Hardware fido keys from token2 - anyone tried them?

Hat

@DeletedUser370 thanks for your detailed review.
Did you try to use it to log into a Windows 11 local account or with the admin prompt ?

DeletedUser370

Hat No, I have not tried this. Windows has no native support for signing in to a Windows account using a security key*, unless you are using an Entra-joined device with an Entra passkey saved to the key. Which means that for non-Entra-joined devices you will need to use custom software. From a quick search on token2.com I cannot find a mention of support for this. Yubico has their own software for this purpose, but their setup guide looks like an incredible nuisance, and you end up using the key in addition to your password, and not as a replacement for it. Which has caused me to never try this out, not even with my Yubikeys. There might be a tiny chance that Yubico's software will work with Token2 keys, but I doubt it. You have made me curious, so I'll probably try this out sometime. But I expect it to fail.

Shouldn't be a problem with Entra-joined devices, as models of Token2 keys are on Microsoft's list of supported devices for attestation with Entra ID. Unless your organization uses attestation to block certain keys, it should work fine with an Entra-joined device. Be sure to check prior to a purchase whether the model you are buying is on this list, if Entra ID is applicable to you.

*There might be a tiny chance that I'm wrong on this point, but I have not yet found evidence to the contrary.

DeletedUser370

Hat Did you try to use it to log into a Windows 11 local account or with the admin prompt ?

I have now tried to configure a Token2 key using the Yubico Login for Windows software and, unsurprisingly, it is not able to detect the key during configuration. Speculation alert: I'm guessing that the app is not simply storing FIDO credentials on the key, but that the Yubikey models that the app suports have special storage slots designed for such a usage. It would explain why not even the Yubikey Security Key series is supported by the app, even though they can store FIDO2 credentials without issues.

DeletedUser370

I bought the PIN+ Release2 USB-C key and have used it for a couple of weeks now. Adding a link to the product because all their keys have names that are ridiculously confusing: https://www.token2.com/shop/product/token2-t2f2-pin-release2-type-c-fido2-u2f-and-totp-security-key-with-pin-complexity-feature
I'm quite satisfied with it so far. It's of course more compact than the Dual key, and the hole for the keychain (is there a better word for that in English?) is placed farther away from the corners, which should mean that it's harder to break. It's shorter but slightly thicker than a modern Yubikey, which is fine for me. I now use one of my Dual keys as a backup key, which I'll store somewhere off-site, and one always connected to my computer.

Of course, like Yubikeys it doesn't have upgradable firmware. Which is ludicrous, but that's the state of the world today.

Soccy

DeletedUser370
In a way, forever firmware is a security feature. It ensures nobody is flashing compromised code onto the devices, as inconvenient as needing a new generation of device every now and again. I only wish it were possible to update a device to support more passkeys if some more compact storage method arose (Yubikey is just too dang small)

DeletedUser370

Soccy In a way, forever firmware is a security feature. It ensures nobody is flashing compromised code onto the devices

Is it not possible for a vendor to sign firmware updates with a private signing key?

Hat

DeletedUser370 I asked them about the Windows login and admin prompt and they confirmed that it wasn't available because Microsoft doesn't support it as standard. Special software would be required.
Anyway, I ordered 2 of the same keys as yours.
I tried one with a hosting provider, Brave on Windows and it worked perfectly without password.
After that I tried with Amazon and I didn't like because Amazon force to use a Windows password (password specially for the key) in addition at each login.
At the moment I didn't try with GrapheneOS because I didn't put Google Play Services on my main profile.

DeletedUser370

Hat After that I tried with Amazon and I didn't like because Amazon force to use a Windows password (password specially for the key) in addition at each login.

I assume you are talking about the PIN of your security key? Or are you talking about Amazon asking you for a TOTP in addition to your security key? If the latter, that can be disabled in your Amazon account settings.

Hat

DeletedUser370 I assume you are talking about the PIN of your security key?

Yes. It seems that the website decides if the PIN is required.

DeletedUser370

Hat For passkeys, the standard is to require user verification (PIN, fingerprint) upon signing in to a service. That is not exclusive to Amazon*. I assume that this is required in order to avoid someone being able to access all your accounts simply by stealing the security key itself.

*The only exception to this that I have observed is the Google Play Store, which allows you to sign in with a passkey over NFC without needing to enter the PIN.

Hat

When and Why PIN Is Asked?

The decision whether to authenticate with a security key with or without a PIN rests with each website or authentication service.

The service provider set on userVerification property one of three options: required, preferred, or discouraged.

I prefer when the user can decide.

DeletedUser370

Hat When and Why PIN Is Asked?

That was a very good summary of the specification and its practical usage. Thanks for linking to it.

klaeuser

DeletedUser370
unfortunately there is no such setting (System > Keyboard > Physical keyboard ...)

DeletedUser370

klaeuser I replied in the new thread you made: https://discuss.grapheneos.org/d/19083-passkey-token2

DeletedUser370

I just noticed today that my Token2 USB-C "PIN+ Release 2" key has received a crack along the half of it. It still works, but the water protection is probably destroyed. I've only kept this key on my keychain, kept in my pocket, and it hasn't been subjected to much force at all. Barely anthing. Used it for about 6 months. I noticed that, after my purchase, Token2 added a notice to the product page:

To ensure proper use, please adhere to the following guidelines:
Use keyrings ≤ 3 mm thick or a lanyard.

My keyring is barely 2.5 mm thick. Perhaps they read my previous review of the Token2 Dual key cracking along the hole for the keychain and then added a notice. The USB-C version felt more solid though.

Not impressed by this product. Never had a Yubikey crack in the past, which was kept on my keychain as well for about 2 years. I'll just buy a silly Yubikey again. They have 100 passkey slots now, which is currently plenty. Not many decent competitors of portable security keys at all. I'll have to readd all my dozens of accounts to it. I was already in a bad mood but now I'm even more annoyed.

BaronAfanas

DeletedUser370 I noticed after I bought two Token2 that KeepassDX supports the Yubikey challenge only on Yubikeys. Who would have thunk...

« Previous Page