On: YubiKey 4C

[_khau]

What are the current alternatives to Yubikey?

Preferably looking for something open-source and in no way associated with Google.

[rogerbinns → _khau]

I haven't used it, but Trezor looks interesting, and there is a Trezor 2 coming soon. https://trezor.io/

The sweet spot is for Bitcoin wallets, but it does the other stuff (U2F, ssh, gpg, passwords). Hardware is interesting. Everything open source. You can add your own "apps".

U2F: https://blog.trezor.io/secure-two-factor-authentication-with...

[nickik → rogerbinns]

I use both this and Yubikeys.

The external screen add even more security and that is very cool. UAF/U2F both have support for external monitors in the protocol, so its really good security.

The ssh/gpg stuff is less advanced then that of the Yubikey, all guides suggest running some special scripts. With the Yubikey you can set it all up so this is not needed. Maybe this works with the Trezor, but I didn't find any guides for this.

I really want Trezor to support UAF as well, given that it has a PIN entry system, this should work.

If you need a Bitcoin Wallet, Trezor is cool, if you want a tool primary for login (U2F/OTP/TOTP), a Yubikey is preferable.

[wyager → rogerbinns]

Trezor is great. Tiny device, big enough display, good build quality.

[moreentropy → _khau]

Have a look at the Nitrokey, it's completely Open Source: https://www.nitrokey.com/

[mstade → _khau]

Wait – Yubikey is associated with Google? Or did you mean that whatever alternatives people suggest mustn't be associated with Google?

[nickik → mstade]

There are some connections. The people who founded it. Google are early investors. Google are also one of the most important costumers.

I think that makes it even more secure. Google house lots of people running around with these.

[pmoriarty → nickik]

"I think that makes it even more secure."

That reminds me of how for a long time people were saying that encryption influenced and blessed by the NSA must be secure because government agencies were using it and the NSA wouldn't weaken their encryption.

Turns out they did.

[j_s → _khau]

This may be enough: https://sc4.us/hsm/

Source: https://news.ycombinator.com/item?id=13033080

Paging HN user and product vendor: lisper

[bb88 → _khau]

The U2F zero was on amazon for a while. But not anymore.

Unfortunately the guy who is doing it no longer has time for it.

[nhf → bb88]

If you're feeling crafty, you can create your own: https://github.com/conorpp/u2f-zero/wiki/Building-a-U2F-Toke...

[bb88 → nhf]

No. I'm not. That's why I bought mine on amazon. :)