Topic by sightlessHorseman 2021-03-27 22:13:53

  • From: Germany
  • Registered: 2011-12-03
  • Posts: 5,528
  • User Karma: 392

Hey everyone.
Something beforehand, if you are looking on what a ubi key is, please consult google, I am looking for answers from those who know what the device actually is.

The external GPG encryption of passwords in the android topic made me think of that little device again.
checking around abit on the web, it does offer account protection for quite a number of services that I use, including some password managers.
I would want to use it on my iPhone, PC and Android phone if one comes around.
For those who have the ubi Key or better alternatives, what are your experiences with it?

Greetings Moritz.

Hail the unholy church of Satan, go share it's greatness.

Quote Post 1

Thumbs up

Reply by jack 2021-03-27 22:21:11

  • jack
  • Administrator
  • Offline
  • From: United States
  • Registered: 2010-10-16
  • Posts: 6,801
  • User Karma: 936

I have the solo key and my experience has been extremely positive, much more so than the ubikey. If you're starting out with these, you might as well buy one rather than the ubikey. Firmware is upgradeable and open source, whereas the ubikey will make you buy new keys constantly every time they make an upgrade. ADditionally, the solo-key has a mechanical button rather than a contact point, so there is no amount of digital trickery that can fake a login attempt. Although the next generation is apparently doing digital contact point, but even then it will still be your strongest security defense.

Quote Post 2

Thumbs up

Reply by Nuno 2021-03-27 22:43:58

  • Nuno
  • Cygnus A
  • Offline
  • From: Poland
  • Registered: 2013-04-13
  • Posts: 5,795
  • User Karma: 328

I have him too. I am extremely happy with it, the only thing is that it drastically slows down Windows 10 sign in so I have disabled it for Windows 10 sign in as I need speed more than anything else.

If you want to contact me, do not use the forum PM. I respond once a year or two, when I need to write a PM myself. I apologize for the inconvenience.
Telegram: Nuno69a
E-Mail: nuno69a (at) gmail (dot) com

Nuno's Website

Quote Post 3

Thumbs up

Reply by Ethin 2021-03-27 23:42:30 (edited by Ethin 2021-03-27 23:43:16)

  • Ethin
  • Generous angel
  • Offline
  • Registered: 2010-04-21
  • Posts: 8,193
  • User Karma: 1,099

The YubiKey is very good. Its just not upgradable firmware-wise, nor is it open-source, but other than that its very good. I would've gotten the SoloKey if it had existed when I'd gotten my Yubikey, but the project didn't exist back then, at least not that I knew of (this was back in very early 2019).

"On two occasions I have been asked [by members of Parliament!]: 'Pray, Mr. Babbage, if you put into the machine wrong figures, will the right answers come out ?' I am not able rightly to apprehend the kind of confusion of ideas that could provoke such a question."    — Charles Babbage.
My Github

Quote Post 4

Thumbs up

Reply by jack 2021-03-28 00:33:52

  • jack
  • Administrator
  • Offline
  • From: United States
  • Registered: 2010-10-16
  • Posts: 6,801
  • User Karma: 936

@Ethin: The project existed as u2f0, which was more of a proof of concept/diy template than anything else. Not really a good primary daily driver anyway.
@sightlessHorseman: For password managers, keep in mind that the bitwarden desktop app will not support fido keys, nor will the mobile app. It's the nature of a technology that only has the people behind it excited, and everyone else sleeping on the implementation - yes, the number of sites that actually support the thing is truly underwhemling, so prepare to be disappointed (not at the key, but at how little you can actually use it). Let's see: Paypal doesn't support the thing, and they're part of the god-damn fido alliance. Then again why should they when account hacks and gigantic fraud transactions are easy cash for them (remember the Twitch emote bulk purchase fiasco)? Probably why they only ever allow a patheticaly weak maximum of 20 characters for a password. But I digress. Point being, there are plenty of sites and applications that don't support u2f that otherwise should be enforcing it, and part of the problem is they're too sissy to enforce that people actually spend money on security. Plus the general public will make fund of you for having fido enabled on your accounts (not a big deal) but those are the people that still think that sms-based 2factor auth is secure, so there's definitely an education problem overall.

Quote Post 5

Thumbs up

Reply by sightlessHorseman 2021-03-28 05:09:24

  • From: Germany
  • Registered: 2011-12-03
  • Posts: 5,528
  • User Karma: 392

Hey,

I looked at the key abit, but found some little issues I am having with it.
Firstly, it seams that operating the stick does require some programming knolledge and commandline experiences. I don't have a problem with that, but it might get tedious to set the thing up or change certain settings.
Then, it apparently does only support USB type A ports and i would love to use the thing on my mobile devices as well.
I found the Yubi Key 5CI which does have a lightning and USB C connector. My computer does have a USB C port and the a51 as well, if I am at another computer I need to get myself a USB A to USB C adaptor though.

