5 ms·
Ask HN: Alternatives to Yubikey?
I haven't had a good experiencing with Yubikey's support and sales team and I'm looking for an alternative.
What other keys are people actively using?
I'm interested in something with equivalent features to the Yubikey 4 (NFC not required, U2F mandatory).
- graystevens 9y agoHere are a list that someone has collated - http://www.dongleauth.info/dongles/ http://www.dongleauth.info/dongles/ The alternative to Yubikey that I am aware of is NitroKey, but can't say I am aware of how they match up, feature for feature
- wslh 9y agoTrezor? https://blog.trezor.io/secure-two-factor-authentication-with-trezor-u2f-e940fd5a60af https://blog.trezor.io/secure-two-factor-authentication-with... It is also hackable: https://doc.satoshilabs.com/trezor-tech/resources.html https://doc.satoshilabs.com/trezor-tech/resources.html
- anonova 9y agoAnother hardware wallet that supports FIDO/U2F is the Ledger Nano S: https://www.ledgerwallet.com/products/ledger-nano-s https://www.ledgerwallet.com/products/ledger-nano-s The downside of this and the Trezor is that you need a cable to connect it to a device.
- 2bluesc 9y agoWhat was you issue with support? I've had 2 Yubikeys replaced at their cost after published security exploits highlighted shortcomings. Also haven't had one fail on me yet. Would be curious to learn what your experience was.
- eekthecat 9y agoThey are unresponsive for really simple questions (email/Twitter). Their local reseller is not interested in non-business sales.
- thehigherlife 9y agoWhat are you hoping to do with yubikey / what was your question?
- captainmuon 9y agoWhile we're at it, is there one that: - Lets me store certificates and PGP keys - Has two factor authentication (U2F) - Has open hard and software (source-available) Basically, a USB pen drive that allows U2F, and is can be made read only (either by a switch or only writable over a special interface). I don't really need tamper-resistance, pre-generated keys, smart cards or any other advanced features.
- epistasis 9y agoThe difficulty with PGP keys, is that the most common implementation, GPG, wants complete control of the device and does not let it be shared so that other interfaces, like PKCS# can be used. So if you want something for both GPG and other purposes, it really needs to present as two separate devices, or you need to go hacking a branch of GPG. When I looked into doing this, it seemed that upstream would not be interested in interoperation with other smart card standards, so it may not get accepted into upstream. At least that was my experience. If somedbody can correct me, I'd be incredibly grateful.
- captainmuon 9y agoHuh, interesting. I didn't even know GPG could handle devices as such. I was just looking for a device that holds my key files (like for email, ssh, ...). Would of course be great if you could hand the device some plaintext and it would encrypt it without the key leaving it, but I didn't even think about that to be honest. But it makes sense :-).
- roman_zeyde 9y agoI can suggest using TREZOR and Ledger Nano S hardware devices for common GnuPG operations, e.g. signatures and decryption. Please take a look at https://github.com/romanz/trezor-agent/blob/master/README-GPG.md https://github.com/romanz/trezor-agent/blob/master/README-GP... for more details. Disclosure: I am the main developer of this project.
- Nexxxeh 9y agoBoot time and physical size might prove to make it unwieldy, but could you use a Pi Zero in a gadget mode with OTG? You can have it emulate USB HID, so presumably U2F would be workable, and it'll do USB Mass Storage too. Open hardware and software.
- dsl 9y agoNitroKey (https://www.nitrokey.com/ https://www.nitrokey.com/) is the non-crappy version of YubiKey.
- kps 9y agoAccording to that page, the only variant that does U2F does nothing but U2F.
- noja 9y agoyeah what is with that? I want all the boxes ticked!
- tmikaeld 9y ago+ It is (fully) open source - Doesn't support U2F (yet) - Supports only one password manager [1] - Recommends using their own password manager (That has a limit of 16 passwords) [1] https://www.nitrokey.com/documentation/applications#a:password-manager https://www.nitrokey.com/documentation/applications#a:passwo...
