(untitled)

Let's have a U2F thread. I want to buy a hardware token I could use for authentication on my desktop/laptop/phone (decrypting my hard drive, logging in...) and various services (github, email, ssh servers...). From what I gathered, the token should be able to work through NFC if I want to be able to use it on my phone. The only company I heard of is Yubico. Searching for "NFC U2F" on online stores brought results for two other companies, Feitian (Chinese) and Chipnet (couldn't find any info). I'm a bit opposed to using Yubico since they went full proprietary with their last iteration (the Yubikey 4) but from what I gathered the Yubikey 3 Neo (which is NFC-enabled) is still open source. I'm not sure I want to buy a Yubikey 3 though, older hardware often means less updates and more security issues. Problem is, the other companies don't seem very trust worthy either. Their tokens don't seem to be open-source and I can't find any review online. Now, tell me lain, do you use U2F? If yes, how and what for? Are there companies to be avoided, others to be trusted?

>smartcard for hipsters More news at 11. There is nothing wrong with proprietary hardware unless firmware is not updated, Lain Stallmann says.

>>7700 ArsTechnica is now giving away a branded Yubikey if you subscribe to their "pro" yearly package.

>>7700 you only have to sign in once on your phone so do you really need one with nfc? just use on of the one time codes to sign in on your phone

>>7700 No, i use an older phone with severed antennae and gauth, i keep it in a locked drawer. These yubikey things look like they'd wear very quickly on a keychain, not to mention that they're prohibitively expensive where i live.

You can make your own u2f key. It might not be the best option for you if you need it to use NFC, but it's a thing people do, so it might be worth looking into.

Related: https://manybutfinite.com/post/iphones-armed-robbery-hacking/ Story of a guy who lost his phone and had his digital life raped because facebook sends password resets based on phone numbers but 2fa on his main email account saved him in the end.