via SSH), just it wasn't really there, ever, on UI front...

or SoloKey

Unfortunately my solokey2 is buggy even with latest firmware. Hw is much better than solokey1.

But there are indeed alternatives to yubikey. Anyone have experience with https://www.token2.com/shop/product/token2-t2f2-fido2-and-u2... ? 128 resident keys is much better than 25/50

Unfortunately SoloKey doesn't work as an OpenPGP smart card, which means it's not a real substitute for a Yubikey. I haven't had any luck with resident FIDO2, either.

The Solo team believes that other functionality such as PIV overlaps with GnuPG use cases, so that OpenPGP isn't a priority, and their work on that functionality appears to have stopped in 2021. That's too bad, because OpenPGP's network effects far outweigh its pure functionality, which means a technical substitute isn't a substitute.

https://github.com/solokeys/openpgp

I've found Solokey to be unreliable. Recently, for example, I learned that the Solokey 2 can't be added to iCloud as a security key

I have multiple Solo Key 2 devices. (I bought a Kickstarter 4-pack.) I use one of them regularly, and I successfully added it to iCloud as a security key. It has been 100% reliable.

In August 2022 they released a major firmware update. Maybe that addressed the iCloud incompatibility and reliability issues?

Or Librem Key.

Reply on news.ycombinator.com