mirror of
https://github.com/privacyguides/i18n.git
synced 2025-09-16 18:18:47 +00:00
New Crowdin translations by GitHub Action
This commit is contained in:
Crowdin Bot
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: "Multifactor Authentication"
|
||||
icon: 'material/two-factor-authentication'
|
||||
title: Multifactor Authentication
|
||||
icon: material/two-factor-authentication
|
||||
description: MFA is a critical security mechanism for securing your online accounts, but some methods are stronger than others.
|
||||
---
|
||||
|
||||
@@ -64,7 +64,7 @@ If your threat model requires you to have different identities on different webs
|
||||
|
||||
#### FIDO (Fast IDentity Online)
|
||||
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was U2F and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) which includes the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was [U2F](https://en.wikipedia.org/wiki/Universal_2nd_Factor) and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) which includes the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
|
||||
U2F and FIDO2 refer to the [Client to Authenticator Protocol](https://en.wikipedia.org/wiki/Client_to_Authenticator_Protocol), which is the protocol between the security key and the computer, such as a laptop or phone. It complements WebAuthn which is the component used to authenticate with the website (the "Relying Party") you're trying to log in on.
|
||||
|
||||
|
||||
@@ -96,7 +96,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, and view their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, view and edit their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
|
||||
[:octicons-home-16: Homepage](https://peergos.org){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://peergos.net/privacy.html){ .card-link title="Privacy Policy" }
|
||||
@@ -109,9 +109,9 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=peergos.android)
|
||||
- [:simple-github: GitHub](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-apple: macOS](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-linux: Linux](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://peergos.org/download#windows)
|
||||
- [:simple-apple: macOS](https://peergos.org/download#macos)
|
||||
- [:simple-linux: Linux](https://peergos.org/download#linux)
|
||||
- [:octicons-browser-16: Web](https://peergos.net)
|
||||
|
||||
</details>
|
||||
@@ -120,9 +120,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
Peergos is built on top of the [InterPlanetary File System (IPFS)](https://ipfs.tech), a peer-to-peer architecture that protects against [:material-close-outline: Censorship](basics/common-threats.md#avoiding-censorship ""){.pg-blue-gray}.
|
||||
|
||||
Peergos is primarily a web app, but you can self-host the server either as a local cache for your remote Peergos account, or as a standalone storage server which negates the need to register for a remote account and subscription. The Peergos server is a `.jar` file, which means the Java 17+ Runtime Environment ([OpenJDK download](https://azul.com/downloads)) should be installed on your machine to get it working.
|
||||
|
||||
Running a local version of Peergos alongside a registered account on their paid, hosted service allows you to access your Peergos storage without any reliance on DNS or TLS certificate authorities, and keep a copy of your data backed up to their cloud. The user experience should be the same whether you run their desktop server or just use their hosted web interface.
|
||||
Peergos has a web app, desktop apps and an Android app and you can also self-host the server. Client, server and command line interface all run from the same binary. There is a sync engine included (accessible via the desktop or android apps) for bi-directionally synchronizing a local folder with a Peergos folder, and a webdav bridge to allow other applications to access your Peergos storage.
|
||||
|
||||
Peergos was [audited](https://peergos.org/posts/security-audit-2024) in November 2024 by Radically Open Security and all issues were fixed. They were previously [audited](https://cure53.de/pentest-report_peergos.pdf) by Cure53 in June 2019, and all found issues were subsequently fixed.
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
title: "Security Keys"
|
||||
title: Security Keys
|
||||
icon: material/key-chain
|
||||
description: These security keys provide a form of phishing-immune authentication for accounts that support it.
|
||||
cover: multi-factor-authentication.webp
|
||||
@@ -10,7 +10,7 @@ cover: multi-factor-authentication.webp
|
||||
- [:material-target-account: Targeted Attacks](basics/common-threats.md#attacks-against-specific-individuals){ .pg-red }
|
||||
- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange }
|
||||
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the FIDO2 security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the [FIDO2](basics/multi-factor-authentication.md#fido-fast-identity-online) security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
|
||||
## Yubico Security Key
|
||||
|
||||
@@ -20,7 +20,7 @@ A physical **security key** adds a very strong layer of protection to your onlin
|
||||
{ width="315" }
|
||||
</figure>
|
||||
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO U2F, and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO Universal 2nd Factor (U2F), and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/security-key){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -35,10 +35,10 @@ These keys are available in both USB-C and USB-A variants, and both options supp
|
||||
This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- [Yubico Authenticator](https://yubico.com/products/yubico-authenticator)
|
||||
- CCID Smart Card support (PIV-compatibile)
|
||||
- CCID Smart Card support (PIV-compatible)
|
||||
- OpenPGP
|
||||
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) of products instead.
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) series instead.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">تنوية</p>
|
||||
@@ -55,7 +55,7 @@ The firmware of Yubico's Security Keys is not updatable. If you want features in
|
||||
{ width="400" }
|
||||
</figure>
|
||||
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The YubiKey 5 Series has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), [Yubico OTP](basics/multi-factor-authentication.md#yubico-otp), [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), [OpenPGP](https://developers.yubico.com/PGP), and [TOTP and HOTP](https://developers.yubico.com/OATH) authentication.
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The **YubiKey 5 Series** has a wide range of features such as FIDO2/WebAuthn and FIDO U2F, [TOTP and HOTP](https://developers.yubico.com/OATH) authentication, [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), and [OpenPGP](https://developers.yubico.com/PGP).
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/yubikey-5-overview){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -69,7 +69,7 @@ The [comparison table](https://yubico.com/store/compare) shows how the YubiKeys
|
||||
|
||||
YubiKeys can be programmed using the [YubiKey Manager](https://yubico.com/support/download/yubikey-manager) or [YubiKey Personalization Tools](https://yubico.com/support/download/yubikey-personalization-tools). For managing TOTP codes, you can use the [Yubico Authenticator](https://yubico.com/products/yubico-authenticator). All of Yubico's clients are open source.
|
||||
|
||||
For models which support HOTP and TOTP, there are 2 slots in the OTP interface which could be used for HOTP and 32 slots to store TOTP secrets. These secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
For models which [support HOTP and TOTP](https://support.yubico.com/hc/articles/360013790319-How-many-accounts-can-I-register-my-YubiKey-with), the secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">تنوية</p>
|
||||
@@ -86,7 +86,7 @@ The firmware of YubiKey is not updatable. If you want features in newer firmware
|
||||
{ width="300" }
|
||||
</figure>
|
||||
|
||||
The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://www.nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification). The Nitrokey 3 Series in general has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), Personal Identity Verification (PIV), OpenPGP, and TOTP and HOTP authentication.
|
||||
**Nitrokey** has a cost-effective security key capable of FIDO2/WebAuthn and FIDO U2F called the **Nitrokey Passkey**. For support for features such as PIV, OpenPGP, and TOTP and HOTP authentication, you need to purchase one of their other keys like the **Nitrokey 3**. Currently, only the **Nitrokey 3A Mini** has [FIDO Level 1 Certification](https://nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification).
|
||||
|
||||
[:octicons-home-16: Homepage](https://nitrokey.com){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://nitrokey.com/data-privacy-policy){ .card-link title="Privacy Policy" }
|
||||
@@ -96,26 +96,14 @@ The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://
|
||||
|
||||
</div>
|
||||
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys) shows how the different Nitrokey models compare to each other in terms of features and other specifications.
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys#:~:text=The%20Nitrokey%20Family) shows how the different Nitrokey models compare to each other in terms of features and other specifications. Refer to Nitrokey's [documentation](https://docs.nitrokey.com/nitrokeys/features) for more details about the features available on your Nitrokey.
|
||||
|
||||
Nitrokey models can be configured using the [Nitrokey app](https://nitrokey.com/download).
|
||||
|
||||
The Nitrokey 3 Series can act as a password manager. They can store up to 50 different entries, and each entry can contain login, password, comment and OTP.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">تنوية</p>
|
||||
|
||||
Excluding the Nitrokey 3, Nitrokeys with HOTP and TOTP storage do not have it encrypted, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
**Nitrokey** also has the **Nitrokey Passkey**, a lower-price security key capable of [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online). This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- Password Manager
|
||||
- PIV
|
||||
- OpenPGP
|
||||
- Tamper-resistant smart card
|
||||
- TOTP and HOTP
|
||||
Excluding the Nitrokey 3, Nitrokeys which support HOTP and TOTP do not have encrypted storage, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: "Multifactor Authentication"
|
||||
icon: 'material/two-factor-authentication'
|
||||
title: Multifactor Authentication
|
||||
icon: material/two-factor-authentication
|
||||
description: MFA is a critical security mechanism for securing your online accounts, but some methods are stronger than others.
|
||||
---
|
||||
|
||||
@@ -64,7 +64,7 @@ If your threat model requires you to have different identities on different webs
|
||||
|
||||
#### FIDO (Fast IDentity Online)
|
||||
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was U2F and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) which includes the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was [U2F](https://en.wikipedia.org/wiki/Universal_2nd_Factor) and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) which includes the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
|
||||
U2F and FIDO2 refer to the [Client to Authenticator Protocol](https://en.wikipedia.org/wiki/Client_to_Authenticator_Protocol), which is the protocol between the security key and the computer, such as a laptop or phone. It complements WebAuthn which is the component used to authenticate with the website (the "Relying Party") you're trying to log in on.
|
||||
|
||||
|
||||
@@ -96,7 +96,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, and view their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, view and edit their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
|
||||
[:octicons-home-16: Homepage](https://peergos.org){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://peergos.net/privacy.html){ .card-link title="Privacy Policy" }
|
||||
@@ -109,9 +109,9 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=peergos.android)
|
||||
- [:simple-github: GitHub](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-apple: macOS](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-linux: Linux](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://peergos.org/download#windows)
|
||||
- [:simple-apple: macOS](https://peergos.org/download#macos)
|
||||
- [:simple-linux: Linux](https://peergos.org/download#linux)
|
||||
- [:octicons-browser-16: Web](https://peergos.net)
|
||||
|
||||
</details>
|
||||
@@ -120,9 +120,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
Peergos is built on top of the [InterPlanetary File System (IPFS)](https://ipfs.tech), a peer-to-peer architecture that protects against [:material-close-outline: Censorship](basics/common-threats.md#avoiding-censorship ""){.pg-blue-gray}.
|
||||
|
||||
Peergos is primarily a web app, but you can self-host the server either as a local cache for your remote Peergos account, or as a standalone storage server which negates the need to register for a remote account and subscription. The Peergos server is a `.jar` file, which means the Java 17+ Runtime Environment ([OpenJDK download](https://azul.com/downloads)) should be installed on your machine to get it working.
|
||||
|
||||
Running a local version of Peergos alongside a registered account on their paid, hosted service allows you to access your Peergos storage without any reliance on DNS or TLS certificate authorities, and keep a copy of your data backed up to their cloud. The user experience should be the same whether you run their desktop server or just use their hosted web interface.
|
||||
Peergos has a web app, desktop apps and an Android app and you can also self-host the server. Client, server and command line interface all run from the same binary. There is a sync engine included (accessible via the desktop or android apps) for bi-directionally synchronizing a local folder with a Peergos folder, and a webdav bridge to allow other applications to access your Peergos storage.
|
||||
|
||||
Peergos was [audited](https://peergos.org/posts/security-audit-2024) in November 2024 by Radically Open Security and all issues were fixed. They were previously [audited](https://cure53.de/pentest-report_peergos.pdf) by Cure53 in June 2019, and all found issues were subsequently fixed.
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
title: "Security Keys"
|
||||
title: Security Keys
|
||||
icon: material/key-chain
|
||||
description: These security keys provide a form of phishing-immune authentication for accounts that support it.
|
||||
cover: multi-factor-authentication.webp
|
||||
@@ -10,7 +10,7 @@ cover: multi-factor-authentication.webp
|
||||
- [:material-target-account: Targeted Attacks](basics/common-threats.md#attacks-against-specific-individuals){ .pg-red }
|
||||
- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange }
|
||||
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the FIDO2 security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the [FIDO2](basics/multi-factor-authentication.md#fido-fast-identity-online) security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
|
||||
## Yubico Security Key
|
||||
|
||||
@@ -20,7 +20,7 @@ A physical **security key** adds a very strong layer of protection to your onlin
|
||||
{ width="315" }
|
||||
</figure>
|
||||
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO U2F, and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO Universal 2nd Factor (U2F), and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/security-key){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -35,10 +35,10 @@ These keys are available in both USB-C and USB-A variants, and both options supp
|
||||
This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- [Yubico Authenticator](https://yubico.com/products/yubico-authenticator)
|
||||
- CCID Smart Card support (PIV-compatibile)
|
||||
- CCID Smart Card support (PIV-compatible)
|
||||
- OpenPGP
|
||||
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) of products instead.
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) series instead.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
@@ -55,7 +55,7 @@ The firmware of Yubico's Security Keys is not updatable. If you want features in
|
||||
{ width="400" }
|
||||
</figure>
|
||||
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The YubiKey 5 Series has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), [Yubico OTP](basics/multi-factor-authentication.md#yubico-otp), [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), [OpenPGP](https://developers.yubico.com/PGP), and [TOTP and HOTP](https://developers.yubico.com/OATH) authentication.
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The **YubiKey 5 Series** has a wide range of features such as FIDO2/WebAuthn and FIDO U2F, [TOTP and HOTP](https://developers.yubico.com/OATH) authentication, [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), and [OpenPGP](https://developers.yubico.com/PGP).
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/yubikey-5-overview){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -69,7 +69,7 @@ The [comparison table](https://yubico.com/store/compare) shows how the YubiKeys
|
||||
|
||||
YubiKeys can be programmed using the [YubiKey Manager](https://yubico.com/support/download/yubikey-manager) or [YubiKey Personalization Tools](https://yubico.com/support/download/yubikey-personalization-tools). For managing TOTP codes, you can use the [Yubico Authenticator](https://yubico.com/products/yubico-authenticator). All of Yubico's clients are open source.
|
||||
|
||||
For models which support HOTP and TOTP, there are 2 slots in the OTP interface which could be used for HOTP and 32 slots to store TOTP secrets. These secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
For models which [support HOTP and TOTP](https://support.yubico.com/hc/articles/360013790319-How-many-accounts-can-I-register-my-YubiKey-with), the secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
@@ -86,7 +86,7 @@ The firmware of YubiKey is not updatable. If you want features in newer firmware
|
||||
{ width="300" }
|
||||
</figure>
|
||||
|
||||
The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://www.nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification). The Nitrokey 3 Series in general has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), Personal Identity Verification (PIV), OpenPGP, and TOTP and HOTP authentication.
|
||||
**Nitrokey** has a cost-effective security key capable of FIDO2/WebAuthn and FIDO U2F called the **Nitrokey Passkey**. For support for features such as PIV, OpenPGP, and TOTP and HOTP authentication, you need to purchase one of their other keys like the **Nitrokey 3**. Currently, only the **Nitrokey 3A Mini** has [FIDO Level 1 Certification](https://nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification).
|
||||
|
||||
[:octicons-home-16: Homepage](https://nitrokey.com){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://nitrokey.com/data-privacy-policy){ .card-link title="Privacy Policy" }
|
||||
@@ -96,26 +96,14 @@ The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://
|
||||
|
||||
</div>
|
||||
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys) shows how the different Nitrokey models compare to each other in terms of features and other specifications.
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys#:~:text=The%20Nitrokey%20Family) shows how the different Nitrokey models compare to each other in terms of features and other specifications. Refer to Nitrokey's [documentation](https://docs.nitrokey.com/nitrokeys/features) for more details about the features available on your Nitrokey.
|
||||
|
||||
Nitrokey models can be configured using the [Nitrokey app](https://nitrokey.com/download).
|
||||
|
||||
The Nitrokey 3 Series can act as a password manager. They can store up to 50 different entries, and each entry can contain login, password, comment and OTP.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Excluding the Nitrokey 3, Nitrokeys with HOTP and TOTP storage do not have it encrypted, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
**Nitrokey** also has the **Nitrokey Passkey**, a lower-price security key capable of [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online). This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- Password Manager
|
||||
- PIV
|
||||
- OpenPGP
|
||||
- Tamper-resistant smart card
|
||||
- TOTP and HOTP
|
||||
Excluding the Nitrokey 3, Nitrokeys which support HOTP and TOTP do not have encrypted storage, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: "Multifactor Authentication"
|
||||
icon: 'material/two-factor-authentication'
|
||||
title: Multifactor Authentication
|
||||
icon: material/two-factor-authentication
|
||||
description: MFA is a critical security mechanism for securing your online accounts, but some methods are stronger than others.
|
||||
---
|
||||
|
||||
@@ -64,7 +64,7 @@ If your threat model requires you to have different identities on different webs
|
||||
|
||||
#### FIDO (Fast IDentity Online)
|
||||
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was U2F and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) which includes the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was [U2F](https://en.wikipedia.org/wiki/Universal_2nd_Factor) and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) which includes the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
|
||||
U2F and FIDO2 refer to the [Client to Authenticator Protocol](https://en.wikipedia.org/wiki/Client_to_Authenticator_Protocol), which is the protocol between the security key and the computer, such as a laptop or phone. It complements WebAuthn which is the component used to authenticate with the website (the "Relying Party") you're trying to log in on.
|
||||
|
||||
|
||||
@@ -96,7 +96,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, and view their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, view and edit their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
|
||||
[:octicons-home-16: Homepage](https://peergos.org){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://peergos.net/privacy.html){ .card-link title="Privacy Policy" }
|
||||
@@ -109,9 +109,9 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=peergos.android)
|
||||
- [:simple-github: GitHub](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-apple: macOS](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-linux: Linux](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://peergos.org/download#windows)
|
||||
- [:simple-apple: macOS](https://peergos.org/download#macos)
|
||||
- [:simple-linux: Linux](https://peergos.org/download#linux)
|
||||
- [:octicons-browser-16: Web](https://peergos.net)
|
||||
|
||||
</details>
|
||||
@@ -120,9 +120,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
Peergos is built on top of the [InterPlanetary File System (IPFS)](https://ipfs.tech), a peer-to-peer architecture that protects against [:material-close-outline: Censorship](basics/common-threats.md#avoiding-censorship ""){.pg-blue-gray}.
|
||||
|
||||
Peergos is primarily a web app, but you can self-host the server either as a local cache for your remote Peergos account, or as a standalone storage server which negates the need to register for a remote account and subscription. The Peergos server is a `.jar` file, which means the Java 17+ Runtime Environment ([OpenJDK download](https://azul.com/downloads)) should be installed on your machine to get it working.
|
||||
|
||||
Running a local version of Peergos alongside a registered account on their paid, hosted service allows you to access your Peergos storage without any reliance on DNS or TLS certificate authorities, and keep a copy of your data backed up to their cloud. The user experience should be the same whether you run their desktop server or just use their hosted web interface.
|
||||
Peergos has a web app, desktop apps and an Android app and you can also self-host the server. Client, server and command line interface all run from the same binary. There is a sync engine included (accessible via the desktop or android apps) for bi-directionally synchronizing a local folder with a Peergos folder, and a webdav bridge to allow other applications to access your Peergos storage.
|
||||
|
||||
Peergos was [audited](https://peergos.org/posts/security-audit-2024) in November 2024 by Radically Open Security and all issues were fixed. They were previously [audited](https://cure53.de/pentest-report_peergos.pdf) by Cure53 in June 2019, and all found issues were subsequently fixed.
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
title: "Security Keys"
|
||||
title: Security Keys
|
||||
icon: material/key-chain
|
||||
description: These security keys provide a form of phishing-immune authentication for accounts that support it.
|
||||
cover: multi-factor-authentication.webp
|
||||
@@ -10,7 +10,7 @@ cover: multi-factor-authentication.webp
|
||||
- [:material-target-account: Targeted Attacks](basics/common-threats.md#attacks-against-specific-individuals){ .pg-red }
|
||||
- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange }
|
||||
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the FIDO2 security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the [FIDO2](basics/multi-factor-authentication.md#fido-fast-identity-online) security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
|
||||
## Yubico Security Key
|
||||
|
||||
@@ -20,7 +20,7 @@ A physical **security key** adds a very strong layer of protection to your onlin
|
||||
{ width="315" }
|
||||
</figure>
|
||||
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO U2F, and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO Universal 2nd Factor (U2F), and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/security-key){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -35,10 +35,10 @@ These keys are available in both USB-C and USB-A variants, and both options supp
|
||||
This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- [Yubico Authenticator](https://yubico.com/products/yubico-authenticator)
|
||||
- CCID Smart Card support (PIV-compatibile)
|
||||
- CCID Smart Card support (PIV-compatible)
|
||||
- OpenPGP
|
||||
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) of products instead.
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) series instead.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
@@ -55,7 +55,7 @@ The firmware of Yubico's Security Keys is not updatable. If you want features in
|
||||
{ width="400" }
|
||||
</figure>
|
||||
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The YubiKey 5 Series has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), [Yubico OTP](basics/multi-factor-authentication.md#yubico-otp), [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), [OpenPGP](https://developers.yubico.com/PGP), and [TOTP and HOTP](https://developers.yubico.com/OATH) authentication.
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The **YubiKey 5 Series** has a wide range of features such as FIDO2/WebAuthn and FIDO U2F, [TOTP and HOTP](https://developers.yubico.com/OATH) authentication, [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), and [OpenPGP](https://developers.yubico.com/PGP).
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/yubikey-5-overview){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -69,7 +69,7 @@ The [comparison table](https://yubico.com/store/compare) shows how the YubiKeys
|
||||
|
||||
YubiKeys can be programmed using the [YubiKey Manager](https://yubico.com/support/download/yubikey-manager) or [YubiKey Personalization Tools](https://yubico.com/support/download/yubikey-personalization-tools). For managing TOTP codes, you can use the [Yubico Authenticator](https://yubico.com/products/yubico-authenticator). All of Yubico's clients are open source.
|
||||
|
||||
For models which support HOTP and TOTP, there are 2 slots in the OTP interface which could be used for HOTP and 32 slots to store TOTP secrets. These secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
For models which [support HOTP and TOTP](https://support.yubico.com/hc/articles/360013790319-How-many-accounts-can-I-register-my-YubiKey-with), the secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
@@ -86,7 +86,7 @@ The firmware of YubiKey is not updatable. If you want features in newer firmware
|
||||
{ width="300" }
|
||||
</figure>
|
||||
|
||||
The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://www.nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification). The Nitrokey 3 Series in general has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), Personal Identity Verification (PIV), OpenPGP, and TOTP and HOTP authentication.
|
||||
**Nitrokey** has a cost-effective security key capable of FIDO2/WebAuthn and FIDO U2F called the **Nitrokey Passkey**. For support for features such as PIV, OpenPGP, and TOTP and HOTP authentication, you need to purchase one of their other keys like the **Nitrokey 3**. Currently, only the **Nitrokey 3A Mini** has [FIDO Level 1 Certification](https://nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification).
|
||||
|
||||
[:octicons-home-16: Homepage](https://nitrokey.com){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://nitrokey.com/data-privacy-policy){ .card-link title="Privacy Policy" }
|
||||
@@ -96,26 +96,14 @@ The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://
|
||||
|
||||
</div>
|
||||
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys) shows how the different Nitrokey models compare to each other in terms of features and other specifications.
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys#:~:text=The%20Nitrokey%20Family) shows how the different Nitrokey models compare to each other in terms of features and other specifications. Refer to Nitrokey's [documentation](https://docs.nitrokey.com/nitrokeys/features) for more details about the features available on your Nitrokey.
|
||||
|
||||
Nitrokey models can be configured using the [Nitrokey app](https://nitrokey.com/download).
|
||||
|
||||
The Nitrokey 3 Series can act as a password manager. They can store up to 50 different entries, and each entry can contain login, password, comment and OTP.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Excluding the Nitrokey 3, Nitrokeys with HOTP and TOTP storage do not have it encrypted, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
**Nitrokey** also has the **Nitrokey Passkey**, a lower-price security key capable of [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online). This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- Password Manager
|
||||
- PIV
|
||||
- OpenPGP
|
||||
- Tamper-resistant smart card
|
||||
- TOTP and HOTP
|
||||
Excluding the Nitrokey 3, Nitrokeys which support HOTP and TOTP do not have encrypted storage, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: "Multifactor Authentication"
|
||||
icon: 'material/two-factor-authentication'
|
||||
title: Multifactor Authentication
|
||||
icon: material/two-factor-authentication
|
||||
description: MFA is a critical security mechanism for securing your online accounts, but some methods are stronger than others.
|
||||
---
|
||||
|
||||
@@ -64,7 +64,7 @@ If your threat model requires you to have different identities on different webs
|
||||
|
||||
#### FIDO (Fast IDentity Online)
|
||||
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was U2F and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) which includes the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was [U2F](https://en.wikipedia.org/wiki/Universal_2nd_Factor) and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) which includes the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
|
||||
U2F and FIDO2 refer to the [Client to Authenticator Protocol](https://en.wikipedia.org/wiki/Client_to_Authenticator_Protocol), which is the protocol between the security key and the computer, such as a laptop or phone. It complements WebAuthn which is the component used to authenticate with the website (the "Relying Party") you're trying to log in on.
|
||||
|
||||
|
||||
@@ -96,7 +96,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, and view their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, view and edit their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
|
||||
[:octicons-home-16: Homepage](https://peergos.org){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://peergos.net/privacy.html){ .card-link title="Privacy Policy" }
|
||||
@@ -109,9 +109,9 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=peergos.android)
|
||||
- [:simple-github: GitHub](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-apple: macOS](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-linux: Linux](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://peergos.org/download#windows)
|
||||
- [:simple-apple: macOS](https://peergos.org/download#macos)
|
||||
- [:simple-linux: Linux](https://peergos.org/download#linux)
|
||||
- [:octicons-browser-16: Web](https://peergos.net)
|
||||
|
||||
</details>
|
||||
@@ -120,9 +120,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
Peergos is built on top of the [InterPlanetary File System (IPFS)](https://ipfs.tech), a peer-to-peer architecture that protects against [:material-close-outline: Censorship](basics/common-threats.md#avoiding-censorship ""){.pg-blue-gray}.
|
||||
|
||||
Peergos is primarily a web app, but you can self-host the server either as a local cache for your remote Peergos account, or as a standalone storage server which negates the need to register for a remote account and subscription. The Peergos server is a `.jar` file, which means the Java 17+ Runtime Environment ([OpenJDK download](https://azul.com/downloads)) should be installed on your machine to get it working.
|
||||
|
||||
Running a local version of Peergos alongside a registered account on their paid, hosted service allows you to access your Peergos storage without any reliance on DNS or TLS certificate authorities, and keep a copy of your data backed up to their cloud. The user experience should be the same whether you run their desktop server or just use their hosted web interface.
|
||||
Peergos has a web app, desktop apps and an Android app and you can also self-host the server. Client, server and command line interface all run from the same binary. There is a sync engine included (accessible via the desktop or android apps) for bi-directionally synchronizing a local folder with a Peergos folder, and a webdav bridge to allow other applications to access your Peergos storage.
|
||||
|
||||
Peergos was [audited](https://peergos.org/posts/security-audit-2024) in November 2024 by Radically Open Security and all issues were fixed. They were previously [audited](https://cure53.de/pentest-report_peergos.pdf) by Cure53 in June 2019, and all found issues were subsequently fixed.
