What processor parts will this be using?<p>A major benefit of the Yubikey U2F parts is that they're almost indestructible. I've heard over and over again about how flimsy the Feitian parts are, and from people who have run over their Yubikeys with cars and still had them work. How resilient (in particular: waterproof) will these be?
I've spent some time building small open source USB devices, I went through a "let's just use the PCB to make the USB plug" phase but frankly they're not wonderfully reliable, I'm not a fan, and actual USB plugs are cheap and reliable (you do need to use one that has thru-hole lugs to be robust, not just surface mount which is an extra manufacturing step).<p>I just finished building my first USB-C (for standard USB) board board, it's surprisingly easy, 2 extra resistors - pad tolerances are tight, but it's not hard
If you could manage to modify Signal so it's keys were stored on the security key, and the user had to tap each time they log in, that would be far more valuable than GPG.
> It protects against phishing<p>Not so much. U2F proves only that the user tapped the device when asked to do so.<p>You still have to trust your browser and your entire desktop that the tap will be used to log in to the service you are browsing instead of e.g. quietly logging to your home banking.<p>To prevent "tap hijacking" we need a display on the U2F key to show the URL/service you are really authenticating to.
I wonder where are they going to manufacture it, and what control and visibility will they have into their supply chains, both upstream and downstream?<p>Absent some very serious issue with the crypto implementation, that would be my greatest concern -- how easy would it be for a state-level actor to introduce some sort of backdoor or other vulnerability (even a subtle one, e.g. modification to EM radiation pattern) to either all or just a select subset of devices, either into components "upstream" in the supply chain, in manufacturing itself, or downstream in transit to the retailer/customer.
What's nitrokey's status regarding fido2 ? I know that their current open source products don't support it, but they were planning to add it.
From the image it doesn't look like it'll be easily hand solderable. I love that about the U2F zero (though I'm still torn on if I should build it or buy it).
Looks awesome, just one thing about the website if anybody knows them personally. The motto under the Product, "Secure login, open, easy." is mostly hidden by the photo.