Whoops, @Yubico just scored 31% on the Sony PS3 Epic Fail scale. Collect three signatures from a FIPS Yubikey and you can calculate the private key.https://www.yubico.com/support/security-advisories/ysa-2019-02/ …
-
I don't trust Yubico since they told me that "accidental" session hijacking in their webshop was "not a problem"
Are there any other SSH/OpenPGP/U2F compatible USB tokens that are not crap? I know of several open source projects, but stuff using random (non-secure) microcontrollers isn't really serious.
-
-
Last time I looked, https://www.nitrokey.com/ had both: random microcontrollers with open source firmware and designs with secure elements...
-
Nitrokey looks quite interesting, but why they use mostly insecure ecc algorithms see https://safecurves.cr.yp.to ??? Only the „starter“ supports Curve25519, not sure about SECG/Koblitz
- Show replies
New conversation -
-
-
This is my favorite, it is U2F only though https://www.amazon.co.uk/Feitian-ePass-FIDO-NFC-Security-Key/dp/B01M1R5LRD/ …
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
I wish the opengpg/smartcard firmware for the tomu was anywhere near ready :/
-
I lost my tomu in the time between getting it at 33c3 and now, and the firmware still isn't there lol
- Show replies
New conversation -
-
-
Well,
@themooltipass has ssh-agent integration. It does not have U2F support, but the new device that's coming up might have. No idea about openPGP, but with the small file store and cli tools it must be possible. Love the fact software and hardware are fully open! -
we're definitely planning on adding webauthn support :). Thanks again for the support!
End of conversation
New conversation -
-
-
Check out solokeys (h/t
@catileptic) https://github.com/solokeys/soloThanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
Lol Purism. After their phone shenanigans (where they just used FSF's bullshit RYF certification backdoors to be able to claim their stuff is "free" via technicalities) I wasn't expecting much. Turns out (after following like 6 links) it's a rebranded NitroKey. Insecure MCU.
- Show replies
New conversation
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.