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
title: "Security Keys"
|
||||
title: Security Keys
|
||||
icon: material/key-chain
|
||||
description: These security keys provide a form of phishing-immune authentication for accounts that support it.
|
||||
cover: multi-factor-authentication.webp
|
||||
@@ -10,7 +10,7 @@ cover: multi-factor-authentication.webp
|
||||
- [:material-target-account: Targeted Attacks](basics/common-threats.md#attacks-against-specific-individuals){ .pg-red }
|
||||
- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange }
|
||||
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the FIDO2 security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the [FIDO2](basics/multi-factor-authentication.md#fido-fast-identity-online) security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
|
||||
## Yubico Security Key
|
||||
|
||||
@@ -20,7 +20,7 @@ A physical **security key** adds a very strong layer of protection to your onlin
|
||||
{ width="315" }
|
||||
</figure>
|
||||
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO U2F, and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO Universal 2nd Factor (U2F), and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/security-key){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -35,10 +35,10 @@ These keys are available in both USB-C and USB-A variants, and both options supp
|
||||
This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- [Yubico Authenticator](https://yubico.com/products/yubico-authenticator)
|
||||
- CCID Smart Card support (PIV-compatibile)
|
||||
- CCID Smart Card support (PIV-compatible)
|
||||
- OpenPGP
|
||||
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) of products instead.
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) series instead.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Varování</p>
|
||||
@@ -55,7 +55,7 @@ The firmware of Yubico's Security Keys is not updatable. If you want features in
|
||||
{ width="400" }
|
||||
</figure>
|
||||
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The YubiKey 5 Series has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), [Yubico OTP](basics/multi-factor-authentication.md#yubico-otp), [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), [OpenPGP](https://developers.yubico.com/PGP), and [TOTP and HOTP](https://developers.yubico.com/OATH) authentication.
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The **YubiKey 5 Series** has a wide range of features such as FIDO2/WebAuthn and FIDO U2F, [TOTP and HOTP](https://developers.yubico.com/OATH) authentication, [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), and [OpenPGP](https://developers.yubico.com/PGP).
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/yubikey-5-overview){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -69,7 +69,7 @@ The [comparison table](https://yubico.com/store/compare) shows how the YubiKeys
|
||||
|
||||
YubiKeys can be programmed using the [YubiKey Manager](https://yubico.com/support/download/yubikey-manager) or [YubiKey Personalization Tools](https://yubico.com/support/download/yubikey-personalization-tools). For managing TOTP codes, you can use the [Yubico Authenticator](https://yubico.com/products/yubico-authenticator). All of Yubico's clients are open source.
|
||||
|
||||
For models which support HOTP and TOTP, there are 2 slots in the OTP interface which could be used for HOTP and 32 slots to store TOTP secrets. These secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
For models which [support HOTP and TOTP](https://support.yubico.com/hc/articles/360013790319-How-many-accounts-can-I-register-my-YubiKey-with), the secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Varování</p>
|
||||
@@ -86,7 +86,7 @@ The firmware of YubiKey is not updatable. If you want features in newer firmware
|
||||
{ width="300" }
|
||||
</figure>
|
||||
|
||||
The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://www.nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification). The Nitrokey 3 Series in general has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), Personal Identity Verification (PIV), OpenPGP, and TOTP and HOTP authentication.
|
||||
**Nitrokey** has a cost-effective security key capable of FIDO2/WebAuthn and FIDO U2F called the **Nitrokey Passkey**. For support for features such as PIV, OpenPGP, and TOTP and HOTP authentication, you need to purchase one of their other keys like the **Nitrokey 3**. Currently, only the **Nitrokey 3A Mini** has [FIDO Level 1 Certification](https://nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification).
|
||||
|
||||
[:octicons-home-16: Homepage](https://nitrokey.com){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://nitrokey.com/data-privacy-policy){ .card-link title="Privacy Policy" }
|
||||
@@ -96,26 +96,14 @@ The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://
|
||||
|
||||
</div>
|
||||
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys) shows how the different Nitrokey models compare to each other in terms of features and other specifications.
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys#:~:text=The%20Nitrokey%20Family) shows how the different Nitrokey models compare to each other in terms of features and other specifications. Refer to Nitrokey's [documentation](https://docs.nitrokey.com/nitrokeys/features) for more details about the features available on your Nitrokey.
|
||||
|
||||
Nitrokey models can be configured using the [Nitrokey app](https://nitrokey.com/download).
|
||||
|
||||
The Nitrokey 3 Series can act as a password manager. They can store up to 50 different entries, and each entry can contain login, password, comment and OTP.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Varování</p>
|
||||
|
||||
Excluding the Nitrokey 3, Nitrokeys with HOTP and TOTP storage do not have it encrypted, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
**Nitrokey** also has the **Nitrokey Passkey**, a lower-price security key capable of [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online). This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- Password Manager
|
||||
- PIV
|
||||
- OpenPGP
|
||||
- Tamper-resistant smart card
|
||||
- TOTP and HOTP
|
||||
Excluding the Nitrokey 3, Nitrokeys which support HOTP and TOTP do not have encrypted storage, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: "Multi-Faktor-Authentisierung"
|
||||
icon: 'material/two-factor-authentication'
|
||||
title: Multi-Faktor-Authentisierung
|
||||
icon: material/two-factor-authentication
|
||||
description: MFA ist ein wichtiger Sicherheitsmechanismus zum Schutz deiner Online-Konten, aber einige Methoden sind stärker als andere.
|
||||
---
|
||||
|
||||
@@ -64,7 +64,7 @@ Wenn dein Bedrohungsmodell unterschiedliche Identitäten auf verschiedenen Websi
|
||||
|
||||
#### FIDO (Fast IDentity Online)
|
||||
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) umfasst eine Reihe von Standards, zuerst U2F und später [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project), welches den Webstandard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn) beinhaltet.
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was [U2F](https://en.wikipedia.org/wiki/Universal_2nd_Factor) and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) which includes the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
|
||||
U2F und FIDO2 beziehen sich auf das [Client to Authenticator Protocol](https://de.wikipedia.org/wiki/Client_to_Authenticator_Protocol), d. h. das Protokoll zwischen dem Sicherheitsschlüssel und dem Computer, z. B. einem Laptop oder Telefon. Es ergänzt WebAuthn, die Komponente zur Authentifizierung bei der Website (der "Relying Party"), bei der du dich anzumelden versuchst.
|
||||
|
||||
|
||||
@@ -96,7 +96,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, and view their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, view and edit their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
|
||||
[:octicons-home-16: Homepage](https://peergos.org){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://peergos.net/privacy.html){ .card-link title="Privacy Policy" }
|
||||
@@ -109,9 +109,9 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=peergos.android)
|
||||
- [:simple-github: GitHub](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-apple: macOS](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-linux: Linux](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://peergos.org/download#windows)
|
||||
- [:simple-apple: macOS](https://peergos.org/download#macos)
|
||||
- [:simple-linux: Linux](https://peergos.org/download#linux)
|
||||
- [:octicons-browser-16: Web](https://peergos.net)
|
||||
|
||||
</details>
|
||||
@@ -120,9 +120,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
Peergos is built on top of the [InterPlanetary File System (IPFS)](https://ipfs.tech), a peer-to-peer architecture that protects against [:material-close-outline: Censorship](basics/common-threats.md#avoiding-censorship ""){.pg-blue-gray}.
|
||||
|
||||
Peergos is primarily a web app, but you can self-host the server either as a local cache for your remote Peergos account, or as a standalone storage server which negates the need to register for a remote account and subscription. The Peergos server is a `.jar` file, which means the Java 17+ Runtime Environment ([OpenJDK download](https://azul.com/downloads)) should be installed on your machine to get it working.
|
||||
|
||||
Running a local version of Peergos alongside a registered account on their paid, hosted service allows you to access your Peergos storage without any reliance on DNS or TLS certificate authorities, and keep a copy of your data backed up to their cloud. The user experience should be the same whether you run their desktop server or just use their hosted web interface.
|
||||
Peergos has a web app, desktop apps and an Android app and you can also self-host the server. Client, server and command line interface all run from the same binary. There is a sync engine included (accessible via the desktop or android apps) for bi-directionally synchronizing a local folder with a Peergos folder, and a webdav bridge to allow other applications to access your Peergos storage.
|
||||
|
||||
Peergos was [audited](https://peergos.org/posts/security-audit-2024) in November 2024 by Radically Open Security and all issues were fixed. They were previously [audited](https://cure53.de/pentest-report_peergos.pdf) by Cure53 in June 2019, and all found issues were subsequently fixed.
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
title: "Security Keys"
|
||||
title: Security Keys
|
||||
icon: material/key-chain
|
||||
description: These security keys provide a form of phishing-immune authentication for accounts that support it.
|
||||
cover: multi-factor-authentication.webp
|
||||
@@ -10,7 +10,7 @@ cover: multi-factor-authentication.webp
|
||||
- [:material-target-account: Targeted Attacks](basics/common-threats.md#attacks-against-specific-individuals){ .pg-red }
|
||||
- [:material-bug-outline: Passive Angriffe](basics/common-threats.md#security-and-privacy){ .pg-orange }
|
||||
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the FIDO2 security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the [FIDO2](basics/multi-factor-authentication.md#fido-fast-identity-online) security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
|
||||
## Yubico Security Key
|
||||
|
||||
@@ -20,7 +20,7 @@ A physical **security key** adds a very strong layer of protection to your onlin
|
||||
{ width="315" }
|
||||
</figure>
|
||||
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO U2F, and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO Universal 2nd Factor (U2F), and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/security-key){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -35,10 +35,10 @@ Diese Tasten sind sowohl als USB-C- als auch als USB-A-Variante erhältlich, und
|
||||
This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- [Yubico Authenticator](https://yubico.com/products/yubico-authenticator)
|
||||
- CCID Smart Card Unterstützung (PIV-kompatibel)
|
||||
- CCID Smart Card support (PIV-compatible)
|
||||
- OpenPGP
|
||||
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) of products instead.
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) series instead.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warnung</p>
|
||||
@@ -55,7 +55,7 @@ The firmware of Yubico's Security Keys is not updatable. If you want features in
|
||||
{ width="400" }
|
||||
</figure>
|
||||
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The YubiKey 5 Series has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), [Yubico OTP](basics/multi-factor-authentication.md#yubico-otp), [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), [OpenPGP](https://developers.yubico.com/PGP), and [TOTP and HOTP](https://developers.yubico.com/OATH) authentication.
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The **YubiKey 5 Series** has a wide range of features such as FIDO2/WebAuthn and FIDO U2F, [TOTP and HOTP](https://developers.yubico.com/OATH) authentication, [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), and [OpenPGP](https://developers.yubico.com/PGP).
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/yubikey-5-overview){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -69,7 +69,7 @@ The [comparison table](https://yubico.com/store/compare) shows how the YubiKeys
|
||||
|
||||
YubiKeys can be programmed using the [YubiKey Manager](https://yubico.com/support/download/yubikey-manager) or [YubiKey Personalization Tools](https://yubico.com/support/download/yubikey-personalization-tools). For managing TOTP codes, you can use the [Yubico Authenticator](https://yubico.com/products/yubico-authenticator). All of Yubico's clients are open source.
|
||||
|
||||
For models which support HOTP and TOTP, there are 2 slots in the OTP interface which could be used for HOTP and 32 slots to store TOTP secrets. These secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
For models which [support HOTP and TOTP](https://support.yubico.com/hc/articles/360013790319-How-many-accounts-can-I-register-my-YubiKey-with), the secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warnung</p>
|
||||
@@ -86,7 +86,7 @@ The firmware of YubiKey is not updatable. If you want features in newer firmware
|
||||
{ width="300" }
|
||||
</figure>
|
||||
|
||||
The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://www.nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification). The Nitrokey 3 Series in general has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), Personal Identity Verification (PIV), OpenPGP, and TOTP and HOTP authentication.
|
||||
**Nitrokey** has a cost-effective security key capable of FIDO2/WebAuthn and FIDO U2F called the **Nitrokey Passkey**. For support for features such as PIV, OpenPGP, and TOTP and HOTP authentication, you need to purchase one of their other keys like the **Nitrokey 3**. Currently, only the **Nitrokey 3A Mini** has [FIDO Level 1 Certification](https://nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification).
|
||||
|
||||
[:octicons-home-16: Homepage](https://nitrokey.com){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://nitrokey.com/data-privacy-policy){ .card-link title="Privacy Policy" }
|
||||
@@ -96,26 +96,14 @@ The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://
|
||||
|
||||
</div>
|
||||
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys) shows how the different Nitrokey models compare to each other in terms of features and other specifications.
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys#:~:text=The%20Nitrokey%20Family) shows how the different Nitrokey models compare to each other in terms of features and other specifications. Refer to Nitrokey's [documentation](https://docs.nitrokey.com/nitrokeys/features) for more details about the features available on your Nitrokey.
|
||||
|
||||
Nitrokey models can be configured using the [Nitrokey app](https://nitrokey.com/download).
|
||||
|
||||
The Nitrokey 3 Series can act as a password manager. They can store up to 50 different entries, and each entry can contain login, password, comment and OTP.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warnung</p>
|
||||
|
||||
Excluding the Nitrokey 3, Nitrokeys with HOTP and TOTP storage do not have it encrypted, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
**Nitrokey** also has the **Nitrokey Passkey**, a lower-price security key capable of [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online). This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- Passwort-Manager
|
||||
- PIV
|
||||
- OpenPGP
|
||||
- Tamper-resistant smart card
|
||||
- TOTP and HOTP
|
||||
Excluding the Nitrokey 3, Nitrokeys which support HOTP and TOTP do not have encrypted storage, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: "Multifactor Authentication"
|
||||
icon: 'material/two-factor-authentication'
|
||||
title: Multifactor Authentication
|
||||
icon: material/two-factor-authentication
|
||||
description: MFA is a critical security mechanism for securing your online accounts, but some methods are stronger than others.
|
||||
---
|
||||
|
||||
@@ -64,7 +64,7 @@ If your threat model requires you to have different identities on different webs
|
||||
|
||||
#### FIDO (Fast IDentity Online)
|
||||
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was U2F and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) which includes the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was [U2F](https://en.wikipedia.org/wiki/Universal_2nd_Factor) and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) which includes the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
|
||||
U2F and FIDO2 refer to the [Client to Authenticator Protocol](https://en.wikipedia.org/wiki/Client_to_Authenticator_Protocol), which is the protocol between the security key and the computer, such as a laptop or phone. It complements WebAuthn which is the component used to authenticate with the website (the "Relying Party") you're trying to log in on.
|
||||
|
||||
|
||||
@@ -96,7 +96,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, and view their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, view and edit their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
|
||||
[:octicons-home-16: Homepage](https://peergos.org){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://peergos.net/privacy.html){ .card-link title="Privacy Policy" }
|
||||
@@ -109,9 +109,9 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=peergos.android)
|
||||
- [:simple-github: GitHub](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-apple: macOS](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-linux: Linux](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://peergos.org/download#windows)
|
||||
- [:simple-apple: macOS](https://peergos.org/download#macos)
|
||||
- [:simple-linux: Linux](https://peergos.org/download#linux)
|
||||
- [:octicons-browser-16: Web](https://peergos.net)
|
||||
|
||||
</details>
|
||||
@@ -120,9 +120,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
Peergos is built on top of the [InterPlanetary File System (IPFS)](https://ipfs.tech), a peer-to-peer architecture that protects against [:material-close-outline: Censorship](basics/common-threats.md#avoiding-censorship ""){.pg-blue-gray}.
|
||||
|
||||
Peergos is primarily a web app, but you can self-host the server either as a local cache for your remote Peergos account, or as a standalone storage server which negates the need to register for a remote account and subscription. The Peergos server is a `.jar` file, which means the Java 17+ Runtime Environment ([OpenJDK download](https://azul.com/downloads)) should be installed on your machine to get it working.
|
||||
|
||||
Running a local version of Peergos alongside a registered account on their paid, hosted service allows you to access your Peergos storage without any reliance on DNS or TLS certificate authorities, and keep a copy of your data backed up to their cloud. The user experience should be the same whether you run their desktop server or just use their hosted web interface.
|
||||
Peergos has a web app, desktop apps and an Android app and you can also self-host the server. Client, server and command line interface all run from the same binary. There is a sync engine included (accessible via the desktop or android apps) for bi-directionally synchronizing a local folder with a Peergos folder, and a webdav bridge to allow other applications to access your Peergos storage.
|
||||
|
||||
Peergos was [audited](https://peergos.org/posts/security-audit-2024) in November 2024 by Radically Open Security and all issues were fixed. They were previously [audited](https://cure53.de/pentest-report_peergos.pdf) by Cure53 in June 2019, and all found issues were subsequently fixed.
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
title: "Security Keys"
|
||||
title: Security Keys
|
||||
icon: material/key-chain
|
||||
description: These security keys provide a form of phishing-immune authentication for accounts that support it.
|
||||
cover: multi-factor-authentication.webp
|
||||
@@ -10,7 +10,7 @@ cover: multi-factor-authentication.webp
|
||||
- [:material-target-account: Targeted Attacks](basics/common-threats.md#attacks-against-specific-individuals){ .pg-red }
|
||||
- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange }
|
||||
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the FIDO2 security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the [FIDO2](basics/multi-factor-authentication.md#fido-fast-identity-online) security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
|
||||
## Yubico Security Key
|
||||
|
||||
@@ -20,7 +20,7 @@ A physical **security key** adds a very strong layer of protection to your onlin
|
||||
{ width="315" }
|
||||
</figure>
|
||||
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO U2F, and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO Universal 2nd Factor (U2F), and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/security-key){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -35,10 +35,10 @@ These keys are available in both USB-C and USB-A variants, and both options supp
|
||||
This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- [Yubico Authenticator](https://yubico.com/products/yubico-authenticator)
|
||||
- CCID Smart Card support (PIV-compatibile)
|
||||
- CCID Smart Card support (PIV-compatible)
|
||||
- OpenPGP
|
||||
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) of products instead.
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) series instead.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
@@ -55,7 +55,7 @@ The firmware of Yubico's Security Keys is not updatable. If you want features in
|
||||
{ width="400" }
|
||||
</figure>
|
||||
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The YubiKey 5 Series has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), [Yubico OTP](basics/multi-factor-authentication.md#yubico-otp), [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), [OpenPGP](https://developers.yubico.com/PGP), and [TOTP and HOTP](https://developers.yubico.com/OATH) authentication.
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The **YubiKey 5 Series** has a wide range of features such as FIDO2/WebAuthn and FIDO U2F, [TOTP and HOTP](https://developers.yubico.com/OATH) authentication, [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), and [OpenPGP](https://developers.yubico.com/PGP).
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/yubikey-5-overview){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -69,7 +69,7 @@ The [comparison table](https://yubico.com/store/compare) shows how the YubiKeys
|
||||
|
||||
YubiKeys can be programmed using the [YubiKey Manager](https://yubico.com/support/download/yubikey-manager) or [YubiKey Personalization Tools](https://yubico.com/support/download/yubikey-personalization-tools). For managing TOTP codes, you can use the [Yubico Authenticator](https://yubico.com/products/yubico-authenticator). All of Yubico's clients are open source.
|
||||
|
||||
For models which support HOTP and TOTP, there are 2 slots in the OTP interface which could be used for HOTP and 32 slots to store TOTP secrets. These secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
For models which [support HOTP and TOTP](https://support.yubico.com/hc/articles/360013790319-How-many-accounts-can-I-register-my-YubiKey-with), the secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
@@ -86,7 +86,7 @@ The firmware of YubiKey is not updatable. If you want features in newer firmware
|
||||
{ width="300" }
|
||||
</figure>
|
||||
|
||||
The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://www.nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification). The Nitrokey 3 Series in general has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), Personal Identity Verification (PIV), OpenPGP, and TOTP and HOTP authentication.
|
||||
**Nitrokey** has a cost-effective security key capable of FIDO2/WebAuthn and FIDO U2F called the **Nitrokey Passkey**. For support for features such as PIV, OpenPGP, and TOTP and HOTP authentication, you need to purchase one of their other keys like the **Nitrokey 3**. Currently, only the **Nitrokey 3A Mini** has [FIDO Level 1 Certification](https://nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification).
|
||||
|
||||
[:octicons-home-16: Homepage](https://nitrokey.com){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://nitrokey.com/data-privacy-policy){ .card-link title="Privacy Policy" }
|
||||
@@ -96,26 +96,14 @@ The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://
|
||||
|
||||
</div>
|
||||
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys) shows how the different Nitrokey models compare to each other in terms of features and other specifications.
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys#:~:text=The%20Nitrokey%20Family) shows how the different Nitrokey models compare to each other in terms of features and other specifications. Refer to Nitrokey's [documentation](https://docs.nitrokey.com/nitrokeys/features) for more details about the features available on your Nitrokey.
|
||||
|
||||
Nitrokey models can be configured using the [Nitrokey app](https://nitrokey.com/download).
|
||||
|
||||
The Nitrokey 3 Series can act as a password manager. They can store up to 50 different entries, and each entry can contain login, password, comment and OTP.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Excluding the Nitrokey 3, Nitrokeys with HOTP and TOTP storage do not have it encrypted, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
**Nitrokey** also has the **Nitrokey Passkey**, a lower-price security key capable of [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online). This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- Password Manager
|
||||
- PIV
|
||||
- OpenPGP
|
||||
- Tamper-resistant smart card
|
||||
- TOTP and HOTP
|
||||
Excluding the Nitrokey 3, Nitrokeys which support HOTP and TOTP do not have encrypted storage, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: "Multifactor Authentication"
|
||||
icon: 'material/two-factor-authentication'
|
||||
title: Multifactor Authentication
|
||||
icon: material/two-factor-authentication
|
||||
description: MFA is a critical security mechanism for securing your online accounts, but some methods are stronger than others.
|
||||
---
|
||||
|
||||
@@ -64,7 +64,7 @@ If your threat model requires you to have different identities on different webs
|
||||
|
||||
#### FIDO (Fast IDentity Online)
|
||||
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was U2F and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) which includes the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was [U2F](https://en.wikipedia.org/wiki/Universal_2nd_Factor) and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) which includes the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
|
||||
U2F and FIDO2 refer to the [Client to Authenticator Protocol](https://en.wikipedia.org/wiki/Client_to_Authenticator_Protocol), which is the protocol between the security key and the computer, such as a laptop or phone. It complements WebAuthn which is the component used to authenticate with the website (the "Relying Party") you're trying to log in on.
|
||||
|
||||
|
||||
@@ -96,7 +96,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, and view their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, view and edit their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
|
||||
[:octicons-home-16: Homepage](https://peergos.org){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://peergos.net/privacy.html){ .card-link title="Privacy Policy" }
|
||||
@@ -109,9 +109,9 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=peergos.android)
|
||||
- [:simple-github: GitHub](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-apple: macOS](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-linux: Linux](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://peergos.org/download#windows)
|
||||
- [:simple-apple: macOS](https://peergos.org/download#macos)
|
||||
- [:simple-linux: Linux](https://peergos.org/download#linux)
|
||||
- [:octicons-browser-16: Web](https://peergos.net)
|
||||
|
||||
</details>
|
||||
@@ -120,9 +120,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
Peergos is built on top of the [InterPlanetary File System (IPFS)](https://ipfs.tech), a peer-to-peer architecture that protects against [:material-close-outline: Censorship](basics/common-threats.md#avoiding-censorship ""){.pg-blue-gray}.
|
||||
|
||||
Peergos is primarily a web app, but you can self-host the server either as a local cache for your remote Peergos account, or as a standalone storage server which negates the need to register for a remote account and subscription. The Peergos server is a `.jar` file, which means the Java 17+ Runtime Environment ([OpenJDK download](https://azul.com/downloads)) should be installed on your machine to get it working.
|
||||
|
||||
Running a local version of Peergos alongside a registered account on their paid, hosted service allows you to access your Peergos storage without any reliance on DNS or TLS certificate authorities, and keep a copy of your data backed up to their cloud. The user experience should be the same whether you run their desktop server or just use their hosted web interface.
|
||||
Peergos has a web app, desktop apps and an Android app and you can also self-host the server. Client, server and command line interface all run from the same binary. There is a sync engine included (accessible via the desktop or android apps) for bi-directionally synchronizing a local folder with a Peergos folder, and a webdav bridge to allow other applications to access your Peergos storage.
|
||||
|
||||
Peergos was [audited](https://peergos.org/posts/security-audit-2024) in November 2024 by Radically Open Security and all issues were fixed. They were previously [audited](https://cure53.de/pentest-report_peergos.pdf) by Cure53 in June 2019, and all found issues were subsequently fixed.
