u2f-zero
Security and privacy
hardware security key
SHOW HN2016
How HN took it
5 positive, 24 neutral or asking, 1 mixed, 9 critical, out of 39 comments about the project. Thread score -0.05.
Design: 1 for, 2 againstPricing: 1 for, 1 againstPrivacy: 0 for, 2 againstPerformance: 0 for, 2 againstIdea: 2 for, 0 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Open source hardware design using KiCad is appreciated.
From 1 comment
This looks fantastic, and doubly so because it uses KiCAD, which I love.
StavrosK on HN
Cheap PCB fabrication makes DIY hardware practical.
From 2 comments
My barrier to entry with a lot of DIY hardware projects was an incorrect assumption that it was difficult/expensive to get PCBs made. Looking into this, I found the blog of the…
CJKinni on HNIn addition to the vendors you mention via that link, OSH Park[1] is great option for hobbyists (or very small-volume production). This is the same source listed in OP. It's a…
tomkinstinch on HN
Objections
Bare PCB on a keychain will not survive long; a case or potting is needed.
From 3 comments
It would absolutely not survive for very long like this (naked PCB on a key-chain). Mechanical damage from the actual keys on the same chain is what will kill it before water,…
aexaey on HNI'd be very skeptical about that claim without substantial evidence of it surviving in the field. Especially if you use ROHS solder, which is more brittle than leaded solder.…
mng2 on HNThe tiny amount of lead involved is very unlikely to be harmful. You could probably safely eat the amount of solder used to assemble that board. I do think think a case is…
nibnib on HN
Firmware in the secure element cannot be audited.
From 1 comment
It still has firmware, of course, which cannot be audited -- which makes it exactly as secure as a $40 Yubikey. Perhaps even a little more secure - because a Yubikey is…
beagle3 on HN
Durability claims lack field evidence.
From 1 comment
I'd be very skeptical about that claim without substantial evidence of it surviving in the field. Especially if you use ROHS solder, which is more brittle than leaded solder.…
mng2 on HN
Requests
Use cross-vendor U2F udev rules instead of hardcoded device ids.
From 1 comment
Linux users should use cross-vendor U2F support rather than hardcoding device ids into the udev rules: https://github.com/amluto/u2f-hidraw-policy
amluto on HN
Provide a working programmer link.
From 1 comment
The programmer link is not working. > The page isn't redirecting properly http://www.digikey.com/product-detail/en/silicon-labs/DEBUGADPTR1-USB/336-1182-ND/807653
arviewer on HN
Questions
How to back up data when the key cannot be copied.
From 1 comment
I really like the idea of using a token like this, but how do you back up the data if the key is not copyable?
tomohawk on HN
Whether sidechannel attacks on U2F tokens have been published.
From 1 comment
Very cool! Has anyone published any work on using sidechannel information to extract keys from U2F tokens?
cwkoss on HN
Alternatives named
Yubikey
From 2 comments
It still has firmware, of course, which cannot be audited -- which makes it exactly as secure as a $40 Yubikey. Perhaps even a little more secure - because a Yubikey is…
beagle3 on HNIs there anything written on why this is a valid choice for improving op-sec versus going with a commercial offering? Open source made from parts seems like it would be very much…
zaroth on HN
Ledger U2F javacard
From 1 comment
Haven't tried it yet, but there is this for smartcards. Not sure if it will work with blank java cards, I mean they provide the cap file and source.…
xaduha on HN