- travisby 9y agoUnfortunately it's not _fully_ open source. They don't say it anywhere on their webpage, but they use an [OpenPGP Smart Card](https://www.g10code.com/p-card.html https://www.g10code.com/p-card.html) internally, where some of the implementation by ZeitControl isn't open source. g10 has a reference implementation that is fully open source, but there's some additional (timing?) attacks that Zeitcontrol has implemented and cannot release. Note the NitroKey start is a gnuk implementation and is fully open source. The tamper-resistant models are using the BasicCard with Zeitcontrol software.
- tokenizerrr 9y agoWhat is non-crappy about it compared to the YubiKey?
- dchest 9y agoI have two of their U2F and if the OP's problem is sales and support, I'm not really sure Nitrokey are without issues as well: 1) Ordered 2, received 1. Thankfully, support quickly sent the second one once I wrote to them. 2) Now they only work when I plug something else to another port to my Mac (no such problem with Yubikey). No reply since April 29: https://support.nitrokey.com/t/nitrokey-u2f-issues-in-macos-10-12-4/444 https://support.nitrokey.com/t/nitrokey-u2f-issues-in-macos-... Edit: I now noticed they have a different U2F version — the previous one was a card that you fold to make it into a USB dongle.
- debatem1 9y agoI've given up on yubikey at this point. I love the form factor, but it was easier in the end to build a different second factor infrastructure than it was to deal with the company. I've been toying with the idea of building an open source replacement and fabbing it with a shuttle service but ultimately the cost is really too high to justify.
- markgamache1 9y agoSounds like an opportunity for someone to make consulting money. I have found their docs lacking, but never tried support. Once I muddled through and figured out what I needed, I have been very happy. That said, I have looked for alternatives and found none. I am most disappointed in the mediocre coverage of their RDP drivers. I need to use all the features over RDP. Some work and some don't.
- bockafer 9y agoPerhaps? * Do not allow smart card redirection Group Policy object
- weinzierl 9y agoNitrokey (formerly CryptoStick) https://www.nitrokey.com https://www.nitrokey.com AFAIK they are used at Mozilla. The Firmware is Open Source. Downside is that not all their dongles support U2F.
- drdaeman 9y agoActually, none does: https://www.nitrokey.com/#comparison https://www.nitrokey.com/#comparison The only dongle to support U2F is currently only available for pre-order, with ETA in autumn 2017.
- chipz 9y agoSlightly out of topic, is it possible to create one with similar function to yubikey with USB flash drive?
- tptacek 9y agoIt's worth considering: almost nobody who uses Yubikeys loves them, but they are by a wide margin the tokens experts recommend most.
- api 9y agoThe problem is largely with their docs, or lack thereof. Just figuring out how to use one as a token for ssh is incredibly painful. The docs are very "enterprise," meaning half-done, overly complicated, confusing, scattered, etc.
- drdaeman 9y agoThere was a series of changes, e.g. regarding platform keys, software source availability etc etc. I think there were some "I don't endorse this anymore" posts, although I don't really remember the details.
- tptacek 9y agoI've read "I don't endorse this" from open source advocates, but none from crypto engineers.
- dkhenry 9y agoI use my yubikey and I love it. I have it set up to do GPG, SSH, TOTP, and U2F and it works great. It is worlds better then any other Smart Card or second factor out there, and U2F is literally just plug it in and tap it.
- cafogleman 9y agoI recommend the OnlyKey: https://www.amazon.com/OnlyKey-Color-Password-Manager-Obsolete/dp/B06Y1CSRZX https://www.amazon.com/OnlyKey-Color-Password-Manager-Obsole... The device uses strong encryption (where legal), and goes beyond U2F to include password management, certificate storage, OTP/Google Auth, and plausible deniability. The hardware is teensy-based, and the firmware is open source. The devs have released fairly regular updates, and even encourage hacking on it to meet custom needs.
- voidz 9y agoDoes not ship to the Netherlands... Meh!
- j_s 9y agoYou can buy the international edition with PayPal and re-flash it. https://crp.to/p/ https://crp.to/p/ I am interested to find out more info on the tamper-resistance of the hardware.