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
title: "Security Keys"
|
||||
title: Security Keys
|
||||
icon: material/key-chain
|
||||
description: These security keys provide a form of phishing-immune authentication for accounts that support it.
|
||||
cover: multi-factor-authentication.webp
|
||||
@@ -10,7 +10,7 @@ cover: multi-factor-authentication.webp
|
||||
- [:material-target-account: Targeted Attacks](basics/common-threats.md#attacks-against-specific-individuals){ .pg-red }
|
||||
- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange }
|
||||
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the FIDO2 security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the [FIDO2](basics/multi-factor-authentication.md#fido-fast-identity-online) security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
|
||||
## Yubico Security Key
|
||||
|
||||
@@ -20,7 +20,7 @@ A physical **security key** adds a very strong layer of protection to your onlin
|
||||
{ width="315" }
|
||||
</figure>
|
||||
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO U2F, and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO Universal 2nd Factor (U2F), and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/security-key){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -35,10 +35,10 @@ These keys are available in both USB-C and USB-A variants, and both options supp
|
||||
This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- [Yubico Authenticator](https://yubico.com/products/yubico-authenticator)
|
||||
- CCID Smart Card support (PIV-compatibile)
|
||||
- CCID Smart Card support (PIV-compatible)
|
||||
- OpenPGP
|
||||
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) of products instead.
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) series instead.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
@@ -55,7 +55,7 @@ The firmware of Yubico's Security Keys is not updatable. If you want features in
|
||||
{ width="400" }
|
||||
</figure>
|
||||
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The YubiKey 5 Series has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), [Yubico OTP](basics/multi-factor-authentication.md#yubico-otp), [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), [OpenPGP](https://developers.yubico.com/PGP), and [TOTP and HOTP](https://developers.yubico.com/OATH) authentication.
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The **YubiKey 5 Series** has a wide range of features such as FIDO2/WebAuthn and FIDO U2F, [TOTP and HOTP](https://developers.yubico.com/OATH) authentication, [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), and [OpenPGP](https://developers.yubico.com/PGP).
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/yubikey-5-overview){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -69,7 +69,7 @@ The [comparison table](https://yubico.com/store/compare) shows how the YubiKeys
|
||||
|
||||
YubiKeys can be programmed using the [YubiKey Manager](https://yubico.com/support/download/yubikey-manager) or [YubiKey Personalization Tools](https://yubico.com/support/download/yubikey-personalization-tools). For managing TOTP codes, you can use the [Yubico Authenticator](https://yubico.com/products/yubico-authenticator). All of Yubico's clients are open source.
|
||||
|
||||
For models which support HOTP and TOTP, there are 2 slots in the OTP interface which could be used for HOTP and 32 slots to store TOTP secrets. These secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
For models which [support HOTP and TOTP](https://support.yubico.com/hc/articles/360013790319-How-many-accounts-can-I-register-my-YubiKey-with), the secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
@@ -86,7 +86,7 @@ The firmware of YubiKey is not updatable. If you want features in newer firmware
|
||||
{ width="300" }
|
||||
</figure>
|
||||
|
||||
The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://www.nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification). The Nitrokey 3 Series in general has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), Personal Identity Verification (PIV), OpenPGP, and TOTP and HOTP authentication.
|
||||
**Nitrokey** has a cost-effective security key capable of FIDO2/WebAuthn and FIDO U2F called the **Nitrokey Passkey**. For support for features such as PIV, OpenPGP, and TOTP and HOTP authentication, you need to purchase one of their other keys like the **Nitrokey 3**. Currently, only the **Nitrokey 3A Mini** has [FIDO Level 1 Certification](https://nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification).
|
||||
|
||||
[:octicons-home-16: Homepage](https://nitrokey.com){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://nitrokey.com/data-privacy-policy){ .card-link title="Privacy Policy" }
|
||||
@@ -96,26 +96,14 @@ The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://
|
||||
|
||||
</div>
|
||||
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys) shows how the different Nitrokey models compare to each other in terms of features and other specifications.
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys#:~:text=The%20Nitrokey%20Family) shows how the different Nitrokey models compare to each other in terms of features and other specifications. Refer to Nitrokey's [documentation](https://docs.nitrokey.com/nitrokeys/features) for more details about the features available on your Nitrokey.
|
||||
|
||||
Nitrokey models can be configured using the [Nitrokey app](https://nitrokey.com/download).
|
||||
|
||||
The Nitrokey 3 Series can act as a password manager. They can store up to 50 different entries, and each entry can contain login, password, comment and OTP.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Excluding the Nitrokey 3, Nitrokeys with HOTP and TOTP storage do not have it encrypted, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
**Nitrokey** also has the **Nitrokey Passkey**, a lower-price security key capable of [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online). This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- Password Manager
|
||||
- PIV
|
||||
- OpenPGP
|
||||
- Tamper-resistant smart card
|
||||
- TOTP and HOTP
|
||||
Excluding the Nitrokey 3, Nitrokeys which support HOTP and TOTP do not have encrypted storage, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: "Autenticación Multifactor"
|
||||
icon: 'material/two-factor-authentication'
|
||||
title: Autenticación Multifactor
|
||||
icon: material/two-factor-authentication
|
||||
description: La MFA es un mecanismo de seguridad fundamental para proteger tus cuentas en línea, pero algunos métodos son más eficaces que otros.
|
||||
---
|
||||
|
||||
@@ -64,7 +64,7 @@ Si tu modelo de amenaza requiere que tengas diferentes identidades en diferentes
|
||||
|
||||
#### FIDO (Fast IDentity Online)
|
||||
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) incluye una serie de estándares, primero fue U2F y después [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) el cual incluye el estándar web [WebAuthn](https://es.wikipedia.org/wiki/WebAuthn).
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was [U2F](https://en.wikipedia.org/wiki/Universal_2nd_Factor) and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) which includes the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
|
||||
U2F y FIDO2 se refieren al [Protocolo Cliente-Autenticador](https://en.wikipedia.org/wiki/Client_to_Authenticator_Protocol), que es el protocolo entre la clave de seguridad y el ordenador, como un portátil o un teléfono. Complementa a WebAuthn, que es el componente utilizado para autenticarse con el sitio web (la "parte dependiente") en el que estás intentando de iniciar sesión.
|
||||
|
||||
|
||||
@@ -96,7 +96,7 @@ También han recibido el Sello de Confianza Digital, una certificación de la [S
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Peergos** es un protocolo descentralizado y una plataforma de código abierto para almacenamiento, redes sociales y aplicaciones. Proporciona un espacio seguro y privado donde los usuarios pueden almacenar, compartir y ver sus fotos, vídeos, documentos, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
**Peergos** es un protocolo descentralizado y una plataforma de código abierto para almacenamiento, redes sociales y aplicaciones. It provides a secure and private space where users can store, share, view and edit their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
|
||||
[:octicons-home-16: Página Principal](https://peergos.org){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://peergos.net/privacy.html){ .card-link title="Política de Privacidad" }
|
||||
@@ -105,13 +105,13 @@ También han recibido el Sello de Confianza Digital, una certificación de la [S
|
||||
[:octicons-heart-16:](https://github.com/peergos/peergos#support){ .card-link title="Contribuir" }
|
||||
|
||||
<details class="downloads" markdown>
|
||||
<summary>Downloads "Descargas"</summary>
|
||||
<summary>Downloads</summary>
|
||||
|
||||
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=peergos.android)
|
||||
- [:simple-github: GitHub](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-apple: macOS](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-linux: Linux](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://peergos.org/download#windows)
|
||||
- [:simple-apple: macOS](https://peergos.org/download#macos)
|
||||
- [:simple-linux: Linux](https://peergos.org/download#linux)
|
||||
- [:octicons-browser-16: Web](https://peergos.net)
|
||||
|
||||
</details>
|
||||
@@ -120,9 +120,7 @@ También han recibido el Sello de Confianza Digital, una certificación de la [S
|
||||
|
||||
Peergos se basa en el [Sistema de Archivos Interplanetario (IPFS)](https://ipfs.tech), una arquitectura entre iguales que protege contra [:material-close-outline: la censura](basics/common-threats.md#avoiding-censorship ""){.pg-blue-gray}.
|
||||
|
||||
Peergos es principalmente una aplicación web, pero puedes alojar tú mismo el servidor, ya sea como caché local para tu cuenta Peergos remota o como servidor de almacenamiento independiente, lo que evita la necesidad de registrarte para obtener una cuenta y una suscripción remotas. El servidor Peergos es un archivo `.jar`, lo que significa que debes tener instalado en tu máquina Java 17+ Runtime Environmen ([descarga de OpenJDK](https://azul.com/downloads)) para que funcione.
|
||||
|
||||
Ejecutar una versión local de Peergos junto con una cuenta registrada en su servicio alojado de pago te permite acceder a tu almacenamiento Peergos sin depender de DNS o autoridades de certificación TLS, y mantener una copia de seguridad de tus datos en su nube. La experiencia de usuario debería ser la misma tanto si ejecutas su servidor de escritorio como si utilizas su interfaz web alojada.
|
||||
Peergos has a web app, desktop apps and an Android app and you can also self-host the server. Client, server and command line interface all run from the same binary. There is a sync engine included (accessible via the desktop or android apps) for bi-directionally synchronizing a local folder with a Peergos folder, and a webdav bridge to allow other applications to access your Peergos storage.
|
||||
|
||||
Peergos fue [auditado](https://peergos.org/posts/security-audit-2024) en noviembre de 2024 por Radically Open Security y se solucionaron todos los problemas. Anteriormente fueron [auditados](https://cure53.de/pentest-report_peergos.pdf) por Cure53 en junio de 2019, y todos los problemas encontrados se solucionaron posteriormente.
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
title: "Llaves de seguridad"
|
||||
title: Llaves de seguridad
|
||||
icon: material/key-chain
|
||||
description: Estas llaves de seguridad proporcionan una forma de autenticación inmune al phishing para las cuentas que lo admiten.
|
||||
cover: multi-factor-authentication.webp
|
||||
@@ -10,7 +10,7 @@ cover: multi-factor-authentication.webp
|
||||
- [:material-target-account: Ataques dirigidos](basics/common-threats.md#attacks-against-specific-individuals){ .pg-red }
|
||||
- [:material-bug-outline: Ataques pasivos](basics/common-threats.md#security-and-privacy){ .pg-orange }
|
||||
|
||||
Una **llave de seguridad** física añade una capa fuerte de protección a tus cuentas en línea. A comparación con las [aplicaciones de autenticación](multi-factor-authentication.md), el protocolo de llave de seguridad FIDO2 es innume al phishing y no puede ser comprometido sin tener la llave física. Muchos servicios admiten FIDO2/WebAuthn como opción de autenticación multifactor para proteger tu cuenta, y algunos servicios te permiten utilizar una llave de seguridad como autenticador fuerte de factor único con autenticación sin contraseña.
|
||||
Una **llave de seguridad** física añade una capa fuerte de protección a tus cuentas en línea. Compared to [authenticator apps](multi-factor-authentication.md), the [FIDO2](basics/multi-factor-authentication.md#fido-fast-identity-online) security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Muchos servicios admiten FIDO2/WebAuthn como opción de autenticación multifactor para proteger tu cuenta, y algunos servicios te permiten utilizar una llave de seguridad como autenticador fuerte de factor único con autenticación sin contraseña.
|
||||
|
||||
## Llave de seguridad Yubico
|
||||
|
||||
@@ -18,7 +18,7 @@ Una **llave de seguridad** física añade una capa fuerte de protección a tus c
|
||||
|
||||
<figure markdown="span"> { width="315" }</figure>
|
||||
|
||||
La serie **Yubico Security Key** es la llave de seguridad física más rentable con certificación FIDO de Nivel 2[^1]. Esta es compatible con FIDO2/WebAuthn y FIDO U2F, y funciona con muchos servicios compatibles con una llave de seguridad como segundo factor, así como con muchos gestores de contraseñas.
|
||||
La serie **Yubico Security Key** es la llave de seguridad física más rentable con certificación FIDO de Nivel 2[^1]. It supports FIDO2/WebAuthn and FIDO Universal 2nd Factor (U2F), and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
|
||||
[:octicons-home-16: Página Principal](https://yubico.com/products/security-key){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Política de Privacidad" }
|
||||
@@ -33,10 +33,10 @@ Estas llaves están disponibles en variantes USB-C y USB-A, y ambas opciones sop
|
||||
Esta llave proporciona únicamente la funcionalidad básica de FIDO2, pero para la mayoría de las personas esto es todo lo que necesitan. Algunas características notables que la serie de llave de seguridad **no** incluye son:
|
||||
|
||||
- [Autenticador Yubico](https://yubico.com/products/yubico-authenticator)
|
||||
- Soporte para la tarjeta inteligente CCID (compatible con PIV)
|
||||
- CCID Smart Card support (PIV-compatible)
|
||||
- OpenPGP
|
||||
|
||||
Si necesitas alguna de estas características, deberías considerar alguno de los [YubiKey](#yubikey) de alta gama.
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) series instead.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Advertencia</p>
|
||||
@@ -51,7 +51,7 @@ El firmware de las llaves de seguridad de Yubico no es actualizable. Si quieres
|
||||
|
||||
<figure markdown="span"> { width="400" }</figure>
|
||||
|
||||
La serie **YubiKey** de Yubico se encuentra entre las llaves de seguridad más populares con certificación FIDO de Nivel 2[^1]. La serie YubiKey 5 cuenta con una amplia gama de funciones como [Segundo Factor Universal (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 y WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), [Yubico OTP](basics/multi-factor-authentication.md#yubico-otp), [Verificación de Identidad Personal (PIV)](https://developers.yubico.com/PIV), [OpenPGP](https://developers.yubico.com/PGP) y autenticación [TOTP y HOTP](https://developers.yubico.com/OATH).
|
||||
La serie **YubiKey** de Yubico se encuentra entre las llaves de seguridad más populares con certificación FIDO de Nivel 2[^1]. The **YubiKey 5 Series** has a wide range of features such as FIDO2/WebAuthn and FIDO U2F, [TOTP and HOTP](https://developers.yubico.com/OATH) authentication, [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), and [OpenPGP](https://developers.yubico.com/PGP).
|
||||
|
||||
[:octicons-home-16: Página Principal](https://yubico.com/products/yubikey-5-overview){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Política de Privacidad" }
|
||||
@@ -65,7 +65,7 @@ La [tabla comparativa](https://yubico.com/store/compare) muestra cómo se compar
|
||||
|
||||
Las YubiKeys pueden ser programadas utilizando [YubiKey Manager](https://yubico.com/support/download/yubikey-manager) o [YubiKey Personalization Tools](https://yubico.com/support/download/yubikey-personalization-tools). Para gestionar los códigos TOTP, puedes utilizar el [Autenticador Yubico](https://yubico.com/products/yubico-authenticator). Todos los clientes de Yubico son de código abierto.
|
||||
|
||||
Para los modelos compatibles con HOTP y TOTP, hay 2 ranuras en la interfaz OTP que pueden utilizarse para HOTP y 32 ranuras para almacenar secretos TOTP. Estos secretos se almacenan cifrados en la llave y nunca son expuestos a los dispositivos a los que se conectan. Cuando una semilla (secreto compartido) es proporcionada al Autenticador Yubico, este solo mostrará el código de seis dígitos y nunca la semilla. Este modelo de seguridad ayuda a limitar lo que un atacante puede reailzar si alguno de los dispositivos en los que se ejecuta el Autenticador Yubico y hace resistente a la YubiKey ante los ataques físicos.
|
||||
For models which [support HOTP and TOTP](https://support.yubico.com/hc/articles/360013790319-How-many-accounts-can-I-register-my-YubiKey-with), the secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Cuando una semilla (secreto compartido) es proporcionada al Autenticador Yubico, este solo mostrará el código de seis dígitos y nunca la semilla. Este modelo de seguridad ayuda a limitar lo que un atacante puede reailzar si alguno de los dispositivos en los que se ejecuta el Autenticador Yubico y hace resistente a la YubiKey ante los ataques físicos.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Advertencia</p>
|
||||
@@ -80,7 +80,7 @@ El firmware de YubiKey no es actualizable. Si quieres características en las ve
|
||||
|
||||
<figure markdown="span"> { width="300" }</figure>
|
||||
|
||||
La **Nitrokey 3A Mini** [tiene Certificación FIDO Authenticator de Nivel 1](https://www.nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification). La serie Nitrokey 3 en general tiene una amplia gama de características como [Segundo Factor Universal (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 y WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), Verificación de Identidad Personal (PIV), OpenPGP, y autenticación TOTP y HOTP.
|
||||
**Nitrokey** has a cost-effective security key capable of FIDO2/WebAuthn and FIDO U2F called the **Nitrokey Passkey**. For support for features such as PIV, OpenPGP, and TOTP and HOTP authentication, you need to purchase one of their other keys like the **Nitrokey 3**. Currently, only the **Nitrokey 3A Mini** has [FIDO Level 1 Certification](https://nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification).
|
||||
|
||||
[:octicons-home-16: Página Principal](https://nitrokey.com){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://nitrokey.com/data-privacy-policy){ .card-link title="Politica de Privacidad" }
|
||||
@@ -90,26 +90,14 @@ La **Nitrokey 3A Mini** [tiene Certificación FIDO Authenticator de Nivel 1](htt
|
||||
|
||||
</div>
|
||||
|
||||
La [tabla comparativa](https://nitrokey.com/products/nitrokeys) muestra cómo los diferentes modelos de Nitrokey se comparan entre sí en términos de características y otras especificaciones.
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys#:~:text=The%20Nitrokey%20Family) shows how the different Nitrokey models compare to each other in terms of features and other specifications. Refer to Nitrokey's [documentation](https://docs.nitrokey.com/nitrokeys/features) for more details about the features available on your Nitrokey.
|
||||
|
||||
Los modelos de Nitrokey pueden ser configurados utilizando la [aplicación de Nitrokey](https://nitrokey.com/download).
|
||||
|
||||
La serie Nitrokey 3 puede actuar como administrador de contraseñas. Pueden almacenar hasta 50 entradas diferentes, y cada entrada puede contener nombre de usuario, contraseña, comentario y OTP.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Advertencia</p>
|
||||
|
||||
Excluyendo la Nitrokey 3, las Nitrokeys con almacenamiento HOTP y TOTP no lo tienen encriptado, haciéndolas vulnerables a ataques físicos.
|
||||
|
||||
</div>
|
||||
|
||||
**Nitrokey** también tiene la **Nitrokey Passkey**, una clave de seguridad de menor precio con [FIDO2 y WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online). Esta llave proporciona únicamente la funcionalidad básica de FIDO2, pero para la mayoría de las personas esto es todo lo que necesitan. Algunas características notables que la serie de llave de seguridad **no** incluye son:
|
||||
|
||||
- Administrador de contraseñas
|
||||
- PIV
|
||||
- OpenPGP
|
||||
- Tarjeta inteligente a prueba de manipulaciones
|
||||
- TOTP y HOTP
|
||||
Excluding the Nitrokey 3, Nitrokeys which support HOTP and TOTP do not have encrypted storage, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: "Multifactor Authentication"
|
||||
icon: 'material/two-factor-authentication'
|
||||
title: Multifactor Authentication
|
||||
icon: material/two-factor-authentication
|
||||
description: MFA is a critical security mechanism for securing your online accounts, but some methods are stronger than others.
|
||||
---
|
||||
|
||||
@@ -64,7 +64,7 @@ If your threat model requires you to have different identities on different webs
|
||||
|
||||
#### FIDO (Fast IDentity Online)
|
||||
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was U2F and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) which includes the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was [U2F](https://en.wikipedia.org/wiki/Universal_2nd_Factor) and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) which includes the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
|
||||
U2F and FIDO2 refer to the [Client to Authenticator Protocol](https://en.wikipedia.org/wiki/Client_to_Authenticator_Protocol), which is the protocol between the security key and the computer, such as a laptop or phone. It complements WebAuthn which is the component used to authenticate with the website (the "Relying Party") you're trying to log in on.
|
||||
|
||||
|
||||
@@ -96,7 +96,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, and view their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, view and edit their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
|
||||
[:octicons-home-16: Homepage](https://peergos.org){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://peergos.net/privacy.html){ .card-link title="Privacy Policy" }
|
||||
@@ -109,9 +109,9 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=peergos.android)
|
||||
- [:simple-github: GitHub](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-apple: macOS](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-linux: Linux](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://peergos.org/download#windows)
|
||||
- [:simple-apple: macOS](https://peergos.org/download#macos)
|
||||
- [:simple-linux: Linux](https://peergos.org/download#linux)
|
||||
- [:octicons-browser-16: Web](https://peergos.net)
|
||||
|
||||
</details>
|
||||
@@ -120,9 +120,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
Peergos is built on top of the [InterPlanetary File System (IPFS)](https://ipfs.tech), a peer-to-peer architecture that protects against [:material-close-outline: Censorship](basics/common-threats.md#avoiding-censorship ""){.pg-blue-gray}.
|
||||
|
||||
Peergos is primarily a web app, but you can self-host the server either as a local cache for your remote Peergos account, or as a standalone storage server which negates the need to register for a remote account and subscription. The Peergos server is a `.jar` file, which means the Java 17+ Runtime Environment ([OpenJDK download](https://azul.com/downloads)) should be installed on your machine to get it working.
|
||||
|
||||
Running a local version of Peergos alongside a registered account on their paid, hosted service allows you to access your Peergos storage without any reliance on DNS or TLS certificate authorities, and keep a copy of your data backed up to their cloud. The user experience should be the same whether you run their desktop server or just use their hosted web interface.
|
||||
Peergos has a web app, desktop apps and an Android app and you can also self-host the server. Client, server and command line interface all run from the same binary. There is a sync engine included (accessible via the desktop or android apps) for bi-directionally synchronizing a local folder with a Peergos folder, and a webdav bridge to allow other applications to access your Peergos storage.
|
||||
|
||||
Peergos was [audited](https://peergos.org/posts/security-audit-2024) in November 2024 by Radically Open Security and all issues were fixed. They were previously [audited](https://cure53.de/pentest-report_peergos.pdf) by Cure53 in June 2019, and all found issues were subsequently fixed.
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
title: "Security Keys"
|
||||
title: Security Keys
|
||||
icon: material/key-chain
|
||||
description: These security keys provide a form of phishing-immune authentication for accounts that support it.
|
||||
cover: multi-factor-authentication.webp
|
||||
@@ -10,7 +10,7 @@ cover: multi-factor-authentication.webp
|
||||
- [:material-target-account: Targeted Attacks](basics/common-threats.md#attacks-against-specific-individuals){ .pg-red }
|
||||
- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange }
|
||||
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the FIDO2 security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the [FIDO2](basics/multi-factor-authentication.md#fido-fast-identity-online) security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
|
||||
## Yubico Security Key
|
||||
|
||||
@@ -20,7 +20,7 @@ A physical **security key** adds a very strong layer of protection to your onlin
|
||||
{ width="315" }
|
||||
</figure>
|
||||
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO U2F, and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO Universal 2nd Factor (U2F), and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/security-key){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -35,10 +35,10 @@ These keys are available in both USB-C and USB-A variants, and both options supp
|
||||
This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- [Yubico Authenticator](https://yubico.com/products/yubico-authenticator)
|
||||
- CCID Smart Card support (PIV-compatibile)
|
||||
- CCID Smart Card support (PIV-compatible)
|
||||
- OpenPGP
|
||||
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) of products instead.
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) series instead.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
@@ -55,7 +55,7 @@ The firmware of Yubico's Security Keys is not updatable. If you want features in
|
||||
{ width="400" }
|
||||
</figure>
|
||||
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The YubiKey 5 Series has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), [Yubico OTP](basics/multi-factor-authentication.md#yubico-otp), [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), [OpenPGP](https://developers.yubico.com/PGP), and [TOTP and HOTP](https://developers.yubico.com/OATH) authentication.
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The **YubiKey 5 Series** has a wide range of features such as FIDO2/WebAuthn and FIDO U2F, [TOTP and HOTP](https://developers.yubico.com/OATH) authentication, [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), and [OpenPGP](https://developers.yubico.com/PGP).
