Which U2F Key is the most secure?

Guillaume

Guillaume And it has nothing to do with the discussion but I would like to take the opportunity to point out that ProtonPass is on sale with a unique and LIFEtime offer!

fid02

PrivacyAndSecurity

Back in May 2024 a GrapheneOS developer mentioned the Trezor Safe 3 as what they consider a more secure alternative to FIDO2 with Yubikeys (source).

Quote:

https://trezor.io/trezor-safe-3 has a decent secure element and can be used for FIDO2, and using it requires unlocking it with a PIN with secure element enforcing a max attempt limit

that's not the main purpose of that but it can be used for FIDO2, SSH, PGP and other things like that despite it not being the main use

dext

fid02 Outside of it main purpose, the documentation is terrible. Someone please send sources if I'm wrong somewhere.
It's an interesting device for u2f if you already use it for crypto, but it's more lie OnlyKey than Yubikey or Nitrokey.

It's not unique and unforgeable. It has a secure element, but the main key is not derived from unreadable hidden key, but from a dice password you remember. So in practice everything I talked about OnlyKey applies.
No NFC, not waterproof. There is some documentation on GPG, but it looks like it doesn't work as standard Smartcard. Isn't it only a backup for GPG stored inhome directory?

Updated table:

| Feature\Device......| Yubikey..| Nitrokey..| OnlyKey..| Trezor..| | Unique/unforgeable..| yes......| yes...... | no...... | no......| | Updatable.......... | no...... | yes...... | yes......| yes.... | | Smartcard.......... | yes......| yes...... | no...... | no......| | Passkeys............| 128......| 50?...... | 12?......| no?.... | | NFC................ | yes......| yes...... | no...... | no......| | IP68................| yes......| no........| yes......| no......| | Backup..............| no...... | no........| yes......| yes.... | | Long-term cost......| $$$......| $$........| $........| $...... |

fid02

dext I deliberately didn't comment on the practicality of Trezors as FIDO keys, seeing as the original post was asking about security features. Thought it would be nice to quote a security researcher on the matter, as my own insight into hardware security is severely restricted. But I agree with you on the practical challenges of using a Trezor if you're intending to carry a key around with you wherever you go, indoors and outdoors; it's clearly not designed for that practical purpose.

« Previous Page