- cafogleman 9y agoThey have an international version that does not ship with encryption of the data stored on the device, to deal with the various laws around encryption in other countries. However, there's no hardware difference, and since it's all open-source, there's nothing stopping you from loading the "US" firmware on the "International" version. More info at their site: https://crp.to/ https://crp.to/
- funkaster 9y ago
- j_s 9y agoThis came up last week on the OpenPGP discussion; here's a re-post -- no one else has mentioned the sc4-hsm yet. https://news.ycombinator.com/item?id=14495213 https://news.ycombinator.com/item?id=14495213 Open source (-ish?) Yubikey alternatives https://sc4.us/hsm/ https://sc4.us/hsm/ $75 | https://news.ycombinator.com/item?id=12053181 https://news.ycombinator.com/item?id=12053181 https://trezor.io/ https://trezor.io/ $99 | https://news.ycombinator.com/item?id=10795087 https://news.ycombinator.com/item?id=10795087 (not much on HN) https://www.floss-shop.de/en/security-privacy/smartcards/13/openpgp-smart-card-v2.1 https://www.floss-shop.de/en/security-privacy/smartcards/13/... €16.40 (OpenPGP Smart Card v2.1; 4096-bit keys) https://www.fidesmo.com/fidesmo/about/privacy-card/ https://www.fidesmo.com/fidesmo/about/privacy-card/ €15 (NFC only; recommended by the terminated SIGILANCE OpenPGP Smart Card project; 2048-bit keys)
- noja 9y agoFixed link: https://www.floss-shop.de/en/security-privacy/smartcards/13/openpgp-smart-card-v2.1 https://www.floss-shop.de/en/security-privacy/smartcards/13/...
- MichaelGG 9y agoIt's a bit offputting that the SC4 calls itself a "hardware-secure module" which seems to be a unique term (vs hardware security module).
- deleted 9y ago[deleted]
- rbjorklin 9y agoThe DIY open source alternative: https://u2fzero.com/ https://u2fzero.com/
- AdmiralAsshat 9y agoIs...that...safe? I'm all for the a DIY solution, but considering how much of a pickle I'd be in if all of my 2FA tokens were inaccessible, wouldn't the average person want some kind of case or shielding around the exposed board? Give me an enclosure like Samsung's metal flash drives[0], and then I'd be sold. [0]https://www.amazon.com/Samsung-METAL-Flash-MUF-32BA-AM/dp/B013CCTM2E/ref=sr_1_1?ie=UTF8&qid=1497289973&sr=8-1&keywords=samsung+flash+drive https://www.amazon.com/Samsung-METAL-Flash-MUF-32BA-AM/dp/B0...
- rbjorklin 9y agoThe Github page has this to say: "The token should be durable enough to survive on a key chain for years, even after going through the wash." [0] I'd guess covering it all with hot glue would provide sufficient protection. [0] https://github.com/conorpp/u2f-zero/ https://github.com/conorpp/u2f-zero/
- dom0 9y agoHot snot gets icky with time, rather use a conformal coating; they're available in spray-form as well (e.g. CRC Urethan or Plastik 70). That being said FR4 is a really tough material and it's quite difficult to pry SMD parts off.
- cmurf 9y agoThose Samsung flash drives are nice, I have several. ~22MB/s write, and ~130MB/s read.
- lisper 9y agohttps://sc4.us/hsm https://sc4.us/hsm It's fully open-source, but the only standard application currently supported is U2F. Disclosure: this is my product.
- chaz6 9y agoFYI your website is blocked by my work proxy:- Access Denied (content_filter_denied) Your request was denied because of its content categorization: "Placeholders"
- lisper 9y agoVery sorry about that, but I have no idea what I can do about it. The page is not a placeholder. It's a very generic Bootstrap page with real content.
- user5994461 9y agoSecurID has been the gold standard for more than a decade. Not to dismiss YubiKey but companies that can afford 2 factor and take security seriously already have SecurID for a long time.
- pgeorgi 9y agoSecurID is just an expensive TOTP implementation (although a very established one, as you noted) That "gold standard" required reissuing 40 millions of devices in 2011 due to a single server breach. Lockheed-Martin was apparently really, really happy about it, too. If that's your desired level of security, just use any TOTP authenticator app on your smartphone.