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/yubikey-5-overview){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -69,7 +69,7 @@ The [comparison table](https://yubico.com/store/compare) shows how the YubiKeys
|
||||
|
||||
YubiKeys can be programmed using the [YubiKey Manager](https://yubico.com/support/download/yubikey-manager) or [YubiKey Personalization Tools](https://yubico.com/support/download/yubikey-personalization-tools). For managing TOTP codes, you can use the [Yubico Authenticator](https://yubico.com/products/yubico-authenticator). All of Yubico's clients are open source.
|
||||
|
||||
For models which support HOTP and TOTP, there are 2 slots in the OTP interface which could be used for HOTP and 32 slots to store TOTP secrets. These secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
For models which [support HOTP and TOTP](https://support.yubico.com/hc/articles/360013790319-How-many-accounts-can-I-register-my-YubiKey-with), the secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
@@ -86,7 +86,7 @@ The firmware of YubiKey is not updatable. If you want features in newer firmware
|
||||
{ width="300" }
|
||||
</figure>
|
||||
|
||||
The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://www.nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification). The Nitrokey 3 Series in general has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), Personal Identity Verification (PIV), OpenPGP, and TOTP and HOTP authentication.
|
||||
**Nitrokey** has a cost-effective security key capable of FIDO2/WebAuthn and FIDO U2F called the **Nitrokey Passkey**. For support for features such as PIV, OpenPGP, and TOTP and HOTP authentication, you need to purchase one of their other keys like the **Nitrokey 3**. Currently, only the **Nitrokey 3A Mini** has [FIDO Level 1 Certification](https://nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification).
|
||||
|
||||
[:octicons-home-16: Homepage](https://nitrokey.com){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://nitrokey.com/data-privacy-policy){ .card-link title="Privacy Policy" }
|
||||
@@ -96,26 +96,14 @@ The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://
|
||||
|
||||
</div>
|
||||
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys) shows how the different Nitrokey models compare to each other in terms of features and other specifications.
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys#:~:text=The%20Nitrokey%20Family) shows how the different Nitrokey models compare to each other in terms of features and other specifications. Refer to Nitrokey's [documentation](https://docs.nitrokey.com/nitrokeys/features) for more details about the features available on your Nitrokey.
|
||||
|
||||
Nitrokey models can be configured using the [Nitrokey app](https://nitrokey.com/download).
|
||||
|
||||
The Nitrokey 3 Series can act as a password manager. They can store up to 50 different entries, and each entry can contain login, password, comment and OTP.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Excluding the Nitrokey 3, Nitrokeys with HOTP and TOTP storage do not have it encrypted, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
**Nitrokey** also has the **Nitrokey Passkey**, a lower-price security key capable of [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online). This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- Password Manager
|
||||
- PIV
|
||||
- OpenPGP
|
||||
- Tamper-resistant smart card
|
||||
- TOTP and HOTP
|
||||
Excluding the Nitrokey 3, Nitrokeys which support HOTP and TOTP do not have encrypted storage, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: "Authentification Multi-Facteurs"
|
||||
icon: 'material/two-factor-authentication'
|
||||
title: Authentification Multi-Facteurs
|
||||
icon: material/two-factor-authentication
|
||||
description: MFA est un mécanisme de sécurité essentiel pour sécuriser vos comptes en ligne, mais certaines méthodes sont plus efficaces que d'autres.
|
||||
---
|
||||
|
||||
@@ -64,7 +64,7 @@ Si votre modèle de menace exige que vous ayez des identités différentes sur d
|
||||
|
||||
#### FIDO (Fast IDentity Online)
|
||||
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) comprend un certain nombre de normes, d'abord l'U2F puis, plus tard, la [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) qui comprend la norme Web [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was [U2F](https://en.wikipedia.org/wiki/Universal_2nd_Factor) and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) which includes the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
|
||||
U2F et FIDO2 font référence au [Protocole client à authentificateur](https://en.wikipedia.org/wiki/Client_to_Authenticator_Protocol), qui est le protocole entre la clé de sécurité et l'ordinateur, comme un ordinateur portable ou un téléphone. Il complète WebAuthn qui est le composant utilisé pour s'authentifier avec le site Web (la « partie utilisatrice ») sur lequel vous essayez de vous connecter.
|
||||
|
||||
|
||||
@@ -96,7 +96,7 @@ Tresorit est également certifié par le Digital Trust Label, délivrée par la
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Peergos** est un protocole décentralisé et une plateforme open-source pour le stockage, les réseaux sociaux et les applications. Peergos fournit un espace privé et sécurisé où les utilisateurs peuvent stocker, partager, et consulter leurs photos, vidéos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
**Peergos** est un protocole décentralisé et une plateforme open-source pour le stockage, les réseaux sociaux et les applications. It provides a secure and private space where users can store, share, view and edit their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
|
||||
[:octicons-home-16: Page d'Accueil](https://peergos.org){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://peergos.net/privacy.html){ .card-link title="Politique de Confidentialité" }
|
||||
@@ -105,13 +105,13 @@ Tresorit est également certifié par le Digital Trust Label, délivrée par la
|
||||
[:octicons-heart-16:](https://github.com/peergos/peergos#support){ .card-link title="Contribuer" }
|
||||
|
||||
<details class="downloads" markdown>
|
||||
<summary>Téléchargement</summary>
|
||||
<summary>Downloads</summary>
|
||||
|
||||
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=peergos.android)
|
||||
- [:simple-github: GitHub](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-apple: macOS](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-linux: Linux](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://peergos.org/download#windows)
|
||||
- [:simple-apple: macOS](https://peergos.org/download#macos)
|
||||
- [:simple-linux: Linux](https://peergos.org/download#linux)
|
||||
- [:octicons-browser-16: Web](https://peergos.net)
|
||||
|
||||
</details>
|
||||
@@ -120,9 +120,7 @@ Tresorit est également certifié par le Digital Trust Label, délivrée par la
|
||||
|
||||
Peergos fonctionne avec le [système de fichier interplanétaire (InterPlanetary File System ou IPFS)](https://ipfs.tech), un protocole pair à pair qui permet de contourner la [:material-close-outline: Censure](basics/common-threats.md#avoiding-censorship ""){.pg-blue-gray}.
|
||||
|
||||
Peergos est avant tout une application web, mais vous pouvez héberger vous-même le serveur, soit en tant que cache local pour votre compte Peergos distant, soit en tant que serveur de stockage autonome, ce qui vous évite d'avoir à vous inscrire pour un compte et payer un abonnement. Le serveur Peergos est un fichier `.jar`, ce que signifie que l'environnement d'éxecution Java 17+ ([télécharger OpenJDK](https://azul.com/downloads)) doit être installé sur votre machine pour le faire fonctionner.
|
||||
|
||||
L'exécution d'une version locale de Peergos parallèlement à un compte enregistré sur leur service hébergé payant vous permet d'accéder à votre stockage Peergos sans dépendre d'un DNS ou des autorités de certification TLS, et de conserver une copie de vos données sauvegardées dans leur cloud. L'expérience utilisateur est à peu près la même, que vous utilisiez leur serveur de bureau ou leur interface web hébergée.
|
||||
Peergos has a web app, desktop apps and an Android app and you can also self-host the server. Client, server and command line interface all run from the same binary. There is a sync engine included (accessible via the desktop or android apps) for bi-directionally synchronizing a local folder with a Peergos folder, and a webdav bridge to allow other applications to access your Peergos storage.
|
||||
|
||||
Peergos a été [auditionné](https://peergos.org/posts/security-audit-2024) en novembre 2024 par Radically Open Security et tous les problèmes ont été corrigés. Ils ont été précédemment [auditionnés](https://cure53.de/pentest-report_peergos.pdf) par Cure53 en juin 2019, à la suite de quoi tous les problèmes trouvés ont été résolus.
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
title: "Clés de sécurité"
|
||||
title: Clés de sécurité
|
||||
icon: material/key-chain
|
||||
description: These security keys provide a form of phishing-immune authentication for accounts that support it.
|
||||
cover: multi-factor-authentication.webp
|
||||
@@ -10,7 +10,7 @@ cover: multi-factor-authentication.webp
|
||||
- [:material-target-account: Targeted Attacks](basics/common-threats.md#attacks-against-specific-individuals){ .pg-red }
|
||||
- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange }
|
||||
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the FIDO2 security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the [FIDO2](basics/multi-factor-authentication.md#fido-fast-identity-online) security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
|
||||
## Yubico Security Key
|
||||
|
||||
@@ -20,7 +20,7 @@ A physical **security key** adds a very strong layer of protection to your onlin
|
||||
{ width="315" }
|
||||
</figure>
|
||||
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO U2F, and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO Universal 2nd Factor (U2F), and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/security-key){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -35,10 +35,10 @@ These keys are available in both USB-C and USB-A variants, and both options supp
|
||||
This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- [Yubico Authenticator](https://yubico.com/products/yubico-authenticator)
|
||||
- CCID Smart Card support (PIV-compatibile)
|
||||
- CCID Smart Card support (PIV-compatible)
|
||||
- OpenPGP
|
||||
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) of products instead.
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) series instead.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Avertissement</p>
|
||||
@@ -55,7 +55,7 @@ The firmware of Yubico's Security Keys is not updatable. If you want features in
|
||||
{ width="400" }
|
||||
</figure>
|
||||
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The YubiKey 5 Series has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), [Yubico OTP](basics/multi-factor-authentication.md#yubico-otp), [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), [OpenPGP](https://developers.yubico.com/PGP), and [TOTP and HOTP](https://developers.yubico.com/OATH) authentication.
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The **YubiKey 5 Series** has a wide range of features such as FIDO2/WebAuthn and FIDO U2F, [TOTP and HOTP](https://developers.yubico.com/OATH) authentication, [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), and [OpenPGP](https://developers.yubico.com/PGP).
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/yubikey-5-overview){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -69,7 +69,7 @@ The [comparison table](https://yubico.com/store/compare) shows how the YubiKeys
|
||||
|
||||
YubiKeys can be programmed using the [YubiKey Manager](https://yubico.com/support/download/yubikey-manager) or [YubiKey Personalization Tools](https://yubico.com/support/download/yubikey-personalization-tools). For managing TOTP codes, you can use the [Yubico Authenticator](https://yubico.com/products/yubico-authenticator). All of Yubico's clients are open source.
|
||||
|
||||
For models which support HOTP and TOTP, there are 2 slots in the OTP interface which could be used for HOTP and 32 slots to store TOTP secrets. These secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
For models which [support HOTP and TOTP](https://support.yubico.com/hc/articles/360013790319-How-many-accounts-can-I-register-my-YubiKey-with), the secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Avertissement</p>
|
||||
@@ -86,7 +86,7 @@ The firmware of YubiKey is not updatable. If you want features in newer firmware
|
||||
{ width="300" }
|
||||
</figure>
|
||||
|
||||
The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://www.nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification). The Nitrokey 3 Series in general has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), Personal Identity Verification (PIV), OpenPGP, and TOTP and HOTP authentication.
|
||||
**Nitrokey** has a cost-effective security key capable of FIDO2/WebAuthn and FIDO U2F called the **Nitrokey Passkey**. For support for features such as PIV, OpenPGP, and TOTP and HOTP authentication, you need to purchase one of their other keys like the **Nitrokey 3**. Currently, only the **Nitrokey 3A Mini** has [FIDO Level 1 Certification](https://nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification).
|
||||
|
||||
[:octicons-home-16: Homepage](https://nitrokey.com){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://nitrokey.com/data-privacy-policy){ .card-link title="Privacy Policy" }
|
||||
@@ -96,26 +96,14 @@ The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://
|
||||
|
||||
</div>
|
||||
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys) shows how the different Nitrokey models compare to each other in terms of features and other specifications.
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys#:~:text=The%20Nitrokey%20Family) shows how the different Nitrokey models compare to each other in terms of features and other specifications. Refer to Nitrokey's [documentation](https://docs.nitrokey.com/nitrokeys/features) for more details about the features available on your Nitrokey.
|
||||
|
||||
Nitrokey models can be configured using the [Nitrokey app](https://nitrokey.com/download).
|
||||
|
||||
The Nitrokey 3 Series can act as a password manager. They can store up to 50 different entries, and each entry can contain login, password, comment and OTP.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Avertissement</p>
|
||||
|
||||
Excluding the Nitrokey 3, Nitrokeys with HOTP and TOTP storage do not have it encrypted, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
**Nitrokey** also has the **Nitrokey Passkey**, a lower-price security key capable of [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online). This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- Gestionnaire de mots de passe
|
||||
- PIV
|
||||
- OpenPGP
|
||||
- Tamper-resistant smart card
|
||||
- TOTP and HOTP
|
||||
Excluding the Nitrokey 3, Nitrokeys which support HOTP and TOTP do not have encrypted storage, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: "Multifactor Authentication"
|
||||
icon: 'material/two-factor-authentication'
|
||||
title: Multifactor Authentication
|
||||
icon: material/two-factor-authentication
|
||||
description: MFA הוא מנגנון אבטחה קריטי לאבטחת החשבונות המקוונים שלך, אך שיטות מסוימות חזקות יותר מאחרות.
|
||||
---
|
||||
|
||||
@@ -64,7 +64,7 @@ Yubico OTP הוא פרוטוקול אימות המיושם בדרך כלל במ
|
||||
|
||||
#### FIDO (זיהוי מהיר באינטרנט)
|
||||
|
||||
אם מודל האיומים שלך דורש ממך זהויות שונות באתרים שונים, חזק **אל תשתמש **ב- Yubico OTP עם אותו מפתח אבטחת חומרה באתרים אלה מכיוון שמזהה ציבורי הוא ייחודי לכל מפתח אבטחה.
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was [U2F](https://en.wikipedia.org/wiki/Universal_2nd_Factor) and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) which includes the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
|
||||
U2F ו - FIDO2 מתייחסים ל - [Client to Authenticator Protocol](https://en.wikipedia.org/wiki/Client_to_Authenticator_Protocol), שהוא הפרוטוקול בין מפתח האבטחה למחשב, כגון מחשב נייד או טלפון. זה משלים את WebAuthn שהוא הרכיב המשמש לאימות עם האתר ("הצד המסתמך") שאליו אתה מנסה להיכנס.
|
||||
|
||||
|
||||
@@ -96,7 +96,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, and view their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, view and edit their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
|
||||
[:octicons-home-16: Homepage](https://peergos.org){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://peergos.net/privacy.html){ .card-link title="Privacy Policy" }
|
||||
@@ -109,9 +109,9 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=peergos.android)
|
||||
- [:simple-github: GitHub](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-apple: macOS](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-linux: Linux](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://peergos.org/download#windows)
|
||||
- [:simple-apple: macOS](https://peergos.org/download#macos)
|
||||
- [:simple-linux: Linux](https://peergos.org/download#linux)
|
||||
- [:octicons-browser-16: Web](https://peergos.net)
|
||||
|
||||
</details>
|
||||
@@ -120,9 +120,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
Peergos is built on top of the [InterPlanetary File System (IPFS)](https://ipfs.tech), a peer-to-peer architecture that protects against [:material-close-outline: Censorship](basics/common-threats.md#avoiding-censorship ""){.pg-blue-gray}.
|
||||
|
||||
Peergos is primarily a web app, but you can self-host the server either as a local cache for your remote Peergos account, or as a standalone storage server which negates the need to register for a remote account and subscription. The Peergos server is a `.jar` file, which means the Java 17+ Runtime Environment ([OpenJDK download](https://azul.com/downloads)) should be installed on your machine to get it working.
|
||||
|
||||
Running a local version of Peergos alongside a registered account on their paid, hosted service allows you to access your Peergos storage without any reliance on DNS or TLS certificate authorities, and keep a copy of your data backed up to their cloud. The user experience should be the same whether you run their desktop server or just use their hosted web interface.
|
||||
Peergos has a web app, desktop apps and an Android app and you can also self-host the server. Client, server and command line interface all run from the same binary. There is a sync engine included (accessible via the desktop or android apps) for bi-directionally synchronizing a local folder with a Peergos folder, and a webdav bridge to allow other applications to access your Peergos storage.
|
||||
|
||||
Peergos was [audited](https://peergos.org/posts/security-audit-2024) in November 2024 by Radically Open Security and all issues were fixed. They were previously [audited](https://cure53.de/pentest-report_peergos.pdf) by Cure53 in June 2019, and all found issues were subsequently fixed.
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
title: "Security Keys"
|
||||
title: Security Keys
|
||||
icon: material/key-chain
|
||||
description: These security keys provide a form of phishing-immune authentication for accounts that support it.
|
||||
cover: multi-factor-authentication.webp
|
||||
@@ -10,7 +10,7 @@ cover: multi-factor-authentication.webp
|
||||
- [:material-target-account: Targeted Attacks](basics/common-threats.md#attacks-against-specific-individuals){ .pg-red }
|
||||
- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange }
|
||||
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the FIDO2 security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the [FIDO2](basics/multi-factor-authentication.md#fido-fast-identity-online) security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
|
||||
## Yubico Security Key
|
||||
|
||||
@@ -20,7 +20,7 @@ A physical **security key** adds a very strong layer of protection to your onlin
|
||||
{ width="315" }
|
||||
</figure>
|
||||
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO U2F, and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO Universal 2nd Factor (U2F), and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/security-key){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -35,10 +35,10 @@ These keys are available in both USB-C and USB-A variants, and both options supp
|
||||
This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- [Yubico Authenticator](https://yubico.com/products/yubico-authenticator)
|
||||
- CCID Smart Card support (PIV-compatibile)
|
||||
- CCID Smart Card support (PIV-compatible)
|
||||
- OpenPGP
|
||||
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) of products instead.
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) series instead.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
@@ -55,7 +55,7 @@ The firmware of Yubico's Security Keys is not updatable. If you want features in
|
||||
{ width="400" }
|
||||
</figure>
|
||||
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The YubiKey 5 Series has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), [Yubico OTP](basics/multi-factor-authentication.md#yubico-otp), [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), [OpenPGP](https://developers.yubico.com/PGP), and [TOTP and HOTP](https://developers.yubico.com/OATH) authentication.
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The **YubiKey 5 Series** has a wide range of features such as FIDO2/WebAuthn and FIDO U2F, [TOTP and HOTP](https://developers.yubico.com/OATH) authentication, [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), and [OpenPGP](https://developers.yubico.com/PGP).
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/yubikey-5-overview){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -69,7 +69,7 @@ The [comparison table](https://yubico.com/store/compare) shows how the YubiKeys
|
||||
|
||||
YubiKeys can be programmed using the [YubiKey Manager](https://yubico.com/support/download/yubikey-manager) or [YubiKey Personalization Tools](https://yubico.com/support/download/yubikey-personalization-tools). For managing TOTP codes, you can use the [Yubico Authenticator](https://yubico.com/products/yubico-authenticator). All of Yubico's clients are open source.
|
||||
|
||||
For models which support HOTP and TOTP, there are 2 slots in the OTP interface which could be used for HOTP and 32 slots to store TOTP secrets. These secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
For models which [support HOTP and TOTP](https://support.yubico.com/hc/articles/360013790319-How-many-accounts-can-I-register-my-YubiKey-with), the secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
@@ -86,7 +86,7 @@ The firmware of YubiKey is not updatable. If you want features in newer firmware
|
||||
{ width="300" }
|
||||
</figure>
|
||||
|
||||
The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://www.nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification). The Nitrokey 3 Series in general has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), Personal Identity Verification (PIV), OpenPGP, and TOTP and HOTP authentication.
|
||||
**Nitrokey** has a cost-effective security key capable of FIDO2/WebAuthn and FIDO U2F called the **Nitrokey Passkey**. For support for features such as PIV, OpenPGP, and TOTP and HOTP authentication, you need to purchase one of their other keys like the **Nitrokey 3**. Currently, only the **Nitrokey 3A Mini** has [FIDO Level 1 Certification](https://nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification).
|
||||
|
||||
[:octicons-home-16: Homepage](https://nitrokey.com){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://nitrokey.com/data-privacy-policy){ .card-link title="Privacy Policy" }
|
||||
@@ -96,26 +96,14 @@ The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://
|
||||
|
||||
</div>
|
||||
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys) shows how the different Nitrokey models compare to each other in terms of features and other specifications.
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys#:~:text=The%20Nitrokey%20Family) shows how the different Nitrokey models compare to each other in terms of features and other specifications. Refer to Nitrokey's [documentation](https://docs.nitrokey.com/nitrokeys/features) for more details about the features available on your Nitrokey.
|
||||
|
||||
Nitrokey models can be configured using the [Nitrokey app](https://nitrokey.com/download).
|
||||
|
||||
The Nitrokey 3 Series can act as a password manager. They can store up to 50 different entries, and each entry can contain login, password, comment and OTP.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Excluding the Nitrokey 3, Nitrokeys with HOTP and TOTP storage do not have it encrypted, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
**Nitrokey** also has the **Nitrokey Passkey**, a lower-price security key capable of [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online). This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- מנהל הסיסמאות
|
||||
- PIV
|
||||
- OpenPGP
|
||||
- Tamper-resistant smart card
|
||||
- TOTP and HOTP
|
||||
Excluding the Nitrokey 3, Nitrokeys which support HOTP and TOTP do not have encrypted storage, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: "Multifactor Authentication"
|
||||
icon: 'material/two-factor-authentication'
|
||||
title: Multifactor Authentication
|
||||
icon: material/two-factor-authentication
|
||||
description: MFA is a critical security mechanism for securing your online accounts, but some methods are stronger than others.
|
||||
---
|
||||
|
||||
@@ -64,7 +64,7 @@ If your threat model requires you to have different identities on different webs
|
||||
|
||||
#### FIDO (Fast IDentity Online)
|
||||
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was U2F and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) which includes the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was [U2F](https://en.wikipedia.org/wiki/Universal_2nd_Factor) and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) which includes the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
|
||||
U2F and FIDO2 refer to the [Client to Authenticator Protocol](https://en.wikipedia.org/wiki/Client_to_Authenticator_Protocol), which is the protocol between the security key and the computer, such as a laptop or phone. It complements WebAuthn which is the component used to authenticate with the website (the "Relying Party") you're trying to log in on.
|
||||
|
||||
|
||||
@@ -96,7 +96,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, and view their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, view and edit their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
|
||||
[:octicons-home-16: Homepage](https://peergos.org){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://peergos.net/privacy.html){ .card-link title="Privacy Policy" }
|
||||
@@ -109,9 +109,9 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=peergos.android)
|
||||
- [:simple-github: GitHub](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-apple: macOS](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-linux: Linux](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://peergos.org/download#windows)
|
||||
- [:simple-apple: macOS](https://peergos.org/download#macos)
|
||||
- [:simple-linux: Linux](https://peergos.org/download#linux)
|
||||
- [:octicons-browser-16: Web](https://peergos.net)
|
||||
|
||||
</details>
|
||||
@@ -120,9 +120,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
Peergos is built on top of the [InterPlanetary File System (IPFS)](https://ipfs.tech), a peer-to-peer architecture that protects against [:material-close-outline: Censorship](basics/common-threats.md#avoiding-censorship ""){.pg-blue-gray}.
|
||||
|
||||
Peergos is primarily a web app, but you can self-host the server either as a local cache for your remote Peergos account, or as a standalone storage server which negates the need to register for a remote account and subscription. The Peergos server is a `.jar` file, which means the Java 17+ Runtime Environment ([OpenJDK download](https://azul.com/downloads)) should be installed on your machine to get it working.
|
||||
|
||||
Running a local version of Peergos alongside a registered account on their paid, hosted service allows you to access your Peergos storage without any reliance on DNS or TLS certificate authorities, and keep a copy of your data backed up to their cloud. The user experience should be the same whether you run their desktop server or just use their hosted web interface.
|
||||
Peergos has a web app, desktop apps and an Android app and you can also self-host the server. Client, server and command line interface all run from the same binary. There is a sync engine included (accessible via the desktop or android apps) for bi-directionally synchronizing a local folder with a Peergos folder, and a webdav bridge to allow other applications to access your Peergos storage.
|
||||
|
||||
Peergos was [audited](https://peergos.org/posts/security-audit-2024) in November 2024 by Radically Open Security and all issues were fixed. They were previously [audited](https://cure53.de/pentest-report_peergos.pdf) by Cure53 in June 2019, and all found issues were subsequently fixed.
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
title: "Security Keys"
|
||||
title: Security Keys
|
||||
icon: material/key-chain
|
||||
description: These security keys provide a form of phishing-immune authentication for accounts that support it.
|
||||
cover: multi-factor-authentication.webp
|
||||
@@ -10,7 +10,7 @@ cover: multi-factor-authentication.webp
|
||||
- [:material-target-account: Targeted Attacks](basics/common-threats.md#attacks-against-specific-individuals){ .pg-red }
|
||||
- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange }
|
||||
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the FIDO2 security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the [FIDO2](basics/multi-factor-authentication.md#fido-fast-identity-online) security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
|
||||
## Yubico Security Key
|
||||
|
||||
@@ -20,7 +20,7 @@ A physical **security key** adds a very strong layer of protection to your onlin
|
||||
{ width="315" }
|
||||
</figure>
|
||||
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO U2F, and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO Universal 2nd Factor (U2F), and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/security-key){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -35,10 +35,10 @@ These keys are available in both USB-C and USB-A variants, and both options supp
|
||||
This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- [Yubico Authenticator](https://yubico.com/products/yubico-authenticator)
|
||||
- CCID Smart Card support (PIV-compatibile)
|
||||
- CCID Smart Card support (PIV-compatible)
|
||||
- OpenPGP
|
||||
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) of products instead.
