Which U2F Key?

DeletedUser570

schweizer Why should I trust you more than GrapheneOS which work to improve security and privacy? And no hardware keys are not far superior, they are behind on hardening the secure element like Pixels. And your point that Apps for 2FA are not second factor is just wrong. And Windows is not secure either like most desktop OS. Those hardware keys you mentioned have less research and resources for making it secure. Google has the best research for security and privacy. And the NFC is an attack surface too, which you would not have with Pixels. Those hardware keys often have many vulnerabilities.

schweizer

DeletedUser570 You misunderstand so many things. Google has been a key driver in developing FIDO2. They use hardware keys instead of GrapheneOS internally. Then again the GrapheneOS team is small and their ressources limited.

FIDO2 provides security against man in the middle attacks while TOTP does not address this popular attack vector. To my knowledge FIDO2 U2F has never been hacked where TOTP does not need to be hacked. It is unsafe by design.

Not using a desktop computer is not a realistic option in todays work life.

DeletedUser550

On my phone, no.
On my Laptop, yes.
Yubikey, but not any more...
I cannot reconcile myself using a device that is marketed as a security USB key, with out of date and software.
Older keys are intentionally unable to be updated. The only option is to buy into the system again as you will no doubt be invested in apps etc..and buy the newer keys with up to date software.
That is until, they produce a new key...
A marketing bonanza for sure.
I have taken my hard earned cash elsewhere.

DeletedUser570

DeletedUser550 So you decide not to have it on your secure phone but instead on an insecure place? Desktop OS is a lot weaker than mobile OS like Pixels or Iphone. Most of those hardware keys even if they are new, they don't have the capacity/resources to make the secure element really secure with hardening. Google does have the capacity to do that and they did. The 2FA Apps do not come with costs and are more secure than hardware keys/wallets. Those hardware keys or cold wallets have higher attack surface too, because of Bluetooth, NFC, Wifi and more. With GrapheneOS and airplane mode this attack surface is not there.

fid03

DeletedUser570 https://discuss.grapheneos.org/d/17614-which-u2f-key-is-the-most-secure/23

DeletedUser570

fid03 I know about that but GrapheneOS recommended me to use the phone instead of hardware keys/wallets. And it makes totally sense.

fid03

DeletedUser570 I know about that but GrapheneOS recommended me to use the phone instead of hardware keys/wallets. And it makes totally sense.

Sure. But GrapheneOS has no native support yet for storing passkeys to the Pixel secure element. I believe the software HW Fido2 Provider can do that, but it doesn't have a way to view, manage or delete them.

xxx

DeletedUser570
Nitrokey is opensource so you can check ;-) They work with the same hardware as solokey? Not sure.
To my knowledge their products are 'fine'.

DeletedUser570

xxx I know that those are open source but open source does not mean secure or more secure than pixels secure element. I used Nitrokey before too, which I said before. But your knowledge and assumption that it is fine, is not facts and wrong in this matter.

DeletedUser570

fid03 I never heard about that and it's interesting to read/think about. What I understood from it was to use a 2FA App. But I could be wrong, since your point with passkey confused me.

@GrapheneOS Could you maybe clarify in this topic?

fid03

DeletedUser570 I never heard about that and it's interesting to read/think about. What I understood from it was to use a 2FA App. But I could be wrong, since your point with passkey confused me.

Your original post asks about recommendations for a U2F key. By U2F I assumed you meant FIDO U2F. Did you instead mean TOTP (Time-based One-Time Passcodes)? Note that TOTP is not part of the FIDO U2F standard (nor the newer FIDO2 standard).

DeletedUser570

schweizer That's an assumption. I know this topic quite well. I know what your point is but I disagree. And the real unsafe by design is any Desktop OS. Your point about GrapheneOS team makes no sense in this argument. And Google making FIDO2 does not mean hardware keys are more secure.

And your wrong about the need of desktop computer. We have the option to use Desktop Mode on Pixels -> Use Monitor, mouse and keyboard with it - it's the same as computer but the most secure option instead. Most things you can do on desktop OS, you can do on Android too.

DeletedUser570

fid03 No, I meant hardware keys for U2F but I decided against it -> after my research. And I know about that.

« Previous Page