- user5994461 9y agoSecurID also does private key, certificate authentication and much more. The TOTP is just one of many options. A lot of mails going to the post office. That's one of the good thing about this hardware tokens, you can decommission and replace them easily. What's expensive it to redo all your applications and systems to have 2 factor authentication.
- zurn 9y agoSmartphones are insecure unless you can control all your users have new Apple phones. The problem with many affordable TOTP tokens is clock drift. Are RSA's tokens better with that?
- pgeorgi 9y agoWas there a practical attack on TOTP on smartphones that affected 40M users and spilled industrial secrets? SecurID managed to hit both of these.
- jvagner 9y agoOut of curiosity... is Google Authenticator dead? The iOS app hasn't been updated in quite a while (Feb 22, 2016).
- makmanalp 9y agoCan some folks also speak to the audit consensus on some of these? It seems with many of the newer / open source solutions, few of the end products actually got audited by a competent external security firm / researcher, right?
- chx 9y agoFor me, the ideal solution would be a cross platform password manager software which stores your encrypted vault ... somewhere -- I hate the "cloud" word but let's use it -- and then has a small display which the password manager on your phone can read and decrypt the vault with it. It's just a few hundred (thousand at most) bits that you need to carry across, not a big deal. For desktop / laptop / charging, it needs to be USB pluggable. Physical form factor approximately like https://www.adafruit.com/product/2690 https://www.adafruit.com/product/2690 this or http://www.ebay.com/itm/Mini-4GB-LCD-Screen-Display-MP3-Music-Player-USB-with-FM-Radio-Function-Blue-/190548770930 http://www.ebay.com/itm/Mini-4GB-LCD-Screen-Display-MP3-Musi... this. The problem currently is a) most sites want passwords b) I do not want to mess with cables c) NFC is not ubiquitous.
- cmurf 9y agoI'm annoyed that Lastpass still doesn't support U2F, and I don't really understand the delay at this point.
- eekthecat 9y agoTheir official response is "because not all browsers support it". It could be a valid business decision (I.e. uneven browser support will confuse our users and increase costs) but I think they are just using that as a delay tactic.
- sirsuki 9y agohttp://www.sqrl.pl/ http://www.sqrl.pl/ https://www.grc.com/sqrl/sqrl.htm https://www.grc.com/sqrl/sqrl.htm
- prohor 9y agoI just wonder - if the same key is used for enabling password manager and 2FA ... is it still 2FA? I mean, having the token you get both access to password and second factor to a service.
- lazylester 9y agoI too had poor experience with support and also weak documentation, but I pushed through it and I'm very happy with the product now that it's integrated with my app. They seem to practically 'own' the space and I have some confidence in the longevity of the product.
- bockafer 9y agoI've had good experiences with Yubikeys thus far. I still have two of the Symantec VIP tokens from years ago that I've never had issues with. I recently bought a Neo to test out NFC (NFC support on the HTC 10 seems deplorable for smart card reading btw). I also purchased a few 4c tokens and so far they've worked great although I haven't been using them for very long. The gotchas I've encountered while using them on OSX: - The pins for PIV and OpenPGP are separate as these are separate modules on the card. - You can't use the PIV or NEO GUI managers and gpg at the same time. You might have to unplug and plug the token back in when switching back and forth between GUI/cmdline Yubico tools and gpg. - Forgetting to change my environment to use gpg-agent instead of ssh-agent. - Typing in my local password instead of the PIV pin when logging into OSX while I have a token with PIV enabled plugged in. The "setup" instructions that are referenced in the packaging and on parts of the site are for basic use of OTP. Real documentation is here: https://www.yubico.com/support/knowledge-base/categories/guides/ https://www.yubico.com/support/knowledge-base/categories/gui... For people asking about backing up material on OpenPGP modules: these are write only. Generate your material locally with gpg instead of generating them on the smart card itself and use the keytocard command to copy the keys to the card. You can backup your