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) series instead.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
@@ -55,7 +55,7 @@ The firmware of Yubico's Security Keys is not updatable. If you want features in
|
||||
{ width="400" }
|
||||
</figure>
|
||||
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The YubiKey 5 Series has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), [Yubico OTP](basics/multi-factor-authentication.md#yubico-otp), [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), [OpenPGP](https://developers.yubico.com/PGP), and [TOTP and HOTP](https://developers.yubico.com/OATH) authentication.
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The **YubiKey 5 Series** has a wide range of features such as FIDO2/WebAuthn and FIDO U2F, [TOTP and HOTP](https://developers.yubico.com/OATH) authentication, [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), and [OpenPGP](https://developers.yubico.com/PGP).
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/yubikey-5-overview){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -69,7 +69,7 @@ The [comparison table](https://yubico.com/store/compare) shows how the YubiKeys
|
||||
|
||||
YubiKeys can be programmed using the [YubiKey Manager](https://yubico.com/support/download/yubikey-manager) or [YubiKey Personalization Tools](https://yubico.com/support/download/yubikey-personalization-tools). For managing TOTP codes, you can use the [Yubico Authenticator](https://yubico.com/products/yubico-authenticator). All of Yubico's clients are open source.
|
||||
|
||||
For models which support HOTP and TOTP, there are 2 slots in the OTP interface which could be used for HOTP and 32 slots to store TOTP secrets. These secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
For models which [support HOTP and TOTP](https://support.yubico.com/hc/articles/360013790319-How-many-accounts-can-I-register-my-YubiKey-with), the secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
@@ -86,7 +86,7 @@ The firmware of YubiKey is not updatable. If you want features in newer firmware
|
||||
{ width="300" }
|
||||
</figure>
|
||||
|
||||
The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://www.nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification). The Nitrokey 3 Series in general has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), Personal Identity Verification (PIV), OpenPGP, and TOTP and HOTP authentication.
|
||||
**Nitrokey** has a cost-effective security key capable of FIDO2/WebAuthn and FIDO U2F called the **Nitrokey Passkey**. For support for features such as PIV, OpenPGP, and TOTP and HOTP authentication, you need to purchase one of their other keys like the **Nitrokey 3**. Currently, only the **Nitrokey 3A Mini** has [FIDO Level 1 Certification](https://nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification).
|
||||
|
||||
[:octicons-home-16: Homepage](https://nitrokey.com){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://nitrokey.com/data-privacy-policy){ .card-link title="Privacy Policy" }
|
||||
@@ -96,26 +96,14 @@ The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://
|
||||
|
||||
</div>
|
||||
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys) shows how the different Nitrokey models compare to each other in terms of features and other specifications.
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys#:~:text=The%20Nitrokey%20Family) shows how the different Nitrokey models compare to each other in terms of features and other specifications. Refer to Nitrokey's [documentation](https://docs.nitrokey.com/nitrokeys/features) for more details about the features available on your Nitrokey.
|
||||
|
||||
Nitrokey models can be configured using the [Nitrokey app](https://nitrokey.com/download).
|
||||
|
||||
The Nitrokey 3 Series can act as a password manager. They can store up to 50 different entries, and each entry can contain login, password, comment and OTP.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Excluding the Nitrokey 3, Nitrokeys with HOTP and TOTP storage do not have it encrypted, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
**Nitrokey** also has the **Nitrokey Passkey**, a lower-price security key capable of [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online). This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- Password Manager
|
||||
- PIV
|
||||
- OpenPGP
|
||||
- Tamper-resistant smart card
|
||||
- TOTP and HOTP
|
||||
Excluding the Nitrokey 3, Nitrokeys which support HOTP and TOTP do not have encrypted storage, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: "Multifactor Authentication"
|
||||
icon: 'material/two-factor-authentication'
|
||||
title: Multifactor Authentication
|
||||
icon: material/two-factor-authentication
|
||||
description: MFA is a critical security mechanism for securing your online accounts, but some methods are stronger than others.
|
||||
---
|
||||
|
||||
@@ -64,7 +64,7 @@ If your threat model requires you to have different identities on different webs
|
||||
|
||||
#### FIDO (Fast IDentity Online)
|
||||
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was U2F and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) which includes the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was [U2F](https://en.wikipedia.org/wiki/Universal_2nd_Factor) and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) which includes the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
|
||||
U2F and FIDO2 refer to the [Client to Authenticator Protocol](https://en.wikipedia.org/wiki/Client_to_Authenticator_Protocol), which is the protocol between the security key and the computer, such as a laptop or phone. It complements WebAuthn which is the component used to authenticate with the website (the "Relying Party") you're trying to log in on.
|
||||
|
||||
|
||||
@@ -96,7 +96,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, and view their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, view and edit their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
|
||||
[:octicons-home-16: Homepage](https://peergos.org){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://peergos.net/privacy.html){ .card-link title="Privacy Policy" }
|
||||
@@ -109,9 +109,9 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=peergos.android)
|
||||
- [:simple-github: GitHub](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-apple: macOS](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-linux: Linux](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://peergos.org/download#windows)
|
||||
- [:simple-apple: macOS](https://peergos.org/download#macos)
|
||||
- [:simple-linux: Linux](https://peergos.org/download#linux)
|
||||
- [:octicons-browser-16: Web](https://peergos.net)
|
||||
|
||||
</details>
|
||||
@@ -120,9 +120,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
Peergos is built on top of the [InterPlanetary File System (IPFS)](https://ipfs.tech), a peer-to-peer architecture that protects against [:material-close-outline: Censorship](basics/common-threats.md#avoiding-censorship ""){.pg-blue-gray}.
|
||||
|
||||
Peergos is primarily a web app, but you can self-host the server either as a local cache for your remote Peergos account, or as a standalone storage server which negates the need to register for a remote account and subscription. The Peergos server is a `.jar` file, which means the Java 17+ Runtime Environment ([OpenJDK download](https://azul.com/downloads)) should be installed on your machine to get it working.
|
||||
|
||||
Running a local version of Peergos alongside a registered account on their paid, hosted service allows you to access your Peergos storage without any reliance on DNS or TLS certificate authorities, and keep a copy of your data backed up to their cloud. The user experience should be the same whether you run their desktop server or just use their hosted web interface.
|
||||
Peergos has a web app, desktop apps and an Android app and you can also self-host the server. Client, server and command line interface all run from the same binary. There is a sync engine included (accessible via the desktop or android apps) for bi-directionally synchronizing a local folder with a Peergos folder, and a webdav bridge to allow other applications to access your Peergos storage.
|
||||
|
||||
Peergos was [audited](https://peergos.org/posts/security-audit-2024) in November 2024 by Radically Open Security and all issues were fixed. They were previously [audited](https://cure53.de/pentest-report_peergos.pdf) by Cure53 in June 2019, and all found issues were subsequently fixed.
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
title: "Security Keys"
|
||||
title: Security Keys
|
||||
icon: material/key-chain
|
||||
description: These security keys provide a form of phishing-immune authentication for accounts that support it.
|
||||
cover: multi-factor-authentication.webp
|
||||
@@ -10,7 +10,7 @@ cover: multi-factor-authentication.webp
|
||||
- [:material-target-account: Targeted Attacks](basics/common-threats.md#attacks-against-specific-individuals){ .pg-red }
|
||||
- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange }
|
||||
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the FIDO2 security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the [FIDO2](basics/multi-factor-authentication.md#fido-fast-identity-online) security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
|
||||
## Yubico Security Key
|
||||
|
||||
@@ -20,7 +20,7 @@ A physical **security key** adds a very strong layer of protection to your onlin
|
||||
{ width="315" }
|
||||
</figure>
|
||||
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO U2F, and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO Universal 2nd Factor (U2F), and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/security-key){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -35,10 +35,10 @@ These keys are available in both USB-C and USB-A variants, and both options supp
|
||||
This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- [Yubico Authenticator](https://yubico.com/products/yubico-authenticator)
|
||||
- CCID Smart Card support (PIV-compatibile)
|
||||
- CCID Smart Card support (PIV-compatible)
|
||||
- OpenPGP
|
||||
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) of products instead.
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) series instead.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Figyelmeztetés</p>
|
||||
@@ -55,7 +55,7 @@ The firmware of Yubico's Security Keys is not updatable. If you want features in
|
||||
{ width="400" }
|
||||
</figure>
|
||||
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The YubiKey 5 Series has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), [Yubico OTP](basics/multi-factor-authentication.md#yubico-otp), [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), [OpenPGP](https://developers.yubico.com/PGP), and [TOTP and HOTP](https://developers.yubico.com/OATH) authentication.
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The **YubiKey 5 Series** has a wide range of features such as FIDO2/WebAuthn and FIDO U2F, [TOTP and HOTP](https://developers.yubico.com/OATH) authentication, [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), and [OpenPGP](https://developers.yubico.com/PGP).
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/yubikey-5-overview){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -69,7 +69,7 @@ The [comparison table](https://yubico.com/store/compare) shows how the YubiKeys
|
||||
|
||||
YubiKeys can be programmed using the [YubiKey Manager](https://yubico.com/support/download/yubikey-manager) or [YubiKey Personalization Tools](https://yubico.com/support/download/yubikey-personalization-tools). For managing TOTP codes, you can use the [Yubico Authenticator](https://yubico.com/products/yubico-authenticator). All of Yubico's clients are open source.
|
||||
|
||||
For models which support HOTP and TOTP, there are 2 slots in the OTP interface which could be used for HOTP and 32 slots to store TOTP secrets. These secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
For models which [support HOTP and TOTP](https://support.yubico.com/hc/articles/360013790319-How-many-accounts-can-I-register-my-YubiKey-with), the secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Figyelmeztetés</p>
|
||||
@@ -86,7 +86,7 @@ The firmware of YubiKey is not updatable. If you want features in newer firmware
|
||||
{ width="300" }
|
||||
</figure>
|
||||
|
||||
The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://www.nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification). The Nitrokey 3 Series in general has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), Personal Identity Verification (PIV), OpenPGP, and TOTP and HOTP authentication.
|
||||
**Nitrokey** has a cost-effective security key capable of FIDO2/WebAuthn and FIDO U2F called the **Nitrokey Passkey**. For support for features such as PIV, OpenPGP, and TOTP and HOTP authentication, you need to purchase one of their other keys like the **Nitrokey 3**. Currently, only the **Nitrokey 3A Mini** has [FIDO Level 1 Certification](https://nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification).
|
||||
|
||||
[:octicons-home-16: Homepage](https://nitrokey.com){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://nitrokey.com/data-privacy-policy){ .card-link title="Privacy Policy" }
|
||||
@@ -96,26 +96,14 @@ The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://
|
||||
|
||||
</div>
|
||||
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys) shows how the different Nitrokey models compare to each other in terms of features and other specifications.
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys#:~:text=The%20Nitrokey%20Family) shows how the different Nitrokey models compare to each other in terms of features and other specifications. Refer to Nitrokey's [documentation](https://docs.nitrokey.com/nitrokeys/features) for more details about the features available on your Nitrokey.
|
||||
|
||||
Nitrokey models can be configured using the [Nitrokey app](https://nitrokey.com/download).
|
||||
|
||||
The Nitrokey 3 Series can act as a password manager. They can store up to 50 different entries, and each entry can contain login, password, comment and OTP.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Figyelmeztetés</p>
|
||||
|
||||
Excluding the Nitrokey 3, Nitrokeys with HOTP and TOTP storage do not have it encrypted, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
**Nitrokey** also has the **Nitrokey Passkey**, a lower-price security key capable of [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online). This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- Password Manager
|
||||
- PIV
|
||||
- OpenPGP
|
||||
- Tamper-resistant smart card
|
||||
- TOTP and HOTP
|
||||
Excluding the Nitrokey 3, Nitrokeys which support HOTP and TOTP do not have encrypted storage, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: "Multifactor Authentication"
|
||||
icon: 'material/two-factor-authentication'
|
||||
title: Multifactor Authentication
|
||||
icon: material/two-factor-authentication
|
||||
description: MFA adalah mekanisme keamanan penting untuk mengamankan akun daring Anda, tetapi beberapa metode lebih kuat daripada yang lain.
|
||||
---
|
||||
|
||||
@@ -64,7 +64,7 @@ If your threat model requires you to have different identities on different webs
|
||||
|
||||
#### FIDO (Fast IDentity Online)
|
||||
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was U2F and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) which includes the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was [U2F](https://en.wikipedia.org/wiki/Universal_2nd_Factor) and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) which includes the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
|
||||
U2F and FIDO2 refer to the [Client to Authenticator Protocol](https://en.wikipedia.org/wiki/Client_to_Authenticator_Protocol), which is the protocol between the security key and the computer, such as a laptop or phone. It complements WebAuthn which is the component used to authenticate with the website (the "Relying Party") you're trying to log in on.
|
||||
|
||||
|
||||
@@ -96,7 +96,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, and view their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, view and edit their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
|
||||
[:octicons-home-16: Homepage](https://peergos.org){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://peergos.net/privacy.html){ .card-link title="Privacy Policy" }
|
||||
@@ -109,9 +109,9 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=peergos.android)
|
||||
- [:simple-github: GitHub](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-apple: macOS](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-linux: Linux](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://peergos.org/download#windows)
|
||||
- [:simple-apple: macOS](https://peergos.org/download#macos)
|
||||
- [:simple-linux: Linux](https://peergos.org/download#linux)
|
||||
- [:octicons-browser-16: Web](https://peergos.net)
|
||||
|
||||
</details>
|
||||
@@ -120,9 +120,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
Peergos is built on top of the [InterPlanetary File System (IPFS)](https://ipfs.tech), a peer-to-peer architecture that protects against [:material-close-outline: Censorship](basics/common-threats.md#avoiding-censorship ""){.pg-blue-gray}.
|
||||
|
||||
Peergos is primarily a web app, but you can self-host the server either as a local cache for your remote Peergos account, or as a standalone storage server which negates the need to register for a remote account and subscription. The Peergos server is a `.jar` file, which means the Java 17+ Runtime Environment ([OpenJDK download](https://azul.com/downloads)) should be installed on your machine to get it working.
|
||||
|
||||
Running a local version of Peergos alongside a registered account on their paid, hosted service allows you to access your Peergos storage without any reliance on DNS or TLS certificate authorities, and keep a copy of your data backed up to their cloud. The user experience should be the same whether you run their desktop server or just use their hosted web interface.
|
||||
Peergos has a web app, desktop apps and an Android app and you can also self-host the server. Client, server and command line interface all run from the same binary. There is a sync engine included (accessible via the desktop or android apps) for bi-directionally synchronizing a local folder with a Peergos folder, and a webdav bridge to allow other applications to access your Peergos storage.
|
||||
|
||||
Peergos was [audited](https://peergos.org/posts/security-audit-2024) in November 2024 by Radically Open Security and all issues were fixed. They were previously [audited](https://cure53.de/pentest-report_peergos.pdf) by Cure53 in June 2019, and all found issues were subsequently fixed.
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
title: "Security Keys"
|
||||
title: Security Keys
|
||||
icon: material/key-chain
|
||||
description: These security keys provide a form of phishing-immune authentication for accounts that support it.
|
||||
cover: multi-factor-authentication.webp
|
||||
@@ -10,7 +10,7 @@ cover: multi-factor-authentication.webp
|
||||
- [:material-target-account: Targeted Attacks](basics/common-threats.md#attacks-against-specific-individuals){ .pg-red }
|
||||
- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange }
|
||||
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the FIDO2 security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the [FIDO2](basics/multi-factor-authentication.md#fido-fast-identity-online) security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
|
||||
## Yubico Security Key
|
||||
|
||||
@@ -20,7 +20,7 @@ A physical **security key** adds a very strong layer of protection to your onlin
|
||||
{ width="315" }
|
||||
</figure>
|
||||
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO U2F, and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO Universal 2nd Factor (U2F), and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/security-key){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -35,10 +35,10 @@ These keys are available in both USB-C and USB-A variants, and both options supp
|
||||
This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- [Yubico Authenticator](https://yubico.com/products/yubico-authenticator)
|
||||
- CCID Smart Card support (PIV-compatibile)
|
||||
- CCID Smart Card support (PIV-compatible)
|
||||
- OpenPGP
|
||||
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) of products instead.
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) series instead.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
@@ -55,7 +55,7 @@ The firmware of Yubico's Security Keys is not updatable. If you want features in
|
||||
{ width="400" }
|
||||
</figure>
|
||||
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The YubiKey 5 Series has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), [Yubico OTP](basics/multi-factor-authentication.md#yubico-otp), [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), [OpenPGP](https://developers.yubico.com/PGP), and [TOTP and HOTP](https://developers.yubico.com/OATH) authentication.
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The **YubiKey 5 Series** has a wide range of features such as FIDO2/WebAuthn and FIDO U2F, [TOTP and HOTP](https://developers.yubico.com/OATH) authentication, [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), and [OpenPGP](https://developers.yubico.com/PGP).
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/yubikey-5-overview){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -69,7 +69,7 @@ The [comparison table](https://yubico.com/store/compare) shows how the YubiKeys
|
||||
|
||||
YubiKeys can be programmed using the [YubiKey Manager](https://yubico.com/support/download/yubikey-manager) or [YubiKey Personalization Tools](https://yubico.com/support/download/yubikey-personalization-tools). For managing TOTP codes, you can use the [Yubico Authenticator](https://yubico.com/products/yubico-authenticator). All of Yubico's clients are open source.
|
||||
|
||||
For models which support HOTP and TOTP, there are 2 slots in the OTP interface which could be used for HOTP and 32 slots to store TOTP secrets. These secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
For models which [support HOTP and TOTP](https://support.yubico.com/hc/articles/360013790319-How-many-accounts-can-I-register-my-YubiKey-with), the secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
@@ -86,7 +86,7 @@ The firmware of YubiKey is not updatable. If you want features in newer firmware
|
||||
{ width="300" }
|
||||
</figure>
|
||||
|
||||
The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://www.nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification). The Nitrokey 3 Series in general has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), Personal Identity Verification (PIV), OpenPGP, and TOTP and HOTP authentication.
|
||||
**Nitrokey** has a cost-effective security key capable of FIDO2/WebAuthn and FIDO U2F called the **Nitrokey Passkey**. For support for features such as PIV, OpenPGP, and TOTP and HOTP authentication, you need to purchase one of their other keys like the **Nitrokey 3**. Currently, only the **Nitrokey 3A Mini** has [FIDO Level 1 Certification](https://nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification).
|
||||
|
||||
[:octicons-home-16: Homepage](https://nitrokey.com){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://nitrokey.com/data-privacy-policy){ .card-link title="Privacy Policy" }
|
||||
@@ -96,26 +96,14 @@ The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://
|
||||
|
||||
</div>
|
||||
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys) shows how the different Nitrokey models compare to each other in terms of features and other specifications.
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys#:~:text=The%20Nitrokey%20Family) shows how the different Nitrokey models compare to each other in terms of features and other specifications. Refer to Nitrokey's [documentation](https://docs.nitrokey.com/nitrokeys/features) for more details about the features available on your Nitrokey.
|
||||
|
||||
Nitrokey models can be configured using the [Nitrokey app](https://nitrokey.com/download).
|
||||
|
||||
The Nitrokey 3 Series can act as a password manager. They can store up to 50 different entries, and each entry can contain login, password, comment and OTP.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Excluding the Nitrokey 3, Nitrokeys with HOTP and TOTP storage do not have it encrypted, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
**Nitrokey** also has the **Nitrokey Passkey**, a lower-price security key capable of [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online). This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- Pengelola Kata Sandi
|
||||
- PIV
|
||||
- OpenPGP
|
||||
- Tamper-resistant smart card
|
||||
- TOTP and HOTP
|
||||
Excluding the Nitrokey 3, Nitrokeys which support HOTP and TOTP do not have encrypted storage, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: "Autenticazione a più fattori"
|
||||
icon: 'material/two-factor-authentication'
|
||||
title: Autenticazione a più fattori
|
||||
icon: material/two-factor-authentication
|
||||
description: L'AFM è un meccaanismo di sicurezza fondamentale per proteggere i tuoi profili online, ma alcuni metodi sono più efficaci di altri.
|
||||
---
|
||||
|
||||
@@ -64,7 +64,7 @@ Se il tuo modello di minaccia ti richiede di avere identità differenti su siti
|
||||
|
||||
#### FIDO (IDentità Veloce Online)
|
||||
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) include numerosi standard, prima U2F e, in seguito, [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project), che include lo standard web [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was [U2F](https://en.wikipedia.org/wiki/Universal_2nd_Factor) and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) which includes the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
|
||||
U2F e FIDO2 si riferiscono al [Protocollo dal Client all'Autenticatore](https://en.wikipedia.org/wiki/Client_to_Authenticator_Protocol), che è il protocollo tra la chiave di sicurezza e il dispositivo, come un laptop o telefono. Complementa WebAuthn, utilizzato per autenticarsi con il sito web (la "Parte Facente Affidamento"), a cui stai provando ad accedere.
|
||||
|
||||
|
||||
@@ -96,7 +96,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, and view their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, view and edit their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
|
||||
[:octicons-home-16: Homepage](https://peergos.org){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://peergos.net/privacy.html){ .card-link title="Privacy Policy" }
|
||||
@@ -109,9 +109,9 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=peergos.android)
|
||||
- [:simple-github: GitHub](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-apple: macOS](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-linux: Linux](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://peergos.org/download#windows)
|
||||
- [:simple-apple: macOS](https://peergos.org/download#macos)
|
||||
- [:simple-linux: Linux](https://peergos.org/download#linux)
|
||||
- [:octicons-browser-16: Web](https://peergos.net)
|
||||
|
||||
</details>
|
||||
@@ -120,9 +120,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
Peergos is built on top of the [InterPlanetary File System (IPFS)](https://ipfs.tech), a peer-to-peer architecture that protects against [:material-close-outline: Censorship](basics/common-threats.md#avoiding-censorship ""){.pg-blue-gray}.
|
||||
|
||||
Peergos is primarily a web app, but you can self-host the server either as a local cache for your remote Peergos account, or as a standalone storage server which negates the need to register for a remote account and subscription. The Peergos server is a `.jar` file, which means the Java 17+ Runtime Environment ([OpenJDK download](https://azul.com/downloads)) should be installed on your machine to get it working.
|
||||
|
||||
Running a local version of Peergos alongside a registered account on their paid, hosted service allows you to access your Peergos storage without any reliance on DNS or TLS certificate authorities, and keep a copy of your data backed up to their cloud. The user experience should be the same whether you run their desktop server or just use their hosted web interface.
|
||||
Peergos has a web app, desktop apps and an Android app and you can also self-host the server. Client, server and command line interface all run from the same binary. There is a sync engine included (accessible via the desktop or android apps) for bi-directionally synchronizing a local folder with a Peergos folder, and a webdav bridge to allow other applications to access your Peergos storage.
|
||||
|
||||
Peergos was [audited](https://peergos.org/posts/security-audit-2024) in November 2024 by Radically Open Security and all issues were fixed. They were previously [audited](https://cure53.de/pentest-report_peergos.pdf) by Cure53 in June 2019, and all found issues were subsequently fixed.
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
title: "Chiavi di Sicurezza"
|
||||
title: Chiavi di Sicurezza
|
||||
icon: material/key-chain
|
||||
description: These security keys provide a form of phishing-immune authentication for accounts that support it.
|
||||
cover: multi-factor-authentication.webp
|
||||
@@ -10,7 +10,7 @@ cover: multi-factor-authentication.webp
|
||||
- [:material-target-account: Targeted Attacks](basics/common-threats.md#attacks-against-specific-individuals){ .pg-red }
|
||||
- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange }
|
||||
|
||||
Una **chiave di sicurezza** fisica aggiunge un livello di protezione molto forte ai tuoi account online. Compared to [authenticator apps](multi-factor-authentication.md), the FIDO2 security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
Una **chiave di sicurezza** fisica aggiunge un livello di protezione molto forte ai tuoi account online. Compared to [authenticator apps](multi-factor-authentication.md), the [FIDO2](basics/multi-factor-authentication.md#fido-fast-identity-online) security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
|
||||
## Yubico Security Key
|
||||
|
||||
@@ -20,7 +20,7 @@ Una **chiave di sicurezza** fisica aggiunge un livello di protezione molto forte
|
||||
{ width="315" }
|
||||
</figure>
|
||||
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. Supporta FIDO2/WebAuthn e FIDO U2F e funziona con la maggior parte dei servizi che supportano una chiave di sicurezza come secondo fattore, nonché con molti gestori di password.
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO Universal 2nd Factor (U2F), and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/security-key){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -35,10 +35,10 @@ These keys are available in both USB-C and USB-A variants, and both options supp
|
||||
This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- [Yubico Authenticator](https://yubico.com/products/yubico-authenticator)
|
||||
- CCID Smart Card support (PIV-compatibile)
|
||||
- CCID Smart Card support (PIV-compatible)
|
||||
- OpenPGP
|
||||
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) of products instead.
