solo1

We rebuilt solo v2 [1] firmware in rust, compared to v1 in C [2]. I haven't written any rust code so take what I say with a grain of salt, but generally speaking I think our experience has been very positive. Rust forced us to structure the code a bit better, that makes it easier for multiple people to collaborate on it. Slightly harder learning curve, but that wasn't an issue in our case. In the history of solo, we had a couple security bugs that rust would probably have prevented, so this is a plus for the language. Moreover, the cryptography community is pretty active and we can leverage solid + well maintained libraries. One downside has been collaboration with other OS projects. When we had the C firmware and fido2 library, in less than 1 year we've got 3 other products embedding our code and also a couple manufacturers making demos

My Solokey is hackable and firmware available under Apache/MIT (https://github.com/solokeys/solo1). Unfortunately the easiest way to "export" is likely to rely on the RP, as if they effectively use the sign_counter they may flag such a key as cloned. They should ideally just let you register multiple (and that's an RFC 'SHOULD'). Not a shill by the way, just a happy solokey owner.

I absolutely agree that this is a thing that needs to be solved. I cobbled together my own solution using undocumented bits of the Solo firmware[1], but that's not nearly usable enough for average users. But here's the problem: outside of the hype bubbles, cryptocurrency stuff does not have a good reputation. If the only thing that supports this markets itself as a cryptocurrency wallet, that is going to hurt adoption. People generally do not buy devices in which they actively do not want the main feature. (I did remind myself of DiceKeys[2] while looking through my notes to find [1], but that has its own problems, such as "oh god what are you doing why does this involve OCRing a photograph of dice on my phone".) [1] https://github.com/solokeys/solo1/blob/4.1.5/fido2/ctaphid.c... [2] https://dicekeys.com/

I built a few in the past, typically with a friend or two, but they were dying together with the initial hype/interest. So, lately I tried to focus on bigger challenges and set up companies to handle the os project. My passion is security which I think should be more open. Cryptography is pretty much open nowadays (meaning everything we use crypto-related is likely open), but many other areas in security are not, e.g. authentication. First project SoloKeys: https://github.com/solokeys/solo An open source security key, FIDO2 certified, open hardware and firmware. Profitable, revenue selling the hardware + kickstarter campaigns. Second (newer) project Saasfrom: https://github.com/saasform/saasform A modern auth system for SaaS, with teams & payments. Revenue will come from cloud solution. Just started, onboarding the first beta customers.

I have no firsthand information, but reading https://github.com/solokeys/solo "Solo Hacker can be converted to a secure version, but normal Solo cannot be converted to a Hacker version."

> Unlocking with FIDO2 security tokens (well, at least with those which implement the hmac-secret extension, most do). i.e. your YubiKeys (series 5 and above), or Nitrokey FIDO2 and such. FYI, Nitrokey runs Solo FIDO2 implementation [1], which is also used by Signet HC and OnlyKey. So all these FIDO2 keys will work with LUKS2. And if any maker of keys is reading, please reach out if you're implementing U2F but want to upgrade to the full FIDO2, including the hmac-secret extension. [1] https://github.com/solokeys/solo

Can you elaborate? I can share about SoloKeys (https://github.com/solokeys/solo), an open security key. We set up a company and therefore have employees/founders working on the project. It's for profit and we make money selling the hardware product. We grew the community on github, kickstarter, crowdsupply and by collaborating with similar projects in the space (e.g., NitroKey, Tomu/Fomu, Signet, OnlyKey).

Chiming in to mention SoloKeys, it's open source, FIDO2 certified and supports 50 resident keys. @snakeye, please feel free to port over the CTAP implementation to your device (same for the other tokens I'm reading in the thread). We have already 3 products selling with our firmware. https://github.com/solokeys/solo

First, that's a limitation of git. Second, it's easy to fake PGP: https://boats.gitlab.io/blog/post/signing-commits-without-gp... Third, we're adding support to SoloKeys to do this using a hardware token: https://github.com/solokeys/solo/issues/395#issuecomment-612... We're also collaborating with https://keys.pub/ to make "sign/verify" use cases easily usable with a GUI for everyone. So I'd say there's hope?

To date, the core of our firmware is also used by NitroKey [1], Signet HC [2] and OnlyKey [3]. We did a pretty significant refactor [4] to make the lib even easier to use as part of our MOSS award [5]. Hopefully we'll see even more products -and thus user adoption- of fido2/webauthn. If anyone is reading, has a hardware project and would like to add fido2 functionality, please reach out! [1] https://shop.nitrokey.com/shop/product/nitrokey-fido2-55 [2] https://www.crowdsupply.com/nth-dimension/signet-high-capaci... [3] https://crp.to/2019/10/onlykey-beta8-release-announcement/ [4] https://github.com/solokeys/solo/pull/344 [5] https://medium.com/solokeyssec/solokeys-achieves-fido2-certi...

For a mature, non-Google open source _and_ open hardware option: https://solokeys.com/ Software: https://github.com/solokeys/solo Hardware: https://github.com/solokeys/solo-hw

We sell open source security keys: https://solokeys.com Paid: Amazon, the thing I like is that their dashboard clearly shows marketing cost and revenues, so you can very easily say whether it's worth or not. Non-paid: - Github: http://github.com/solokeys/solo Last time I measured, we had 1% of our traffic coming from Github, and 1% of that traffic converting to a sale. This is pretty awesome I think, especially because having a baseline we can improve. We're not making any strong sale-pitch on Github, we simply put links to our store at the top and bottom of the readme. Right now we're running a crowd funding campaign, and because we knew Github was bringing high quality traffic we're advertising it there. - Twitter. This is our 2nd social in sales. We're not doing anything special, just clear profiles (personal and business) with links t

https://solokeys.com are an option as well if you like open hardware. https://github.com/solokeys/solo I think the NFC ones are shipping after they worked out some kinks.

Blogging, but really marketing in general, thought me to ask "what do I want to say?" and "to whom am I talking?" To an extreme this is also important in the code, because you can get the most clever algorithm or implementation or optimizatiton, but if your code should be maintained by someone else, you'd better keep it clear over clever. In short, write code that others can understand and modify. More generally, with code we have comments, commit messages, readme and sometime even documentation. This is an example of how, at a certain point in time, we reviewed our README. From a confusing list of instructions, it's now a clear how to: https://github.com/solokeys/solo/commit/bbc61d5743b45d62f7e2... - What is this? A security key, with call to action (you can get one) - First FAQ: Security - First User / Use case: Hacker who wants to pers