keyring prior to moving keys and restore it before copying keys to each card or ctrl c out of gpg without saving the keyring references for the material that was moved to the smart card. I used bits and pieces from a few guides to get the setup I wanted as this was my first experience with smart cards and advanced use of pgp: https://www.esev.com/blog/post/2015-01-pgp-ssh-key-on-yubikey-neo/ https://www.esev.com/blog/post/2015-01-pgp-ssh-key-on-yubike... https://rnorth.org/gpg-and-ssh-with-yubikey-for-mac https://rnorth.org/gpg-and-ssh-with-yubikey-for-mac http://suva.sh/posts/gpg-ssh-smartcard-yubikey-keybase/ http://suva.sh/posts/gpg-ssh-smartcard-yubikey-keybase/ https://www.jfry.me/articles/2015/gpg-smartcard/ https://www.jfry.me/articles/2015/gpg-smartcard/ https://spin.atomicobject.com/2013/11/24/secure-gpg-keys-guide/ https://spin.atomicobject.com/2013/11/24/secure-gpg-keys-gui... https://alexcabal.com/creating-the-perfect-gpg-keypair/ https://alexcabal.com/creating-the-perfect-gpg-keypair/ Overview of my process (on an air gapped machine): - Configure gpg.conf. - Generate master, subkey, and revocation material on an encrypted USB drive for offline backup of materia along with revocation certificates. - Backup original .gnupg directory to another folder on the encrypted USB drive. - Copy .gnupg directory to second encrypted USB drive for offsite backup. - For each smart card I wanted the same material on: -- Change default user and admin pins. -- keytocard subkeys for (S)ign, (E)ncrypt, (A)uthenticate (without saving keyring). -- Require local touch for all material ( Yubico specific: https://developers.yubico.com/PGP/Card_edit.html ). -- move on to next card. -- save keyring after running keytocard on the last card so the subkey material no longer exists in the local keyring, only references to it (this might not be necessary, I need to test). - Generate a copy of the keyring without master key to use on daily machine(s). Might also only need to have the master material minus the key in the keyring as noted above. I haven't tested how - Copy new keyring to another USB drive for transferring to daily machine(s). - Configure gpg-agent.conf and gpg.conf on daily machine. Resetting the applet if you messed up or want to start fresh: https://developers.yubico.com/ykneo-openpgp/ResetApplet.html https://developers.yubico.com/ykneo-openpgp/ResetApplet.html https://www.yubico.com/support/knowledge-base/categories/articles/reset-applet-yubikey/ https://www.yubico.com/support/knowledge-base/categories/art...
- kdmoyers 9y agoThere's also this thing https://www.protectimus.com/protectimus-slim-mini https://www.protectimus.com/protectimus-slim-mini A little different because it does not plug in, but very convenient. It seems like the usb key solutions are likely to get left plugged into the port, and so get stolen along with the laptop. The protectimus idea is to keep the key on you at all times.
- kdmoyers 9y agoThere's also this thing https://www.protectimus.com/protectimus-slim-mini https://www.protectimus.com/protectimus-slim-mini A little different because it does not plug in, but very convenient. It seems like the usb key solutions are likely to get left plugged into the port, and so get stolen along with the laptop. The protectimus idea is to keep the key on you at all times.
- erik998 9y agoNot exactly Yubikey but USB Armory has some close features: https://www.crowdsupply.com/inverse-path/usb-armory https://www.crowdsupply.com/inverse-path/usb-armory The following example security application ideas illustrate the flexibility of the USB Armory concept: mass storage device with advanced features such as automatic encryption, virus scanning, host authentication and data self-destruct OpenSSH client and agent for untrusted hosts (e.g Internet kiosks) router for end-to-end VPN tunnelling Tor bridge [see this, for example] password manager with integrated web server electronic wallet [the Electrum Bitcoin wallet works out of the box on the USB Armory. It has been tested with X11 forwarding from Linux as well as Windows hosts.] authentication token portable penetration testing platform low level USB security testing
- scott00 9y agoThe Feitian ePass: https://www.amazon.com/Feitian-ePass-NFC-FIDO-Security/dp/B01M1R5LRD https://www.amazon.com/Feitian-ePass-NFC-FIDO-Security/dp/B0... Can't vouch for it (either product or support), but it exists.