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) series instead.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Avviso</p>
|
||||
@@ -55,7 +55,7 @@ The firmware of Yubico's Security Keys is not updatable. If you want features in
|
||||
{ width="400" }
|
||||
</figure>
|
||||
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The YubiKey 5 Series has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), [Yubico OTP](basics/multi-factor-authentication.md#yubico-otp), [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), [OpenPGP](https://developers.yubico.com/PGP), and [TOTP and HOTP](https://developers.yubico.com/OATH) authentication.
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The **YubiKey 5 Series** has a wide range of features such as FIDO2/WebAuthn and FIDO U2F, [TOTP and HOTP](https://developers.yubico.com/OATH) authentication, [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), and [OpenPGP](https://developers.yubico.com/PGP).
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/yubikey-5-overview){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -69,7 +69,7 @@ The [comparison table](https://yubico.com/store/compare) shows how the YubiKeys
|
||||
|
||||
YubiKeys can be programmed using the [YubiKey Manager](https://yubico.com/support/download/yubikey-manager) or [YubiKey Personalization Tools](https://yubico.com/support/download/yubikey-personalization-tools). For managing TOTP codes, you can use the [Yubico Authenticator](https://yubico.com/products/yubico-authenticator). All of Yubico's clients are open source.
|
||||
|
||||
For models which support HOTP and TOTP, there are 2 slots in the OTP interface which could be used for HOTP and 32 slots to store TOTP secrets. These secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
For models which [support HOTP and TOTP](https://support.yubico.com/hc/articles/360013790319-How-many-accounts-can-I-register-my-YubiKey-with), the secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Avviso</p>
|
||||
@@ -86,7 +86,7 @@ The firmware of YubiKey is not updatable. If you want features in newer firmware
|
||||
{ width="300" }
|
||||
</figure>
|
||||
|
||||
The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://www.nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification). The Nitrokey 3 Series in general has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), Personal Identity Verification (PIV), OpenPGP, and TOTP and HOTP authentication.
|
||||
**Nitrokey** has a cost-effective security key capable of FIDO2/WebAuthn and FIDO U2F called the **Nitrokey Passkey**. For support for features such as PIV, OpenPGP, and TOTP and HOTP authentication, you need to purchase one of their other keys like the **Nitrokey 3**. Currently, only the **Nitrokey 3A Mini** has [FIDO Level 1 Certification](https://nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification).
|
||||
|
||||
[:octicons-home-16: Homepage](https://nitrokey.com){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://nitrokey.com/data-privacy-policy){ .card-link title="Privacy Policy" }
|
||||
@@ -96,26 +96,14 @@ The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://
|
||||
|
||||
</div>
|
||||
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys) shows how the different Nitrokey models compare to each other in terms of features and other specifications.
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys#:~:text=The%20Nitrokey%20Family) shows how the different Nitrokey models compare to each other in terms of features and other specifications. Refer to Nitrokey's [documentation](https://docs.nitrokey.com/nitrokeys/features) for more details about the features available on your Nitrokey.
|
||||
|
||||
Nitrokey models can be configured using the [Nitrokey app](https://nitrokey.com/download).
|
||||
|
||||
The Nitrokey 3 Series can act as a password manager. They can store up to 50 different entries, and each entry can contain login, password, comment and OTP.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Avviso</p>
|
||||
|
||||
Excluding the Nitrokey 3, Nitrokeys with HOTP and TOTP storage do not have it encrypted, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
**Nitrokey** also has the **Nitrokey Passkey**, a lower-price security key capable of [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online). This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- Gestore di password
|
||||
- PIV
|
||||
- OpenPGP
|
||||
- Tamper-resistant smart card
|
||||
- TOTP and HOTP
|
||||
Excluding the Nitrokey 3, Nitrokeys which support HOTP and TOTP do not have encrypted storage, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: "多要素認証"
|
||||
icon: 'material/two-factor-authentication'
|
||||
title: 多要素認証
|
||||
icon: material/two-factor-authentication
|
||||
description: 多要素認証はオンラインアカウントを保護するためのセキュリティの仕組みで、強力な仕組みのものもあります。
|
||||
---
|
||||
|
||||
@@ -64,7 +64,7 @@ Yubico検証サーバーはクラウドベースのサービスでありデー
|
||||
|
||||
#### FIDO (Fast IDentity Online)
|
||||
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance)には多くの標準規格があり、最初にU2F、後にウェブ標準の[WebAuthn](https://en.wikipedia.org/wiki/WebAuthn)を含む[FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project)が策定されました。
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was [U2F](https://en.wikipedia.org/wiki/Universal_2nd_Factor) and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) which includes the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
|
||||
U2FとFIDO2は[Client to Authenticator Protocol](https://en.wikipedia.org/wiki/Client_to_Authenticator_Protocol)で、セキュリティーキーとラップトップや携帯電話のようなコンピューター間のプロトコルです。 ログインしようとしているウェブサイト（「Relaying Party」）との認証に使われているコンポーネントであるWebAuthnを補完しています。
|
||||
|
||||
|
||||
@@ -96,7 +96,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, and view their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, view and edit their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
|
||||
[:octicons-home-16: Homepage](https://peergos.org){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://peergos.net/privacy.html){ .card-link title="Privacy Policy" }
|
||||
@@ -109,9 +109,9 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=peergos.android)
|
||||
- [:simple-github: GitHub](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-apple: macOS](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-linux: Linux](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://peergos.org/download#windows)
|
||||
- [:simple-apple: macOS](https://peergos.org/download#macos)
|
||||
- [:simple-linux: Linux](https://peergos.org/download#linux)
|
||||
- [:octicons-browser-16: Web](https://peergos.net)
|
||||
|
||||
</details>
|
||||
@@ -120,9 +120,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
Peergos is built on top of the [InterPlanetary File System (IPFS)](https://ipfs.tech), a peer-to-peer architecture that protects against [:material-close-outline: Censorship](basics/common-threats.md#avoiding-censorship ""){.pg-blue-gray}.
|
||||
|
||||
Peergos is primarily a web app, but you can self-host the server either as a local cache for your remote Peergos account, or as a standalone storage server which negates the need to register for a remote account and subscription. The Peergos server is a `.jar` file, which means the Java 17+ Runtime Environment ([OpenJDK download](https://azul.com/downloads)) should be installed on your machine to get it working.
|
||||
|
||||
Running a local version of Peergos alongside a registered account on their paid, hosted service allows you to access your Peergos storage without any reliance on DNS or TLS certificate authorities, and keep a copy of your data backed up to their cloud. The user experience should be the same whether you run their desktop server or just use their hosted web interface.
|
||||
Peergos has a web app, desktop apps and an Android app and you can also self-host the server. Client, server and command line interface all run from the same binary. There is a sync engine included (accessible via the desktop or android apps) for bi-directionally synchronizing a local folder with a Peergos folder, and a webdav bridge to allow other applications to access your Peergos storage.
|
||||
|
||||
Peergos was [audited](https://peergos.org/posts/security-audit-2024) in November 2024 by Radically Open Security and all issues were fixed. They were previously [audited](https://cure53.de/pentest-report_peergos.pdf) by Cure53 in June 2019, and all found issues were subsequently fixed.
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
title: "Security Keys"
|
||||
title: Security Keys
|
||||
icon: material/key-chain
|
||||
description: These security keys provide a form of phishing-immune authentication for accounts that support it.
|
||||
cover: multi-factor-authentication.webp
|
||||
@@ -10,7 +10,7 @@ cover: multi-factor-authentication.webp
|
||||
- [:material-target-account: Targeted Attacks](basics/common-threats.md#attacks-against-specific-individuals){ .pg-red }
|
||||
- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange }
|
||||
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the FIDO2 security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the [FIDO2](basics/multi-factor-authentication.md#fido-fast-identity-online) security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
|
||||
## Yubico Security Key
|
||||
|
||||
@@ -20,7 +20,7 @@ A physical **security key** adds a very strong layer of protection to your onlin
|
||||
{ width="315" }
|
||||
</figure>
|
||||
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO U2F, and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO Universal 2nd Factor (U2F), and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/security-key){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -35,10 +35,10 @@ These keys are available in both USB-C and USB-A variants, and both options supp
|
||||
This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- [Yubico Authenticator](https://yubico.com/products/yubico-authenticator)
|
||||
- CCID Smart Card support (PIV-compatibile)
|
||||
- CCID Smart Card support (PIV-compatible)
|
||||
- OpenPGP
|
||||
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) of products instead.
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) series instead.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">注意</p>
|
||||
@@ -55,7 +55,7 @@ The firmware of Yubico's Security Keys is not updatable. If you want features in
|
||||
{ width="400" }
|
||||
</figure>
|
||||
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The YubiKey 5 Series has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), [Yubico OTP](basics/multi-factor-authentication.md#yubico-otp), [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), [OpenPGP](https://developers.yubico.com/PGP), and [TOTP and HOTP](https://developers.yubico.com/OATH) authentication.
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The **YubiKey 5 Series** has a wide range of features such as FIDO2/WebAuthn and FIDO U2F, [TOTP and HOTP](https://developers.yubico.com/OATH) authentication, [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), and [OpenPGP](https://developers.yubico.com/PGP).
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/yubikey-5-overview){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -69,7 +69,7 @@ The [comparison table](https://yubico.com/store/compare) shows how the YubiKeys
|
||||
|
||||
YubiKeys can be programmed using the [YubiKey Manager](https://yubico.com/support/download/yubikey-manager) or [YubiKey Personalization Tools](https://yubico.com/support/download/yubikey-personalization-tools). For managing TOTP codes, you can use the [Yubico Authenticator](https://yubico.com/products/yubico-authenticator). All of Yubico's clients are open source.
|
||||
|
||||
For models which support HOTP and TOTP, there are 2 slots in the OTP interface which could be used for HOTP and 32 slots to store TOTP secrets. These secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
For models which [support HOTP and TOTP](https://support.yubico.com/hc/articles/360013790319-How-many-accounts-can-I-register-my-YubiKey-with), the secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">注意</p>
|
||||
@@ -86,7 +86,7 @@ The firmware of YubiKey is not updatable. If you want features in newer firmware
|
||||
{ width="300" }
|
||||
</figure>
|
||||
|
||||
The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://www.nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification). The Nitrokey 3 Series in general has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), Personal Identity Verification (PIV), OpenPGP, and TOTP and HOTP authentication.
|
||||
**Nitrokey** has a cost-effective security key capable of FIDO2/WebAuthn and FIDO U2F called the **Nitrokey Passkey**. For support for features such as PIV, OpenPGP, and TOTP and HOTP authentication, you need to purchase one of their other keys like the **Nitrokey 3**. Currently, only the **Nitrokey 3A Mini** has [FIDO Level 1 Certification](https://nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification).
|
||||
|
||||
[:octicons-home-16: Homepage](https://nitrokey.com){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://nitrokey.com/data-privacy-policy){ .card-link title="Privacy Policy" }
|
||||
@@ -96,26 +96,14 @@ The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://
|
||||
|
||||
</div>
|
||||
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys) shows how the different Nitrokey models compare to each other in terms of features and other specifications.
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys#:~:text=The%20Nitrokey%20Family) shows how the different Nitrokey models compare to each other in terms of features and other specifications. Refer to Nitrokey's [documentation](https://docs.nitrokey.com/nitrokeys/features) for more details about the features available on your Nitrokey.
|
||||
|
||||
Nitrokey models can be configured using the [Nitrokey app](https://nitrokey.com/download).
|
||||
|
||||
The Nitrokey 3 Series can act as a password manager. They can store up to 50 different entries, and each entry can contain login, password, comment and OTP.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">注意</p>
|
||||
|
||||
Excluding the Nitrokey 3, Nitrokeys with HOTP and TOTP storage do not have it encrypted, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
**Nitrokey** also has the **Nitrokey Passkey**, a lower-price security key capable of [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online). This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- パスワードマネージャー
|
||||
- PIV
|
||||
- OpenPGP
|
||||
- Tamper-resistant smart card
|
||||
- TOTP and HOTP
|
||||
Excluding the Nitrokey 3, Nitrokeys which support HOTP and TOTP do not have encrypted storage, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: "Multifactor Authentication"
|
||||
icon: 'material/two-factor-authentication'
|
||||
title: Multifactor Authentication
|
||||
icon: material/two-factor-authentication
|
||||
description: MFA는 온라인 계정을 보호하는 데에 있어서 중요한 보안 메커니즘이지만, 방식에 따라 보안성은 달라집니다.
|
||||
---
|
||||
|
||||
@@ -64,7 +64,7 @@ Yubico 유효성 검사 서버는 클라우드 기반 서비스입니다. 따라
|
||||
|
||||
#### FIDO(Fast IDentity Online)
|
||||
|
||||
[FIDO](https://ko.wikipedia.org/wiki/FIDO_%EC%96%BC%EB%9D%BC%EC%9D%B4%EC%96%B8%EC%8A%A4)에는 여러 표준이 포함되어 있습니다. U2F가 먼저 추가되었고, 이후에는 [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn) 웹 표준을 포함하는 [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project)가 추가되었습니다.
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was [U2F](https://en.wikipedia.org/wiki/Universal_2nd_Factor) and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) which includes the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
|
||||
U2F, FIDO2는 보안 키와 컴퓨터(노트북, 스마트폰 등) 간의 프로토콜인 [CTAP(Client to Authenticator Protocol)](https://en.wikipedia.org/wiki/Client_to_Authenticator_Protocol)를 포함합니다. 이는 여러분이 로그인하려는 웹사이트, 즉 신뢰 당사자(Relying Party)와 인증하는 데 쓰이는 WebAuthn을 보완합니다.
|
||||
|
||||
|
||||
@@ -96,7 +96,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, and view their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, view and edit their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
|
||||
[:octicons-home-16: Homepage](https://peergos.org){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://peergos.net/privacy.html){ .card-link title="Privacy Policy" }
|
||||
@@ -109,9 +109,9 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=peergos.android)
|
||||
- [:simple-github: GitHub](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-apple: macOS](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-linux: Linux](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://peergos.org/download#windows)
|
||||
- [:simple-apple: macOS](https://peergos.org/download#macos)
|
||||
- [:simple-linux: Linux](https://peergos.org/download#linux)
|
||||
- [:octicons-browser-16: Web](https://peergos.net)
|
||||
|
||||
</details>
|
||||
@@ -120,9 +120,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
Peergos is built on top of the [InterPlanetary File System (IPFS)](https://ipfs.tech), a peer-to-peer architecture that protects against [:material-close-outline: Censorship](basics/common-threats.md#avoiding-censorship ""){.pg-blue-gray}.
|
||||
|
||||
Peergos is primarily a web app, but you can self-host the server either as a local cache for your remote Peergos account, or as a standalone storage server which negates the need to register for a remote account and subscription. The Peergos server is a `.jar` file, which means the Java 17+ Runtime Environment ([OpenJDK download](https://azul.com/downloads)) should be installed on your machine to get it working.
|
||||
|
||||
Running a local version of Peergos alongside a registered account on their paid, hosted service allows you to access your Peergos storage without any reliance on DNS or TLS certificate authorities, and keep a copy of your data backed up to their cloud. The user experience should be the same whether you run their desktop server or just use their hosted web interface.
|
||||
Peergos has a web app, desktop apps and an Android app and you can also self-host the server. Client, server and command line interface all run from the same binary. There is a sync engine included (accessible via the desktop or android apps) for bi-directionally synchronizing a local folder with a Peergos folder, and a webdav bridge to allow other applications to access your Peergos storage.
|
||||
|
||||
Peergos was [audited](https://peergos.org/posts/security-audit-2024) in November 2024 by Radically Open Security and all issues were fixed. They were previously [audited](https://cure53.de/pentest-report_peergos.pdf) by Cure53 in June 2019, and all found issues were subsequently fixed.
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
title: "Security Keys"
|
||||
title: Security Keys
|
||||
icon: material/key-chain
|
||||
description: These security keys provide a form of phishing-immune authentication for accounts that support it.
|
||||
cover: multi-factor-authentication.webp
|
||||
@@ -10,7 +10,7 @@ cover: multi-factor-authentication.webp
|
||||
- [:material-target-account: Targeted Attacks](basics/common-threats.md#attacks-against-specific-individuals){ .pg-red }
|
||||
- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange }
|
||||
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the FIDO2 security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the [FIDO2](basics/multi-factor-authentication.md#fido-fast-identity-online) security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
|
||||
## Yubico Security Key
|
||||
|
||||
@@ -20,7 +20,7 @@ A physical **security key** adds a very strong layer of protection to your onlin
|
||||
{ width="315" }
|
||||
</figure>
|
||||
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO U2F, and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO Universal 2nd Factor (U2F), and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/security-key){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -35,10 +35,10 @@ These keys are available in both USB-C and USB-A variants, and both options supp
|
||||
This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- [Yubico Authenticator](https://yubico.com/products/yubico-authenticator)
|
||||
- CCID Smart Card support (PIV-compatibile)
|
||||
- CCID Smart Card support (PIV-compatible)
|
||||
- OpenPGP
|
||||
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) of products instead.
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) series instead.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
@@ -55,7 +55,7 @@ The firmware of Yubico's Security Keys is not updatable. If you want features in
|
||||
{ width="400" }
|
||||
</figure>
|
||||
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The YubiKey 5 Series has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), [Yubico OTP](basics/multi-factor-authentication.md#yubico-otp), [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), [OpenPGP](https://developers.yubico.com/PGP), and [TOTP and HOTP](https://developers.yubico.com/OATH) authentication.
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The **YubiKey 5 Series** has a wide range of features such as FIDO2/WebAuthn and FIDO U2F, [TOTP and HOTP](https://developers.yubico.com/OATH) authentication, [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), and [OpenPGP](https://developers.yubico.com/PGP).
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/yubikey-5-overview){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -69,7 +69,7 @@ The [comparison table](https://yubico.com/store/compare) shows how the YubiKeys
|
||||
|
||||
YubiKeys can be programmed using the [YubiKey Manager](https://yubico.com/support/download/yubikey-manager) or [YubiKey Personalization Tools](https://yubico.com/support/download/yubikey-personalization-tools). For managing TOTP codes, you can use the [Yubico Authenticator](https://yubico.com/products/yubico-authenticator). All of Yubico's clients are open source.
|
||||
|
||||
For models which support HOTP and TOTP, there are 2 slots in the OTP interface which could be used for HOTP and 32 slots to store TOTP secrets. These secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
For models which [support HOTP and TOTP](https://support.yubico.com/hc/articles/360013790319-How-many-accounts-can-I-register-my-YubiKey-with), the secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
@@ -86,7 +86,7 @@ The firmware of YubiKey is not updatable. If you want features in newer firmware
|
||||
{ width="300" }
|
||||
</figure>
|
||||
|
||||
The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://www.nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification). The Nitrokey 3 Series in general has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), Personal Identity Verification (PIV), OpenPGP, and TOTP and HOTP authentication.
|
||||
**Nitrokey** has a cost-effective security key capable of FIDO2/WebAuthn and FIDO U2F called the **Nitrokey Passkey**. For support for features such as PIV, OpenPGP, and TOTP and HOTP authentication, you need to purchase one of their other keys like the **Nitrokey 3**. Currently, only the **Nitrokey 3A Mini** has [FIDO Level 1 Certification](https://nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification).
|
||||
|
||||
[:octicons-home-16: Homepage](https://nitrokey.com){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://nitrokey.com/data-privacy-policy){ .card-link title="Privacy Policy" }
|
||||
@@ -96,26 +96,14 @@ The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://
|
||||
|
||||
</div>
|
||||
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys) shows how the different Nitrokey models compare to each other in terms of features and other specifications.
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys#:~:text=The%20Nitrokey%20Family) shows how the different Nitrokey models compare to each other in terms of features and other specifications. Refer to Nitrokey's [documentation](https://docs.nitrokey.com/nitrokeys/features) for more details about the features available on your Nitrokey.
|
||||
|
||||
Nitrokey models can be configured using the [Nitrokey app](https://nitrokey.com/download).
|
||||
|
||||
The Nitrokey 3 Series can act as a password manager. They can store up to 50 different entries, and each entry can contain login, password, comment and OTP.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Excluding the Nitrokey 3, Nitrokeys with HOTP and TOTP storage do not have it encrypted, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
**Nitrokey** also has the **Nitrokey Passkey**, a lower-price security key capable of [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online). This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- 비밀번호 관리자
|
||||
- PIV
|
||||
- OpenPGP
|
||||
- Tamper-resistant smart card
|
||||
- TOTP and HOTP
|
||||
Excluding the Nitrokey 3, Nitrokeys which support HOTP and TOTP do not have encrypted storage, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: "Multifactor Authentication"
|
||||
icon: 'material/two-factor-authentication'
|
||||
title: Multifactor Authentication
|
||||
icon: material/two-factor-authentication
|
||||
description: MFA is a critical security mechanism for securing your online accounts, but some methods are stronger than others.
|
||||
---
|
||||
|
||||
@@ -64,7 +64,7 @@ If your threat model requires you to have different identities on different webs
|
||||
|
||||
#### FIDO (Fast IDentity Online)
|
||||
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was U2F and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) which includes the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was [U2F](https://en.wikipedia.org/wiki/Universal_2nd_Factor) and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) which includes the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
|
||||
U2F and FIDO2 refer to the [Client to Authenticator Protocol](https://en.wikipedia.org/wiki/Client_to_Authenticator_Protocol), which is the protocol between the security key and the computer, such as a laptop or phone. It complements WebAuthn which is the component used to authenticate with the website (the "Relying Party") you're trying to log in on.
|
||||
|
||||
|
||||
@@ -96,7 +96,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, and view their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, view and edit their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
|
||||
[:octicons-home-16: Homepage](https://peergos.org){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://peergos.net/privacy.html){ .card-link title="Privacy Policy" }
|
||||
@@ -109,9 +109,9 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=peergos.android)
|
||||
- [:simple-github: GitHub](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-apple: macOS](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-linux: Linux](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://peergos.org/download#windows)
|
||||
- [:simple-apple: macOS](https://peergos.org/download#macos)
|
||||
- [:simple-linux: Linux](https://peergos.org/download#linux)
|
||||
- [:octicons-browser-16: Web](https://peergos.net)
|
||||
|
||||
</details>
|
||||
@@ -120,9 +120,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
Peergos is built on top of the [InterPlanetary File System (IPFS)](https://ipfs.tech), a peer-to-peer architecture that protects against [:material-close-outline: Censorship](basics/common-threats.md#avoiding-censorship ""){.pg-blue-gray}.
|
||||
|
||||
Peergos is primarily a web app, but you can self-host the server either as a local cache for your remote Peergos account, or as a standalone storage server which negates the need to register for a remote account and subscription. The Peergos server is a `.jar` file, which means the Java 17+ Runtime Environment ([OpenJDK download](https://azul.com/downloads)) should be installed on your machine to get it working.
|
||||
|
||||
Running a local version of Peergos alongside a registered account on their paid, hosted service allows you to access your Peergos storage without any reliance on DNS or TLS certificate authorities, and keep a copy of your data backed up to their cloud. The user experience should be the same whether you run their desktop server or just use their hosted web interface.
|
||||
Peergos has a web app, desktop apps and an Android app and you can also self-host the server. Client, server and command line interface all run from the same binary. There is a sync engine included (accessible via the desktop or android apps) for bi-directionally synchronizing a local folder with a Peergos folder, and a webdav bridge to allow other applications to access your Peergos storage.
|
||||
|
||||
Peergos was [audited](https://peergos.org/posts/security-audit-2024) in November 2024 by Radically Open Security and all issues were fixed. They were previously [audited](https://cure53.de/pentest-report_peergos.pdf) by Cure53 in June 2019, and all found issues were subsequently fixed.
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
title: "Security Keys"
|
||||
title: Security Keys
|
||||
icon: material/key-chain
|
||||
description: These security keys provide a form of phishing-immune authentication for accounts that support it.
|
||||
cover: multi-factor-authentication.webp
|
||||
@@ -10,7 +10,7 @@ cover: multi-factor-authentication.webp
|
||||
- [:material-target-account: Targeted Attacks](basics/common-threats.md#attacks-against-specific-individuals){ .pg-red }
|
||||
- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange }
|
||||
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the FIDO2 security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the [FIDO2](basics/multi-factor-authentication.md#fido-fast-identity-online) security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
|
||||
## Yubico Security Key
|
||||
|
||||
@@ -20,7 +20,7 @@ A physical **security key** adds a very strong layer of protection to your onlin
|
||||
{ width="315" }
|
||||
</figure>
|
||||
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO U2F, and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO Universal 2nd Factor (U2F), and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/security-key){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -35,10 +35,10 @@ These keys are available in both USB-C and USB-A variants, and both options supp
|
||||
This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- [Yubico Authenticator](https://yubico.com/products/yubico-authenticator)
|
||||
- CCID Smart Card support (PIV-compatibile)
|
||||
- CCID Smart Card support (PIV-compatible)
|
||||
- OpenPGP
|
||||
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) of products instead.
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) series instead.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
@@ -55,7 +55,7 @@ The firmware of Yubico's Security Keys is not updatable. If you want features in
|
||||
{ width="400" }
|
||||
</figure>
|
||||
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The YubiKey 5 Series has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), [Yubico OTP](basics/multi-factor-authentication.md#yubico-otp), [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), [OpenPGP](https://developers.yubico.com/PGP), and [TOTP and HOTP](https://developers.yubico.com/OATH) authentication.
