I rarely use my smartphone and find it a bit annoying to have to use it for 2FA through apps. I wish to get physical passkeys that will allow me to login to my laptop.
I have heard of YubiKey although I haven’t given it any serious consideration since it is closed source. (My super-tin-foiled friend who introduced me to this world of privacy taught me to never trust a closed-source solution… _long _ story).
Are there any FLOSS versions of Yubikey? Can they be used to log into a Linux machine? Or for banking?
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
[Matrix/Element]Dead
much thanks to @gary_host_laptop for the logo design :)
Verifying the Security Claim of 2FA Devices
The claim that using OTP tokens and Yubikeys compromises your security and privacy is completely false.
Let’s look at this in more detail.
Arguments against concerns:
Additional arguments:
Conclusion:
While purchasing a 2FA device may leave traces in merchants’ databases, the risks are minimal compared to the security they provide. Yubikey and OTP tokens significantly increase the level of security for your accounts, especially when combined with other security methods. Therefore, the claim that using these devices compromises your security and privacy is untrue.
There are suitable alternatives listed in other comments, but it is worth noting that none of them will support the proprietary YubiKey authentication protocol.
This isn’t a big deal if all of the applications you want to use it with support FIDO2/WebAuthn authentication, but YubiKeys support both.
I have a onlykey. Been using it for probably 5 years now. Not sure why they aren’t more common.
I use Onlykey as well. Can do lots of things. Works fine.
For my own understanding, what potential dangers are there using a Yubikey as opposed to an open source key?
I’m a novice myself, so don’t expect an accurate and technical answer. My understanding is that the argument basically boils down to “claim versus veracity” on any vulnerabilities or compromises in the key.
How do you know there aren’t significant security vulnerabilities in the key, or that there aren’t backdoors?
The open source community have some excellent security experts who can check and let us know if all is good, or if something is off.
Might want to check out Mooltipass. I got mine from tindie and they’re worth a look IMO.
Solokeys
I believe solokeys are open source. I use a solo v1 for sudo, ssh, and two factor websites. They either went out of business or are basically defunct as I understand it, but you can pick them up on crowd supply. I wouldn’t get the v2, supposedly they had problems and that’s why they shut down. You likely won’t see updates, but they do function for what you’re looking for. There are some that are shaped like a small thumb drive and some that sit almost flush with a USB port. Some have nfc, which is useful for phones. Buy at least 2 though, and register both for everything, because you don’t want to lock yourself out of something.
I use Solokeys. Didn’t know they were defunct. I just bought another from then a month or so ago. I use it for MFA, ssh, and sudo, and I’m trying to config Kubuntu login screen to require solokey but no luck yet.
I like solokeys, but the one I recently bought has NFC and, technically, my pixel7 running GraphenreOS can detect the device, but it doesn’t work. Many people reported this issue. In my experience, NFC is non-functional.
I’m pretty sure you have to have google play services or MicroG for FIDO2 to work on android. A bit silly of you ask me.
That sounds crazy, but easy to test. Thanks for the suggestion.
There is SoloKey, which is an open-source version of YubiKey. Although full disclosure, I haven’t actually tried it myself so I can’t really vouch for it personally.
Yeah done anything with it over 1.5 ~ 2 years, on top of that NFC does not work at all in many cases.
Yeah I regreted buying one . . . works great on PC though.
I believe that NitroKeys are open-source. The New Oil did a video covering them.
Yes they are - I own 3. Currently Nitrokey offers multiple different keys, but you most likely want to use the Nitrokey 3A.