Ask HN: (Cheap) U2F Tokens?

https://news.ycombinator.com/item?id=20122131

by dbmueller • 7 years ago

2 10 7 years ago

news.ycombinator.com

What 2 factor authentication tokens are you using?

I know about the following (open source ones I think):

* u2fzero

* solo keys

* nitrokey

* tomu + the right firmware (which I guess is not really cryptographically secure)

I'd lean towards the solo keys since it's open source, and I haven't seen any criticisms, but tomu is quite cheaper. Also, which one support “cloning keys” at the setup phase so as to have a backup of your key?

What are your experiences? Recommendations?

panpanna2• 7 years ago

Not really an answer to your question but...

I think the main issue here is to find cryptographic chips in low quantities and diy-friendly packages. The f2c algorithms themselves are not exactly rocket science.

dbmueller4• 7 years ago

But are cryptographic chips actually needed for 2fa tokens to be useful. A lot of security risks are already covered by having a physical second factor, no?

panpanna2• 7 years ago

I think it's mainly for secure storage and secure RNG people use them.

You can of course claim you need neither.

xzcvczx4• 7 years ago

why would you want to clone keys? the point is when one is stolen or goes missing then the 2nd key is useless anyway and you would need new keys.

dbmueller4• 7 years ago

Well, it could also happen that your first key simply fails or gets broken, in which case it's easier to just have a backup.

xzcvczx4• 7 years ago

well all the keys as stated will not allow you to clone keys, except potentially the solo key hacker version and the tomu (hacker version if there is one), as the whole concept behind the 2FA devices is that you can't read the crypto keys off the device, if you could then a reader/device could grab a copy of those keys and your 2FA is no longer secure.

Ask HN: (Cheap) U2F Tokens?

Related Stories