Greetings Moritz.

Hail the unholy church of Satan, go share it's greatness.

Quote Post 6

Thumbs up

Reply by jack 2021-03-28 07:02:40

  • jack
  • Administrator
  • Offline
  • From: United States
  • Registered: 2010-10-16
  • Posts: 6,801
  • User Karma: 936

Solo key has a usb-c flavor as well as a usb type-a variant. It also has nfc for phones, no bluetooth because Bluetooth is not a secure connection anyway. It's much more cost-effective to get two solo-keys than 2 ubikeys, particularly given they charge up the ass for the lightning/USBC variant of the ubikey.

Quote Post 7

Thumbs up

Reply by sightlessHorseman 2021-03-28 08:39:15

  • From: Germany
  • Registered: 2011-12-03
  • Posts: 5,528
  • User Karma: 392

True, they are pritty expensive.
Do the newer iPhone models actually support tokens via NFC? I know that apple opened the NFC adaptor abit, but I am not sure about how well that works for third party devs.

Greetings Moritz.

Hail the unholy church of Satan, go share it's greatness.

Quote Post 8

Thumbs up

Reply by haily_merry 2021-03-28 16:19:04

  • From: England
  • Registered: 2017-08-12
  • Posts: 3,890
  • User Karma: 534

This just seems like an extremely bad idea to me. What if your key gets lost or stolen?

Quote Post 9

Thumbs up

Reply by jack 2021-03-28 17:42:55

  • jack
  • Administrator
  • Offline
  • From: United States
  • Registered: 2010-10-16
  • Posts: 6,801
  • User Karma: 936

@haily_merry: Exactly, so don't lose your key, although getting it stolen is also a possibility.For starters, you want to bury this deep into a smaller compartment in a bag. Almost all of them can fit on a keychain - resist the temptation to do that since that'a more likely target item than your security key alone. This is also why it's a good idea to buy two keys and put them both on your accounts, so if the shit hits the fan then you can still log in. Keep in mind that at present they need both your password and your key, so the likelyhood of actually doing damage is next to none if they just manage to steal your key and not, say, your phone with your password manager.

Quote Post 10

Thumbs up

Reply by sightlessHorseman 2021-03-31 14:30:03

  • From: Germany
  • Registered: 2011-12-03
  • Posts: 5,528
  • User Karma: 392

So, how easy is the solo key to set up? As I said previously, it seams that getting the key to work is still a bit hacky.
On another note, I also got wind of that I don't need the Yubikey with the lightning port, because that one is for older iPhones which don't support iOS 13 or have a dedicated NFC module.

Greetings Moritz.

Hail the unholy church of Satan, go share it's greatness.

Quote Post 11

Thumbs up

Reply by Nikola 2021-03-31 15:29:41

  • From: Serbia
  • Registered: 2015-02-01
  • Posts: 3,942
  • User Karma: 630

@9 I mean, what if you lose your house key?
This actually looks interesting, the entire technology that is, but I assume that it's not yet nearly as widely used in smaller countries, hence why websites can't really enforce something like this yet. In fact, in Serbia I don't really know anyone who bought one of these devices.
I don't think there's any local reselling, doing a Google search for it in my language brings up only English related results. This is just my country, which is even slowly starting to adopt online purchasing more and more, but imagine even worse situations where online purchases aren't common at all, and I assume you got a huge percentage of users who at present don't have access to such a device at all and have no way to obtain it either.
The concept certainly seems great though and I'm hopeful for it getting more popular and more widely used in the near future.

Quote Post 12

Thumbs up

Reply by jack 2021-03-31 16:43:26

  • jack
  • Administrator
  • Offline
  • From: United States
  • Registered: 2010-10-16
  • Posts: 6,801
  • User Karma: 936

They can still inforce it given that the ubico app mimics the mfa a ubikey would do. Plus, if they just go with duo mobile for authentication for example, people from other countries who cannot use a hardware key can use phone verification via an app or phone call.
As for getting the solo key to work, it's absolutely not a hack, just plug in and play.

Quote Post 13

Thumbs up

Reply by jack 2021-03-31 17:08:13

  • jack
  • Administrator
  • Offline
  • From: United States
  • Registered: 2010-10-16
  • Posts: 6,801
  • User Karma: 936

@nidza07: If you had more companies on board, you'd have more companies joining the fido alliance, and then maybe the Fido Allaince could give companies like SoloKey the necessary funding to manufacture globally and pump out millions of units at a time. Like i said, some of the company negligence on this could potentially be financially motivated given that customers getting screwed over by hacks is still easy revenue for behemoths like Paypal and Venmo (Paypal subsidiary).

Quote Post 14

Thumbs up