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The **YubiKey 5 Series** has a wide range of features such as FIDO2/WebAuthn and FIDO U2F, [TOTP and HOTP](https://developers.yubico.com/OATH) authentication, [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), and [OpenPGP](https://developers.yubico.com/PGP).
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/yubikey-5-overview){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -69,7 +69,7 @@ The [comparison table](https://yubico.com/store/compare) shows how the YubiKeys
|
||||
|
||||
YubiKeys can be programmed using the [YubiKey Manager](https://yubico.com/support/download/yubikey-manager) or [YubiKey Personalization Tools](https://yubico.com/support/download/yubikey-personalization-tools). For managing TOTP codes, you can use the [Yubico Authenticator](https://yubico.com/products/yubico-authenticator). All of Yubico's clients are open source.
|
||||
|
||||
For models which support HOTP and TOTP, there are 2 slots in the OTP interface which could be used for HOTP and 32 slots to store TOTP secrets. These secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
For models which [support HOTP and TOTP](https://support.yubico.com/hc/articles/360013790319-How-many-accounts-can-I-register-my-YubiKey-with), the secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
@@ -86,7 +86,7 @@ The firmware of YubiKey is not updatable. If you want features in newer firmware
|
||||
{ width="300" }
|
||||
</figure>
|
||||
|
||||
The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://www.nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification). The Nitrokey 3 Series in general has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), Personal Identity Verification (PIV), OpenPGP, and TOTP and HOTP authentication.
|
||||
**Nitrokey** has a cost-effective security key capable of FIDO2/WebAuthn and FIDO U2F called the **Nitrokey Passkey**. For support for features such as PIV, OpenPGP, and TOTP and HOTP authentication, you need to purchase one of their other keys like the **Nitrokey 3**. Currently, only the **Nitrokey 3A Mini** has [FIDO Level 1 Certification](https://nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification).
|
||||
|
||||
[:octicons-home-16: Homepage](https://nitrokey.com){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://nitrokey.com/data-privacy-policy){ .card-link title="Privacy Policy" }
|
||||
@@ -96,26 +96,14 @@ The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://
|
||||
|
||||
</div>
|
||||
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys) shows how the different Nitrokey models compare to each other in terms of features and other specifications.
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys#:~:text=The%20Nitrokey%20Family) shows how the different Nitrokey models compare to each other in terms of features and other specifications. Refer to Nitrokey's [documentation](https://docs.nitrokey.com/nitrokeys/features) for more details about the features available on your Nitrokey.
|
||||
|
||||
Nitrokey models can be configured using the [Nitrokey app](https://nitrokey.com/download).
|
||||
|
||||
The Nitrokey 3 Series can act as a password manager. They can store up to 50 different entries, and each entry can contain login, password, comment and OTP.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Excluding the Nitrokey 3, Nitrokeys with HOTP and TOTP storage do not have it encrypted, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
**Nitrokey** also has the **Nitrokey Passkey**, a lower-price security key capable of [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online). This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- Password Manager
|
||||
- PIV
|
||||
- OpenPGP
|
||||
- Tamper-resistant smart card
|
||||
- TOTP and HOTP
|
||||
Excluding the Nitrokey 3, Nitrokeys which support HOTP and TOTP do not have encrypted storage, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: "Multifactor Authentication"
|
||||
icon: 'material/two-factor-authentication'
|
||||
title: Multifactor Authentication
|
||||
icon: material/two-factor-authentication
|
||||
description: MFA is een cruciaal beveiligingsmechanisme voor de beveiliging van jouw online accounts, maar sommige methoden zijn sterker dan andere.
|
||||
---
|
||||
|
||||
@@ -76,7 +76,7 @@ Als jouw dreigingsmodel vereist dat je verschillende identiteiten op verschillen
|
||||
|
||||
#### FIDO (Fast IDentity Online)
|
||||
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) omvat een aantal normen, eerst was er U2F en later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) die de webnorm [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn)omvat.
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was [U2F](https://en.wikipedia.org/wiki/Universal_2nd_Factor) and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) which includes the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
|
||||
U2F en FIDO2 verwijzen naar het [Client to Authenticator Protocol](https://en.wikipedia.org/wiki/Client_to_Authenticator_Protocol), dat het protocol is tussen de beveiligingssleutel en de computer, zoals een laptop of telefoon. Het is een aanvulling op WebAuthn, de component die wordt gebruikt om je te authenticeren bij de website (de "Betrouwbare Partij") waarop je probeert in te loggen.
|
||||
|
||||
|
||||
@@ -96,7 +96,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, and view their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, view and edit their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
|
||||
[:octicons-home-16: Homepage](https://peergos.org){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://peergos.net/privacy.html){ .card-link title="Privacy Policy" }
|
||||
@@ -109,9 +109,9 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=peergos.android)
|
||||
- [:simple-github: GitHub](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-apple: macOS](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-linux: Linux](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://peergos.org/download#windows)
|
||||
- [:simple-apple: macOS](https://peergos.org/download#macos)
|
||||
- [:simple-linux: Linux](https://peergos.org/download#linux)
|
||||
- [:octicons-browser-16: Web](https://peergos.net)
|
||||
|
||||
</details>
|
||||
@@ -120,9 +120,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
Peergos is built on top of the [InterPlanetary File System (IPFS)](https://ipfs.tech), a peer-to-peer architecture that protects against [:material-close-outline: Censorship](basics/common-threats.md#avoiding-censorship ""){.pg-blue-gray}.
|
||||
|
||||
Peergos is primarily a web app, but you can self-host the server either as a local cache for your remote Peergos account, or as a standalone storage server which negates the need to register for a remote account and subscription. The Peergos server is a `.jar` file, which means the Java 17+ Runtime Environment ([OpenJDK download](https://azul.com/downloads)) should be installed on your machine to get it working.
|
||||
|
||||
Running a local version of Peergos alongside a registered account on their paid, hosted service allows you to access your Peergos storage without any reliance on DNS or TLS certificate authorities, and keep a copy of your data backed up to their cloud. The user experience should be the same whether you run their desktop server or just use their hosted web interface.
|
||||
Peergos has a web app, desktop apps and an Android app and you can also self-host the server. Client, server and command line interface all run from the same binary. There is a sync engine included (accessible via the desktop or android apps) for bi-directionally synchronizing a local folder with a Peergos folder, and a webdav bridge to allow other applications to access your Peergos storage.
|
||||
|
||||
Peergos was [audited](https://peergos.org/posts/security-audit-2024) in November 2024 by Radically Open Security and all issues were fixed. They were previously [audited](https://cure53.de/pentest-report_peergos.pdf) by Cure53 in June 2019, and all found issues were subsequently fixed.
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
title: "Security Keys"
|
||||
title: Security Keys
|
||||
icon: material/key-chain
|
||||
description: These security keys provide a form of phishing-immune authentication for accounts that support it.
|
||||
cover: multi-factor-authentication.webp
|
||||
@@ -10,7 +10,7 @@ cover: multi-factor-authentication.webp
|
||||
- [:material-target-account: Targeted Attacks](basics/common-threats.md#attacks-against-specific-individuals){ .pg-red }
|
||||
- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange }
|
||||
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the FIDO2 security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the [FIDO2](basics/multi-factor-authentication.md#fido-fast-identity-online) security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
|
||||
## Yubico Security Key
|
||||
|
||||
@@ -20,7 +20,7 @@ A physical **security key** adds a very strong layer of protection to your onlin
|
||||
{ width="315" }
|
||||
</figure>
|
||||
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO U2F, and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO Universal 2nd Factor (U2F), and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/security-key){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -35,10 +35,10 @@ These keys are available in both USB-C and USB-A variants, and both options supp
|
||||
This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- [Yubico Authenticator](https://yubico.com/products/yubico-authenticator)
|
||||
- CCID Smart Card support (PIV-compatibile)
|
||||
- CCID Smart Card support (PIV-compatible)
|
||||
- OpenPGP
|
||||
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) of products instead.
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) series instead.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
@@ -55,7 +55,7 @@ The firmware of Yubico's Security Keys is not updatable. If you want features in
|
||||
{ width="400" }
|
||||
</figure>
|
||||
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The YubiKey 5 Series has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), [Yubico OTP](basics/multi-factor-authentication.md#yubico-otp), [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), [OpenPGP](https://developers.yubico.com/PGP), and [TOTP and HOTP](https://developers.yubico.com/OATH) authentication.
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The **YubiKey 5 Series** has a wide range of features such as FIDO2/WebAuthn and FIDO U2F, [TOTP and HOTP](https://developers.yubico.com/OATH) authentication, [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), and [OpenPGP](https://developers.yubico.com/PGP).
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/yubikey-5-overview){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -69,7 +69,7 @@ The [comparison table](https://yubico.com/store/compare) shows how the YubiKeys
|
||||
|
||||
YubiKeys can be programmed using the [YubiKey Manager](https://yubico.com/support/download/yubikey-manager) or [YubiKey Personalization Tools](https://yubico.com/support/download/yubikey-personalization-tools). For managing TOTP codes, you can use the [Yubico Authenticator](https://yubico.com/products/yubico-authenticator). All of Yubico's clients are open source.
|
||||
|
||||
For models which support HOTP and TOTP, there are 2 slots in the OTP interface which could be used for HOTP and 32 slots to store TOTP secrets. These secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
For models which [support HOTP and TOTP](https://support.yubico.com/hc/articles/360013790319-How-many-accounts-can-I-register-my-YubiKey-with), the secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
@@ -86,7 +86,7 @@ The firmware of YubiKey is not updatable. If you want features in newer firmware
|
||||
{ width="300" }
|
||||
</figure>
|
||||
|
||||
The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://www.nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification). The Nitrokey 3 Series in general has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), Personal Identity Verification (PIV), OpenPGP, and TOTP and HOTP authentication.
|
||||
**Nitrokey** has a cost-effective security key capable of FIDO2/WebAuthn and FIDO U2F called the **Nitrokey Passkey**. For support for features such as PIV, OpenPGP, and TOTP and HOTP authentication, you need to purchase one of their other keys like the **Nitrokey 3**. Currently, only the **Nitrokey 3A Mini** has [FIDO Level 1 Certification](https://nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification).
|
||||
|
||||
[:octicons-home-16: Homepage](https://nitrokey.com){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://nitrokey.com/data-privacy-policy){ .card-link title="Privacy Policy" }
|
||||
@@ -96,26 +96,14 @@ The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://
|
||||
|
||||
</div>
|
||||
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys) shows how the different Nitrokey models compare to each other in terms of features and other specifications.
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys#:~:text=The%20Nitrokey%20Family) shows how the different Nitrokey models compare to each other in terms of features and other specifications. Refer to Nitrokey's [documentation](https://docs.nitrokey.com/nitrokeys/features) for more details about the features available on your Nitrokey.
|
||||
|
||||
Nitrokey models can be configured using the [Nitrokey app](https://nitrokey.com/download).
|
||||
|
||||
The Nitrokey 3 Series can act as a password manager. They can store up to 50 different entries, and each entry can contain login, password, comment and OTP.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Excluding the Nitrokey 3, Nitrokeys with HOTP and TOTP storage do not have it encrypted, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
**Nitrokey** also has the **Nitrokey Passkey**, a lower-price security key capable of [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online). This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- Wachtwoord Manager
|
||||
- PIV
|
||||
- OpenPGP
|
||||
- Tamper-resistant smart card
|
||||
- TOTP and HOTP
|
||||
Excluding the Nitrokey 3, Nitrokeys which support HOTP and TOTP do not have encrypted storage, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: "Multifactor Authentication"
|
||||
icon: 'material/two-factor-authentication'
|
||||
title: Multifactor Authentication
|
||||
icon: material/two-factor-authentication
|
||||
description: MFA is a critical security mechanism for securing your online accounts, but some methods are stronger than others.
|
||||
---
|
||||
|
||||
@@ -64,7 +64,7 @@ If your threat model requires you to have different identities on different webs
|
||||
|
||||
#### FIDO (Fast IDentity Online)
|
||||
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was U2F and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) which includes the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was [U2F](https://en.wikipedia.org/wiki/Universal_2nd_Factor) and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) which includes the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
|
||||
U2F and FIDO2 refer to the [Client to Authenticator Protocol](https://en.wikipedia.org/wiki/Client_to_Authenticator_Protocol), which is the protocol between the security key and the computer, such as a laptop or phone. It complements WebAuthn which is the component used to authenticate with the website (the "Relying Party") you're trying to log in on.
|
||||
|
||||
|
||||
@@ -96,7 +96,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, and view their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, view and edit their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
|
||||
[:octicons-home-16: Homepage](https://peergos.org){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://peergos.net/privacy.html){ .card-link title="Privacy Policy" }
|
||||
@@ -109,9 +109,9 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=peergos.android)
|
||||
- [:simple-github: GitHub](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-apple: macOS](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-linux: Linux](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://peergos.org/download#windows)
|
||||
- [:simple-apple: macOS](https://peergos.org/download#macos)
|
||||
- [:simple-linux: Linux](https://peergos.org/download#linux)
|
||||
- [:octicons-browser-16: Web](https://peergos.net)
|
||||
|
||||
</details>
|
||||
@@ -120,9 +120,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
Peergos is built on top of the [InterPlanetary File System (IPFS)](https://ipfs.tech), a peer-to-peer architecture that protects against [:material-close-outline: Censorship](basics/common-threats.md#avoiding-censorship ""){.pg-blue-gray}.
|
||||
|
||||
Peergos is primarily a web app, but you can self-host the server either as a local cache for your remote Peergos account, or as a standalone storage server which negates the need to register for a remote account and subscription. The Peergos server is a `.jar` file, which means the Java 17+ Runtime Environment ([OpenJDK download](https://azul.com/downloads)) should be installed on your machine to get it working.
|
||||
|
||||
Running a local version of Peergos alongside a registered account on their paid, hosted service allows you to access your Peergos storage without any reliance on DNS or TLS certificate authorities, and keep a copy of your data backed up to their cloud. The user experience should be the same whether you run their desktop server or just use their hosted web interface.
|
||||
Peergos has a web app, desktop apps and an Android app and you can also self-host the server. Client, server and command line interface all run from the same binary. There is a sync engine included (accessible via the desktop or android apps) for bi-directionally synchronizing a local folder with a Peergos folder, and a webdav bridge to allow other applications to access your Peergos storage.
|
||||
|
||||
Peergos was [audited](https://peergos.org/posts/security-audit-2024) in November 2024 by Radically Open Security and all issues were fixed. They were previously [audited](https://cure53.de/pentest-report_peergos.pdf) by Cure53 in June 2019, and all found issues were subsequently fixed.
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
title: "Security Keys"
|
||||
title: Security Keys
|
||||
icon: material/key-chain
|
||||
description: These security keys provide a form of phishing-immune authentication for accounts that support it.
|
||||
cover: multi-factor-authentication.webp
|
||||
@@ -10,7 +10,7 @@ cover: multi-factor-authentication.webp
|
||||
- [:material-target-account: Targeted Attacks](basics/common-threats.md#attacks-against-specific-individuals){ .pg-red }
|
||||
- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange }
|
||||
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the FIDO2 security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the [FIDO2](basics/multi-factor-authentication.md#fido-fast-identity-online) security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
|
||||
## Yubico Security Key
|
||||
|
||||
@@ -20,7 +20,7 @@ A physical **security key** adds a very strong layer of protection to your onlin
|
||||
{ width="315" }
|
||||
</figure>
|
||||
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO U2F, and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO Universal 2nd Factor (U2F), and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/security-key){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -35,10 +35,10 @@ These keys are available in both USB-C and USB-A variants, and both options supp
|
||||
This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- [Yubico Authenticator](https://yubico.com/products/yubico-authenticator)
|
||||
- CCID Smart Card support (PIV-compatibile)
|
||||
- CCID Smart Card support (PIV-compatible)
|
||||
- OpenPGP
|
||||
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) of products instead.
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) series instead.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Ostrzeżenie</p>
|
||||
@@ -55,7 +55,7 @@ The firmware of Yubico's Security Keys is not updatable. If you want features in
|
||||
{ width="400" }
|
||||
</figure>
|
||||
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The YubiKey 5 Series has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), [Yubico OTP](basics/multi-factor-authentication.md#yubico-otp), [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), [OpenPGP](https://developers.yubico.com/PGP), and [TOTP and HOTP](https://developers.yubico.com/OATH) authentication.
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The **YubiKey 5 Series** has a wide range of features such as FIDO2/WebAuthn and FIDO U2F, [TOTP and HOTP](https://developers.yubico.com/OATH) authentication, [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), and [OpenPGP](https://developers.yubico.com/PGP).
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/yubikey-5-overview){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -69,7 +69,7 @@ The [comparison table](https://yubico.com/store/compare) shows how the YubiKeys
|
||||
|
||||
YubiKeys can be programmed using the [YubiKey Manager](https://yubico.com/support/download/yubikey-manager) or [YubiKey Personalization Tools](https://yubico.com/support/download/yubikey-personalization-tools). For managing TOTP codes, you can use the [Yubico Authenticator](https://yubico.com/products/yubico-authenticator). All of Yubico's clients are open source.
|
||||
|
||||
For models which support HOTP and TOTP, there are 2 slots in the OTP interface which could be used for HOTP and 32 slots to store TOTP secrets. These secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
For models which [support HOTP and TOTP](https://support.yubico.com/hc/articles/360013790319-How-many-accounts-can-I-register-my-YubiKey-with), the secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Ostrzeżenie</p>
|
||||
@@ -86,7 +86,7 @@ The firmware of YubiKey is not updatable. If you want features in newer firmware
|
||||
{ width="300" }
|
||||
</figure>
|
||||
|
||||
The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://www.nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification). The Nitrokey 3 Series in general has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), Personal Identity Verification (PIV), OpenPGP, and TOTP and HOTP authentication.
|
||||
**Nitrokey** has a cost-effective security key capable of FIDO2/WebAuthn and FIDO U2F called the **Nitrokey Passkey**. For support for features such as PIV, OpenPGP, and TOTP and HOTP authentication, you need to purchase one of their other keys like the **Nitrokey 3**. Currently, only the **Nitrokey 3A Mini** has [FIDO Level 1 Certification](https://nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification).
|
||||
|
||||
[:octicons-home-16: Homepage](https://nitrokey.com){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://nitrokey.com/data-privacy-policy){ .card-link title="Privacy Policy" }
|
||||
@@ -96,26 +96,14 @@ The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://
|
||||
|
||||
</div>
|
||||
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys) shows how the different Nitrokey models compare to each other in terms of features and other specifications.
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys#:~:text=The%20Nitrokey%20Family) shows how the different Nitrokey models compare to each other in terms of features and other specifications. Refer to Nitrokey's [documentation](https://docs.nitrokey.com/nitrokeys/features) for more details about the features available on your Nitrokey.
|
||||
|
||||
Nitrokey models can be configured using the [Nitrokey app](https://nitrokey.com/download).
|
||||
|
||||
The Nitrokey 3 Series can act as a password manager. They can store up to 50 different entries, and each entry can contain login, password, comment and OTP.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Ostrzeżenie</p>
|
||||
|
||||
Excluding the Nitrokey 3, Nitrokeys with HOTP and TOTP storage do not have it encrypted, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
**Nitrokey** also has the **Nitrokey Passkey**, a lower-price security key capable of [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online). This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- Password Manager
|
||||
- PIV
|
||||
- OpenPGP
|
||||
- Tamper-resistant smart card
|
||||
- TOTP and HOTP
|
||||
Excluding the Nitrokey 3, Nitrokeys which support HOTP and TOTP do not have encrypted storage, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: "Multifactor Authentication"
|
||||
icon: 'material/two-factor-authentication'
|
||||
title: Multifactor Authentication
|
||||
icon: material/two-factor-authentication
|
||||
description: MFA is a critical security mechanism for securing your online accounts, but some methods are stronger than others.
|
||||
---
|
||||
|
||||
@@ -64,7 +64,7 @@ If your threat model requires you to have different identities on different webs
|
||||
|
||||
#### FIDO (Fast IDentity Online)
|
||||
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was U2F and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) which includes the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was [U2F](https://en.wikipedia.org/wiki/Universal_2nd_Factor) and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) which includes the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
|
||||
U2F and FIDO2 refer to the [Client to Authenticator Protocol](https://en.wikipedia.org/wiki/Client_to_Authenticator_Protocol), which is the protocol between the security key and the computer, such as a laptop or phone. It complements WebAuthn which is the component used to authenticate with the website (the "Relying Party") you're trying to log in on.
|
||||
|
||||
|
||||
@@ -96,7 +96,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, and view their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, view and edit their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
|
||||
[:octicons-home-16: Homepage](https://peergos.org){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://peergos.net/privacy.html){ .card-link title="Privacy Policy" }
|
||||
@@ -109,9 +109,9 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=peergos.android)
|
||||
- [:simple-github: GitHub](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-apple: macOS](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-linux: Linux](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://peergos.org/download#windows)
|
||||
- [:simple-apple: macOS](https://peergos.org/download#macos)
|
||||
- [:simple-linux: Linux](https://peergos.org/download#linux)
|
||||
- [:octicons-browser-16: Web](https://peergos.net)
|
||||
|
||||
</details>
|
||||
@@ -120,9 +120,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
Peergos is built on top of the [InterPlanetary File System (IPFS)](https://ipfs.tech), a peer-to-peer architecture that protects against [:material-close-outline: Censorship](basics/common-threats.md#avoiding-censorship ""){.pg-blue-gray}.
|
||||
|
||||
Peergos is primarily a web app, but you can self-host the server either as a local cache for your remote Peergos account, or as a standalone storage server which negates the need to register for a remote account and subscription. The Peergos server is a `.jar` file, which means the Java 17+ Runtime Environment ([OpenJDK download](https://azul.com/downloads)) should be installed on your machine to get it working.
|
||||
|
||||
Running a local version of Peergos alongside a registered account on their paid, hosted service allows you to access your Peergos storage without any reliance on DNS or TLS certificate authorities, and keep a copy of your data backed up to their cloud. The user experience should be the same whether you run their desktop server or just use their hosted web interface.
|
||||
Peergos has a web app, desktop apps and an Android app and you can also self-host the server. Client, server and command line interface all run from the same binary. There is a sync engine included (accessible via the desktop or android apps) for bi-directionally synchronizing a local folder with a Peergos folder, and a webdav bridge to allow other applications to access your Peergos storage.
|
||||
|
||||
Peergos was [audited](https://peergos.org/posts/security-audit-2024) in November 2024 by Radically Open Security and all issues were fixed. They were previously [audited](https://cure53.de/pentest-report_peergos.pdf) by Cure53 in June 2019, and all found issues were subsequently fixed.
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
title: "Security Keys"
|
||||
title: Security Keys
|
||||
icon: material/key-chain
|
||||
description: These security keys provide a form of phishing-immune authentication for accounts that support it.
|
||||
cover: multi-factor-authentication.webp
|
||||
@@ -10,7 +10,7 @@ cover: multi-factor-authentication.webp
|
||||
- [:material-target-account: Targeted Attacks](basics/common-threats.md#attacks-against-specific-individuals){ .pg-red }
|
||||
- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange }
|
||||
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the FIDO2 security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the [FIDO2](basics/multi-factor-authentication.md#fido-fast-identity-online) security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
|
||||
## Yubico Security Key
|
||||
|
||||
@@ -20,7 +20,7 @@ A physical **security key** adds a very strong layer of protection to your onlin
|
||||
{ width="315" }
|
||||
</figure>
|
||||
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO U2F, and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO Universal 2nd Factor (U2F), and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/security-key){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -35,10 +35,10 @@ These keys are available in both USB-C and USB-A variants, and both options supp
|
||||
This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- [Yubico Authenticator](https://yubico.com/products/yubico-authenticator)
|
||||
- CCID Smart Card support (PIV-compatibile)
|
||||
- CCID Smart Card support (PIV-compatible)
|
||||
- OpenPGP
|
||||
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) of products instead.
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) series instead.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Aviso</p>
|
||||
@@ -55,7 +55,7 @@ The firmware of Yubico's Security Keys is not updatable. If you want features in
|
||||
{ width="400" }
|
||||
</figure>
|
||||
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The YubiKey 5 Series has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), [Yubico OTP](basics/multi-factor-authentication.md#yubico-otp), [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), [OpenPGP](https://developers.yubico.com/PGP), and [TOTP and HOTP](https://developers.yubico.com/OATH) authentication.
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The **YubiKey 5 Series** has a wide range of features such as FIDO2/WebAuthn and FIDO U2F, [TOTP and HOTP](https://developers.yubico.com/OATH) authentication, [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), and [OpenPGP](https://developers.yubico.com/PGP).
