Suggestion: SoloKeys for Hardware Key in MFA page

[taivlam]

I'd like to suggest SoloKeys for the MFA page as another option under the "Hardware Security Keys" section.

SoloKey devices use open source software (on GitHub) and hardware, though I don't know too much about the hardware part or how it compares to Nitrokey.

I haven't seen any mention of it on Pull Request 862 yet. Also, SoloKeys was mentioned in the discussions a while back, but this seems to have fallen to the wayside.

Some background (so others don't have to start research from scratch)

SoloKeys devices from the older but currently available Solo 1 line seem to be most similar to the older but currently available Nitrokey FIDO2 hardware security devices.

Upcoming SoloKeys devices in the Solo V2/Solo 2 line (unless you already knew about SoloKeys) seem to be most similar to the Nitrokey 3 line. Currently, the Nitrokey 3 products are in pre-order status (for the USB-A and USB-C variants).

As stated in a SoloKeys announcement from February 2021, SoloKeys and Nitrokey are competitor-collaborators because both companies use Trussed, the same open source cryptography framework.

SoloKeys doesn't seem to get a lot of attention, because SoloKeys only makes hardware security keys (so far). On the other hand, Nitrokey is more well known because it sells other products, such as the Qubes Certified NitroPad X230 and T430 and the NitroPhone 1 and 2/2 Pro (which are preinstalled GrapheneOS devices on the Pixel 4a and Pixel 6/6 Pro, respectively, with various options for removing the microphones, sensors, and cameras).

Other consideration: shipping availability

I originally wanted the Nitrokey FIDO2 but accidentally bought the Nitrokey Pro 2 (which can be used for unlocking the computer upon boot, like in the Insurgo PrivacyBeast X230) in late summer 2021. However, long story short I remembered in a video about passwordless account logins (it's a bit idealistic) that SoloKeys is a good alternative to Nitrokey devices (since shipping was €50 or more via only UPS due to German COVID mail restrictions in early fall 2021).

Basically, if you're in the U.S. or close to North America, then SoloKeys is more sensible regarding shipping - while those in the EU should consider Nitrokey for similar reasoning. However, both SoloKeys and Nitrokey will ultimately ship internationally. Having 1 more recommendation for hardware-based MFA alongside YubiKey and Nitrokey could help readers regarding availability.

[dngray]

I think we were looking at it with the old hardware section, privacytools/privacytools.io#1713 (comment) haven't evaluated them recently though.

[taivlam]

I wasn't aware of searching there, but I'm still glad it's on the radar.

[TommyTran732]

We ordered a Solokey last week. It has not arrived yet, so we can't write an evaluation on it right now. The OnlyKey we ordered have arrived, and I am testing it out. Once the Solokey comes I will write something for it.

Ideally, we do not want to recommend random stuff we don't use, so it's better to learn the quirks of the keys and what not.

[ph00lt0]

I actually don't agree buying Pixels is worse. These companies exposes your data to more companies, Google doesn't do that afaik. Also Pixels are widely available at third party (physical) stores.

The alternative Yubico does not have this practices, so why would you list something that has a worse offering. If solokey and onlykey would be the only option I think you would have a point. Directing people to companies why bad privacy practices is a bad idea. People will order at this vendor directly unless we explicitly recommend against it. Plugins for shopify websites like this placing those trackers often have full access to customer data on the website, that besides those trackers being placed.

I don't think there are any products listed with a website like this. If there are I am happy to suggest removing them in another discussion.

[ph00lt0]

https://github.com/privacyguides/privacyguides.org/discussions/1091

[TommyTran732]

I am strongly against the listing of Solokeys. Please have a look at their website, the amount of trackers that they place without any consent from user is tremendous. Companies who do not respect privacy rights of users should not be promoted.

Maybe reach out to them. In order to be listed on PG (if tommy's evaluation concludes this) they need to remove their trackers.

Irrelevant to the decision to list them or not.

[ghost]

@TommyTran732 What about listing Nitrokey?

[taivlam]

@TommyTran732 What about listing Nitrokey?

IIRC, I'm pretty sure Nitrokey has been listed for quite a while now.

[taivlam]

I'd hate to bump this post, though it's been almost 8 months and there hasn't been any update yet on the status on whether or not to include SoloKeys. Is there some hesitation, since the Solo 2 series is poised to replace the Solo 1 series (similarly how the Nitrokey 3 series is succeeding the Nitrokey 2 series and Nitrokey FIDO 2)?

[jonaharagon]

This discussion will be continued at https://discuss.privacyguides.net/t/solokey-hardware-security-key/11585, but at the moment I don't think we want to recommend SoloKey 1 and we can't recommend SoloKey 2:

SoloKey 2 isn’t generally available yet, and SoloKey 1 is USB-A only, and doesn’t have the best build quality IMHO. I don’t think we should be recommending products that are pre-order only, so I’m going to mark this as waiting and we can revisit it when SK2 is available in stores.