Linux

There's a Swedish startup named Tilitis making open source, verifiably secure hardware keys, but they're not well supported at the moment.

https://tillitis.se/

Yubikey probably has the widest support for things like password managers and automatic sign in.

Look into SoloKeys and NitroKeys and see if there's products from those vendors that fit your needs.

While Keepass has the ability to use a Yubikey (or similar) as 2FA (masterpassword is still required), this does not work on the mobile (Android) apps I tried. If you can make it work, please let me know!

Other than that: I got my Yubikey working ok on Linux Mint. But somehow the first login often does not work as expected (you have to touch the key). That is why I don't use it anymore as 2FA for computer login.

I'm using yubikeys. Works fine on Linux and Android.

Nitrokey would probably be my choice as both the hardware and software are open source( in fact you could probably build your own if you wanted to). I don't trust yubikey as the firmware that runs on them is closed source so you just don't know of it's actually secure.

Yubikey and OnlyKey are the only hardware keys that work with keepassxc. So if that's a requirement for you, then those are your only options. This is true for me as well.

They cover this in their docs and faq page: https://keepassxc.org/docs/#faq-yubikey-2fa. OnlyKey is an unknown to me while I've heard of Yubikey for years.

Onlykey. It's u2f. And has up to 12 or 24 depending on how you setup username password combinations. It's got a physical pin required and you can set what happens on 6 failed attempts. Like nuke it's own firmware and (quantum proof encrypted alg) password and keystore. It requires no software on machine (after setup) so you can use it on machines you don't own and don't need to install middleware (I'm looking at you nitrokey) If you use Linux you can use it as a ssh private key and login method requiring challenge response (via its pin pad) (windows support for it is middleware to do this is ...not easy). It's a true one way write.. you add a password in all you can do is overwrite never read from it. https://onlykey.io/. Ive been using it my corporate IT day to day for 3 years.

I use Yubikey 5 NFC and Canokey Pigeon, both works out of box on Linux.

Crazy coincidence that I was just researching hardware keys today. Why go with a hardware key over a free, open source TOTP generator like Aegis?

Hi there! Your text contains links to other Lemmy communities, here are correct links for Lemmy users: [email protected], [email protected], [email protected]

If you're insane this company makes hardware keys that you can implant under your skin and read via nfc https://dangerousthings.com/product/apex-flex/

(There is also a ring version if for some reason you don't want to shove a microchip inside you 🫣)

I personally just have 3 u2f keys from different brands, one of them is a yubikey, but I only use the u2f functionality. I have read enough about the u2f standard to trust it, but the other fluff on some keys I don't trust enoug in to use on my accounts, and the basic u2f functionality works perfectly on Linux (I even use it for my Linux login) and basically everywhere

I keep one on my keychain(it has an USBA port, but I keep a female a to male c converter on it as cap so I can use it on my phone), another that has password protection instead of a single button lives on a port on my desktop and the third I keep stored, it is more annoying to set up all of them on a new account, but I know I won't loose access or have to recover my accounts if I loose my keychain.

And for sites that don't support u2f I use Aegis for TOTP which would also be my recommendation, that way if your KeePassXC database is compromised your second factor is safe, and you can also have automatic encrypted backups of your Aegis dB synchronised across devices so you don't loose them

And if you are going to be setting up keys on multiple sites don't forget to update or generate your single use recovery codes and store the safely, preferably on paper not digitally.

I personally print mine on regular printer paper on sections about the size of a library card and then I spread some UV curing resin until it soaks through, then I clean the excess and leave them on the sun for about 2 hours (most printer paper has optical brightener that makes the resin much slower to cure). I then cut the individual segments and store them on my safe

It may be paranoid, but it's extra work just when creating an account, and I started doing it after I permanently lost access to a trading account because of a lost key and a faded recovery code, thankfully it had no balance stored there at the time

When I did some research on hardware keys I was between Yubikey and Nitrokey. I ended up going with Yubikey because KeepassXC supported it.

Something to keep in mind is purchasing a backup key. I bought one for my wife and we use each other's as a backup.

For KeepassXC it does not support registering multiple keys (at least not that I have figured out), so I have a copy of my database where it uses my wife's key as a backup.

I use a yubikey (couldn't chose, it's from work) and I have no issues with it working out of the box (endevour os). I just touch the "button" and it "types" the key.

I've been using a Yubikey for years and I'm quite happy.

Yubikey is kinda the gold standard IMO. Yes, I know google has their own titan something ~but the other one I know that can rival yubikey in terms of support and longevity would be nitrokey.~ Else I recommend making a poor man's security key using a keyfile and a flashdrive to secure your keepass database

Edit: forgot about nitrokey's overly sensational claims about a backdoor on Qualcomm chips a while back, that kinda stained my view on their company now. Just get a yubikey sure theres no firmware upgrades and whatnot but its good enough for now. Also heard good things about onlykeys

On average, Vatican has two popes per square kilometer.

EDIT: My bad, wrong thread.