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/yubikey-5-overview){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -69,7 +69,7 @@ The [comparison table](https://yubico.com/store/compare) shows how the YubiKeys
|
||||
|
||||
YubiKeys can be programmed using the [YubiKey Manager](https://yubico.com/support/download/yubikey-manager) or [YubiKey Personalization Tools](https://yubico.com/support/download/yubikey-personalization-tools). For managing TOTP codes, you can use the [Yubico Authenticator](https://yubico.com/products/yubico-authenticator). All of Yubico's clients are open source.
|
||||
|
||||
For models which support HOTP and TOTP, there are 2 slots in the OTP interface which could be used for HOTP and 32 slots to store TOTP secrets. These secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
For models which [support HOTP and TOTP](https://support.yubico.com/hc/articles/360013790319-How-many-accounts-can-I-register-my-YubiKey-with), the secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Aviso</p>
|
||||
@@ -86,7 +86,7 @@ The firmware of YubiKey is not updatable. If you want features in newer firmware
|
||||
{ width="300" }
|
||||
</figure>
|
||||
|
||||
The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://www.nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification). The Nitrokey 3 Series in general has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), Personal Identity Verification (PIV), OpenPGP, and TOTP and HOTP authentication.
|
||||
**Nitrokey** has a cost-effective security key capable of FIDO2/WebAuthn and FIDO U2F called the **Nitrokey Passkey**. For support for features such as PIV, OpenPGP, and TOTP and HOTP authentication, you need to purchase one of their other keys like the **Nitrokey 3**. Currently, only the **Nitrokey 3A Mini** has [FIDO Level 1 Certification](https://nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification).
|
||||
|
||||
[:octicons-home-16: Homepage](https://nitrokey.com){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://nitrokey.com/data-privacy-policy){ .card-link title="Privacy Policy" }
|
||||
@@ -96,26 +96,14 @@ The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://
|
||||
|
||||
</div>
|
||||
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys) shows how the different Nitrokey models compare to each other in terms of features and other specifications.
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys#:~:text=The%20Nitrokey%20Family) shows how the different Nitrokey models compare to each other in terms of features and other specifications. Refer to Nitrokey's [documentation](https://docs.nitrokey.com/nitrokeys/features) for more details about the features available on your Nitrokey.
|
||||
|
||||
Nitrokey models can be configured using the [Nitrokey app](https://nitrokey.com/download).
|
||||
|
||||
The Nitrokey 3 Series can act as a password manager. They can store up to 50 different entries, and each entry can contain login, password, comment and OTP.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Aviso</p>
|
||||
|
||||
Excluding the Nitrokey 3, Nitrokeys with HOTP and TOTP storage do not have it encrypted, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
**Nitrokey** also has the **Nitrokey Passkey**, a lower-price security key capable of [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online). This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- Gerenciador de Senhas
|
||||
- PIV
|
||||
- OpenPGP
|
||||
- Tamper-resistant smart card
|
||||
- TOTP and HOTP
|
||||
Excluding the Nitrokey 3, Nitrokeys which support HOTP and TOTP do not have encrypted storage, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: "Multifactor Authentication"
|
||||
icon: 'material/two-factor-authentication'
|
||||
title: Multifactor Authentication
|
||||
icon: material/two-factor-authentication
|
||||
description: MFA is a critical security mechanism for securing your online accounts, but some methods are stronger than others.
|
||||
---
|
||||
|
||||
@@ -64,7 +64,7 @@ If your threat model requires you to have different identities on different webs
|
||||
|
||||
#### FIDO2 / U2F
|
||||
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was U2F and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) which includes the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was [U2F](https://en.wikipedia.org/wiki/Universal_2nd_Factor) and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) which includes the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
|
||||
U2F and FIDO2 refer to the [Client to Authenticator Protocol](https://en.wikipedia.org/wiki/Client_to_Authenticator_Protocol), which is the protocol between the security key and the computer, such as a laptop or phone. It complements WebAuthn which is the component used to authenticate with the website (the "Relying Party") you're trying to log in on.
|
||||
|
||||
|
||||
@@ -96,7 +96,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, and view their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, view and edit their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
|
||||
[:octicons-home-16: Homepage](https://peergos.org){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://peergos.net/privacy.html){ .card-link title="Privacy Policy" }
|
||||
@@ -109,9 +109,9 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=peergos.android)
|
||||
- [:simple-github: GitHub](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-apple: macOS](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-linux: Linux](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://peergos.org/download#windows)
|
||||
- [:simple-apple: macOS](https://peergos.org/download#macos)
|
||||
- [:simple-linux: Linux](https://peergos.org/download#linux)
|
||||
- [:octicons-browser-16: Web](https://peergos.net)
|
||||
|
||||
</details>
|
||||
@@ -120,9 +120,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
Peergos is built on top of the [InterPlanetary File System (IPFS)](https://ipfs.tech), a peer-to-peer architecture that protects against [:material-close-outline: Censorship](basics/common-threats.md#avoiding-censorship ""){.pg-blue-gray}.
|
||||
|
||||
Peergos is primarily a web app, but you can self-host the server either as a local cache for your remote Peergos account, or as a standalone storage server which negates the need to register for a remote account and subscription. The Peergos server is a `.jar` file, which means the Java 17+ Runtime Environment ([OpenJDK download](https://azul.com/downloads)) should be installed on your machine to get it working.
|
||||
|
||||
Running a local version of Peergos alongside a registered account on their paid, hosted service allows you to access your Peergos storage without any reliance on DNS or TLS certificate authorities, and keep a copy of your data backed up to their cloud. The user experience should be the same whether you run their desktop server or just use their hosted web interface.
|
||||
Peergos has a web app, desktop apps and an Android app and you can also self-host the server. Client, server and command line interface all run from the same binary. There is a sync engine included (accessible via the desktop or android apps) for bi-directionally synchronizing a local folder with a Peergos folder, and a webdav bridge to allow other applications to access your Peergos storage.
|
||||
|
||||
Peergos was [audited](https://peergos.org/posts/security-audit-2024) in November 2024 by Radically Open Security and all issues were fixed. They were previously [audited](https://cure53.de/pentest-report_peergos.pdf) by Cure53 in June 2019, and all found issues were subsequently fixed.
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
title: "Security Keys"
|
||||
title: Security Keys
|
||||
icon: material/key-chain
|
||||
description: These security keys provide a form of phishing-immune authentication for accounts that support it.
|
||||
cover: multi-factor-authentication.webp
|
||||
@@ -10,7 +10,7 @@ cover: multi-factor-authentication.webp
|
||||
- [:material-target-account: Targeted Attacks](basics/common-threats.md#attacks-against-specific-individuals){ .pg-red }
|
||||
- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange }
|
||||
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the FIDO2 security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the [FIDO2](basics/multi-factor-authentication.md#fido-fast-identity-online) security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
|
||||
## Yubico Security Key
|
||||
|
||||
@@ -20,7 +20,7 @@ A physical **security key** adds a very strong layer of protection to your onlin
|
||||
{ width="315" }
|
||||
</figure>
|
||||
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO U2F, and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO Universal 2nd Factor (U2F), and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/security-key){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -35,10 +35,10 @@ These keys are available in both USB-C and USB-A variants, and both options supp
|
||||
This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- [Yubico Authenticator](https://yubico.com/products/yubico-authenticator)
|
||||
- CCID Smart Card support (PIV-compatibile)
|
||||
- CCID Smart Card support (PIV-compatible)
|
||||
- OpenPGP
|
||||
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) of products instead.
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) series instead.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
@@ -55,7 +55,7 @@ The firmware of Yubico's Security Keys is not updatable. If you want features in
|
||||
{ width="400" }
|
||||
</figure>
|
||||
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The YubiKey 5 Series has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), [Yubico OTP](basics/multi-factor-authentication.md#yubico-otp), [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), [OpenPGP](https://developers.yubico.com/PGP), and [TOTP and HOTP](https://developers.yubico.com/OATH) authentication.
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The **YubiKey 5 Series** has a wide range of features such as FIDO2/WebAuthn and FIDO U2F, [TOTP and HOTP](https://developers.yubico.com/OATH) authentication, [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), and [OpenPGP](https://developers.yubico.com/PGP).
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/yubikey-5-overview){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -69,7 +69,7 @@ The [comparison table](https://yubico.com/store/compare) shows how the YubiKeys
|
||||
|
||||
YubiKeys can be programmed using the [YubiKey Manager](https://yubico.com/support/download/yubikey-manager) or [YubiKey Personalization Tools](https://yubico.com/support/download/yubikey-personalization-tools). For managing TOTP codes, you can use the [Yubico Authenticator](https://yubico.com/products/yubico-authenticator). All of Yubico's clients are open source.
|
||||
|
||||
For models which support HOTP and TOTP, there are 2 slots in the OTP interface which could be used for HOTP and 32 slots to store TOTP secrets. These secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
For models which [support HOTP and TOTP](https://support.yubico.com/hc/articles/360013790319-How-many-accounts-can-I-register-my-YubiKey-with), the secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
@@ -86,7 +86,7 @@ The firmware of YubiKey is not updatable. If you want features in newer firmware
|
||||
{ width="300" }
|
||||
</figure>
|
||||
|
||||
The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://www.nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification). The Nitrokey 3 Series in general has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), Personal Identity Verification (PIV), OpenPGP, and TOTP and HOTP authentication.
|
||||
**Nitrokey** has a cost-effective security key capable of FIDO2/WebAuthn and FIDO U2F called the **Nitrokey Passkey**. For support for features such as PIV, OpenPGP, and TOTP and HOTP authentication, you need to purchase one of their other keys like the **Nitrokey 3**. Currently, only the **Nitrokey 3A Mini** has [FIDO Level 1 Certification](https://nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification).
|
||||
|
||||
[:octicons-home-16: Homepage](https://nitrokey.com){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://nitrokey.com/data-privacy-policy){ .card-link title="Privacy Policy" }
|
||||
@@ -96,26 +96,14 @@ The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://
|
||||
|
||||
</div>
|
||||
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys) shows how the different Nitrokey models compare to each other in terms of features and other specifications.
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys#:~:text=The%20Nitrokey%20Family) shows how the different Nitrokey models compare to each other in terms of features and other specifications. Refer to Nitrokey's [documentation](https://docs.nitrokey.com/nitrokeys/features) for more details about the features available on your Nitrokey.
|
||||
|
||||
Nitrokey models can be configured using the [Nitrokey app](https://nitrokey.com/download).
|
||||
|
||||
The Nitrokey 3 Series can act as a password manager. They can store up to 50 different entries, and each entry can contain login, password, comment and OTP.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Excluding the Nitrokey 3, Nitrokeys with HOTP and TOTP storage do not have it encrypted, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
**Nitrokey** also has the **Nitrokey Passkey**, a lower-price security key capable of [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online). This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- Gestor de Palavras-Passe
|
||||
- PIV
|
||||
- OpenPGP
|
||||
- Tamper-resistant smart card
|
||||
- TOTP and HOTP
|
||||
Excluding the Nitrokey 3, Nitrokeys which support HOTP and TOTP do not have encrypted storage, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: "Многофакторная аутентификация"
|
||||
icon: 'material/two-factor-authentication'
|
||||
title: Многофакторная аутентификация
|
||||
icon: material/two-factor-authentication
|
||||
description: MFA - это важнейший механизм безопасности для защиты ваших учетных записей в интернете, однако некоторые методы MFA безопаснее, чем другие.
|
||||
---
|
||||
|
||||
@@ -64,7 +64,7 @@ Yubico OTP - это протокол аутентификации, обычно
|
||||
|
||||
#### FIDO (Fast IDentity Online)
|
||||
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) включает в себя ряд стандартов, сначала был U2F, а затем [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project), который включает в себя веб-стандарт [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was [U2F](https://en.wikipedia.org/wiki/Universal_2nd_Factor) and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) which includes the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
|
||||
U2F и FIDO2 относятся к [Client to Authenticator Protocol](https://en.wikipedia.org/wiki/Client_to_Authenticator_Protocol), который представляет собой протокол между ключом безопасности и компьютером, например ноутбуком или телефоном. Он дополняет WebAuthn, который является компонентом, используемым для аутентификации на сайте ("Relying Party"), на котором вы пытаетесь залогиниться.
|
||||
|
||||
|
||||
@@ -96,7 +96,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, and view their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, view and edit their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
|
||||
[:octicons-home-16: Homepage](https://peergos.org){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://peergos.net/privacy.html){ .card-link title="Privacy Policy" }
|
||||
@@ -109,9 +109,9 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=peergos.android)
|
||||
- [:simple-github: GitHub](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-apple: macOS](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-linux: Linux](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://peergos.org/download#windows)
|
||||
- [:simple-apple: macOS](https://peergos.org/download#macos)
|
||||
- [:simple-linux: Linux](https://peergos.org/download#linux)
|
||||
- [:octicons-browser-16: Web](https://peergos.net)
|
||||
|
||||
</details>
|
||||
@@ -120,9 +120,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
Peergos is built on top of the [InterPlanetary File System (IPFS)](https://ipfs.tech), a peer-to-peer architecture that protects against [:material-close-outline: Censorship](basics/common-threats.md#avoiding-censorship ""){.pg-blue-gray}.
|
||||
|
||||
Peergos is primarily a web app, but you can self-host the server either as a local cache for your remote Peergos account, or as a standalone storage server which negates the need to register for a remote account and subscription. The Peergos server is a `.jar` file, which means the Java 17+ Runtime Environment ([OpenJDK download](https://azul.com/downloads)) should be installed on your machine to get it working.
|
||||
|
||||
Running a local version of Peergos alongside a registered account on their paid, hosted service allows you to access your Peergos storage without any reliance on DNS or TLS certificate authorities, and keep a copy of your data backed up to their cloud. The user experience should be the same whether you run their desktop server or just use their hosted web interface.
|
||||
Peergos has a web app, desktop apps and an Android app and you can also self-host the server. Client, server and command line interface all run from the same binary. There is a sync engine included (accessible via the desktop or android apps) for bi-directionally synchronizing a local folder with a Peergos folder, and a webdav bridge to allow other applications to access your Peergos storage.
|
||||
|
||||
Peergos was [audited](https://peergos.org/posts/security-audit-2024) in November 2024 by Radically Open Security and all issues were fixed. They were previously [audited](https://cure53.de/pentest-report_peergos.pdf) by Cure53 in June 2019, and all found issues were subsequently fixed.
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
title: "Security Keys"
|
||||
title: Security Keys
|
||||
icon: material/key-chain
|
||||
description: These security keys provide a form of phishing-immune authentication for accounts that support it.
|
||||
cover: multi-factor-authentication.webp
|
||||
@@ -10,7 +10,7 @@ cover: multi-factor-authentication.webp
|
||||
- [:material-target-account: Targeted Attacks](basics/common-threats.md#attacks-against-specific-individuals){ .pg-red }
|
||||
- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange }
|
||||
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the FIDO2 security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the [FIDO2](basics/multi-factor-authentication.md#fido-fast-identity-online) security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
|
||||
## Yubico Security Key
|
||||
|
||||
@@ -20,7 +20,7 @@ A physical **security key** adds a very strong layer of protection to your onlin
|
||||
{ width="315" }
|
||||
</figure>
|
||||
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO U2F, and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO Universal 2nd Factor (U2F), and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/security-key){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -35,10 +35,10 @@ These keys are available in both USB-C and USB-A variants, and both options supp
|
||||
This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- [Yubico Authenticator](https://yubico.com/products/yubico-authenticator)
|
||||
- CCID Smart Card support (PIV-compatibile)
|
||||
- CCID Smart Card support (PIV-compatible)
|
||||
- OpenPGP
|
||||
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) of products instead.
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) series instead.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Предупреждение</p>
|
||||
@@ -55,7 +55,7 @@ The firmware of Yubico's Security Keys is not updatable. If you want features in
|
||||
{ width="400" }
|
||||
</figure>
|
||||
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The YubiKey 5 Series has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), [Yubico OTP](basics/multi-factor-authentication.md#yubico-otp), [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), [OpenPGP](https://developers.yubico.com/PGP), and [TOTP and HOTP](https://developers.yubico.com/OATH) authentication.
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The **YubiKey 5 Series** has a wide range of features such as FIDO2/WebAuthn and FIDO U2F, [TOTP and HOTP](https://developers.yubico.com/OATH) authentication, [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), and [OpenPGP](https://developers.yubico.com/PGP).
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/yubikey-5-overview){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -69,7 +69,7 @@ The [comparison table](https://yubico.com/store/compare) shows how the YubiKeys
|
||||
|
||||
YubiKeys can be programmed using the [YubiKey Manager](https://yubico.com/support/download/yubikey-manager) or [YubiKey Personalization Tools](https://yubico.com/support/download/yubikey-personalization-tools). For managing TOTP codes, you can use the [Yubico Authenticator](https://yubico.com/products/yubico-authenticator). All of Yubico's clients are open source.
|
||||
|
||||
For models which support HOTP and TOTP, there are 2 slots in the OTP interface which could be used for HOTP and 32 slots to store TOTP secrets. These secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
For models which [support HOTP and TOTP](https://support.yubico.com/hc/articles/360013790319-How-many-accounts-can-I-register-my-YubiKey-with), the secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Предупреждение</p>
|
||||
@@ -86,7 +86,7 @@ The firmware of YubiKey is not updatable. If you want features in newer firmware
|
||||
{ width="300" }
|
||||
</figure>
|
||||
|
||||
The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://www.nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification). The Nitrokey 3 Series in general has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), Personal Identity Verification (PIV), OpenPGP, and TOTP and HOTP authentication.
|
||||
**Nitrokey** has a cost-effective security key capable of FIDO2/WebAuthn and FIDO U2F called the **Nitrokey Passkey**. For support for features such as PIV, OpenPGP, and TOTP and HOTP authentication, you need to purchase one of their other keys like the **Nitrokey 3**. Currently, only the **Nitrokey 3A Mini** has [FIDO Level 1 Certification](https://nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification).
|
||||
|
||||
[:octicons-home-16: Homepage](https://nitrokey.com){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://nitrokey.com/data-privacy-policy){ .card-link title="Privacy Policy" }
|
||||
@@ -96,26 +96,14 @@ The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://
|
||||
|
||||
</div>
|
||||
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys) shows how the different Nitrokey models compare to each other in terms of features and other specifications.
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys#:~:text=The%20Nitrokey%20Family) shows how the different Nitrokey models compare to each other in terms of features and other specifications. Refer to Nitrokey's [documentation](https://docs.nitrokey.com/nitrokeys/features) for more details about the features available on your Nitrokey.
|
||||
|
||||
Nitrokey models can be configured using the [Nitrokey app](https://nitrokey.com/download).
|
||||
|
||||
The Nitrokey 3 Series can act as a password manager. They can store up to 50 different entries, and each entry can contain login, password, comment and OTP.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Предупреждение</p>
|
||||
|
||||
Excluding the Nitrokey 3, Nitrokeys with HOTP and TOTP storage do not have it encrypted, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
**Nitrokey** also has the **Nitrokey Passkey**, a lower-price security key capable of [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online). This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- Менеджер паролей
|
||||
- PIV
|
||||
- OpenPGP
|
||||
- Tamper-resistant smart card
|
||||
- TOTP and HOTP
|
||||
Excluding the Nitrokey 3, Nitrokeys which support HOTP and TOTP do not have encrypted storage, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: "Multifactor Authentication"
|
||||
icon: 'material/two-factor-authentication'
|
||||
title: Multifactor Authentication
|
||||
icon: material/two-factor-authentication
|
||||
description: MFA is a critical security mechanism for securing your online accounts, but some methods are stronger than others.
|
||||
---
|
||||
|
||||
@@ -64,7 +64,7 @@ If your threat model requires you to have different identities on different webs
|
||||
|
||||
#### FIDO (Fast IDentity Online)
|
||||
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was U2F and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) which includes the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was [U2F](https://en.wikipedia.org/wiki/Universal_2nd_Factor) and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) which includes the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
|
||||
U2F and FIDO2 refer to the [Client to Authenticator Protocol](https://en.wikipedia.org/wiki/Client_to_Authenticator_Protocol), which is the protocol between the security key and the computer, such as a laptop or phone. It complements WebAuthn which is the component used to authenticate with the website (the "Relying Party") you're trying to log in on.
|
||||
|
||||
|
||||
@@ -96,7 +96,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, and view their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, view and edit their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
|
||||
[:octicons-home-16: Homepage](https://peergos.org){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://peergos.net/privacy.html){ .card-link title="Privacy Policy" }
|
||||
@@ -109,9 +109,9 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=peergos.android)
|
||||
- [:simple-github: GitHub](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-apple: macOS](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-linux: Linux](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://peergos.org/download#windows)
|
||||
- [:simple-apple: macOS](https://peergos.org/download#macos)
|
||||
- [:simple-linux: Linux](https://peergos.org/download#linux)
|
||||
- [:octicons-browser-16: Web](https://peergos.net)
|
||||
|
||||
</details>
|
||||
@@ -120,9 +120,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
Peergos is built on top of the [InterPlanetary File System (IPFS)](https://ipfs.tech), a peer-to-peer architecture that protects against [:material-close-outline: Censorship](basics/common-threats.md#avoiding-censorship ""){.pg-blue-gray}.
|
||||
|
||||
Peergos is primarily a web app, but you can self-host the server either as a local cache for your remote Peergos account, or as a standalone storage server which negates the need to register for a remote account and subscription. The Peergos server is a `.jar` file, which means the Java 17+ Runtime Environment ([OpenJDK download](https://azul.com/downloads)) should be installed on your machine to get it working.
|
||||
|
||||
Running a local version of Peergos alongside a registered account on their paid, hosted service allows you to access your Peergos storage without any reliance on DNS or TLS certificate authorities, and keep a copy of your data backed up to their cloud. The user experience should be the same whether you run their desktop server or just use their hosted web interface.
|
||||
Peergos has a web app, desktop apps and an Android app and you can also self-host the server. Client, server and command line interface all run from the same binary. There is a sync engine included (accessible via the desktop or android apps) for bi-directionally synchronizing a local folder with a Peergos folder, and a webdav bridge to allow other applications to access your Peergos storage.
|
||||
|
||||
Peergos was [audited](https://peergos.org/posts/security-audit-2024) in November 2024 by Radically Open Security and all issues were fixed. They were previously [audited](https://cure53.de/pentest-report_peergos.pdf) by Cure53 in June 2019, and all found issues were subsequently fixed.
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
title: "Säkerhetsnycklar"
|
||||
title: Säkerhetsnycklar
|
||||
icon: material/key-chain
|
||||
description: These security keys provide a form of phishing-immune authentication for accounts that support it.
|
||||
cover: multi-factor-authentication.webp
|
||||
@@ -10,7 +10,7 @@ cover: multi-factor-authentication.webp
|
||||
- [:material-target-account: Targeted Attacks](basics/common-threats.md#attacks-against-specific-individuals){ .pg-red }
|
||||
- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange }
|
||||
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the FIDO2 security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the [FIDO2](basics/multi-factor-authentication.md#fido-fast-identity-online) security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
|
||||
## Yubico Security Key
|
||||
|
||||
@@ -20,7 +20,7 @@ A physical **security key** adds a very strong layer of protection to your onlin
|
||||
{ width="315" }
|
||||
</figure>
|
||||
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO U2F, and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO Universal 2nd Factor (U2F), and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/security-key){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -35,10 +35,10 @@ These keys are available in both USB-C and USB-A variants, and both options supp
|
||||
This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- [Yubico Authenticator](https://yubico.com/products/yubico-authenticator)
|
||||
- CCID Smart Card support (PIV-compatibile)
|
||||
- CCID Smart Card support (PIV-compatible)
|
||||
- OpenPGP
|
||||
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) of products instead.
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) series instead.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Varning</p>
|
||||
@@ -55,7 +55,7 @@ The firmware of Yubico's Security Keys is not updatable. If you want features in
|
||||
{ width="400" }
|
||||
</figure>
|
||||
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The YubiKey 5 Series has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), [Yubico OTP](basics/multi-factor-authentication.md#yubico-otp), [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), [OpenPGP](https://developers.yubico.com/PGP), and [TOTP and HOTP](https://developers.yubico.com/OATH) authentication.
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The **YubiKey 5 Series** has a wide range of features such as FIDO2/WebAuthn and FIDO U2F, [TOTP and HOTP](https://developers.yubico.com/OATH) authentication, [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), and [OpenPGP](https://developers.yubico.com/PGP).
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/yubikey-5-overview){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -69,7 +69,7 @@ The [comparison table](https://yubico.com/store/compare) shows how the YubiKeys
|
||||
|
||||
YubiKeys can be programmed using the [YubiKey Manager](https://yubico.com/support/download/yubikey-manager) or [YubiKey Personalization Tools](https://yubico.com/support/download/yubikey-personalization-tools). For managing TOTP codes, you can use the [Yubico Authenticator](https://yubico.com/products/yubico-authenticator). All of Yubico's clients are open source.
|
||||
|
||||
For models which support HOTP and TOTP, there are 2 slots in the OTP interface which could be used for HOTP and 32 slots to store TOTP secrets. These secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
For models which [support HOTP and TOTP](https://support.yubico.com/hc/articles/360013790319-How-many-accounts-can-I-register-my-YubiKey-with), the secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Varning</p>
|
||||
@@ -86,7 +86,7 @@ The firmware of YubiKey is not updatable. If you want features in newer firmware
|
||||
{ width="300" }
|
||||
</figure>
|
||||
|
||||
The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://www.nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification). The Nitrokey 3 Series in general has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), Personal Identity Verification (PIV), OpenPGP, and TOTP and HOTP authentication.
|
||||
**Nitrokey** has a cost-effective security key capable of FIDO2/WebAuthn and FIDO U2F called the **Nitrokey Passkey**. For support for features such as PIV, OpenPGP, and TOTP and HOTP authentication, you need to purchase one of their other keys like the **Nitrokey 3**. Currently, only the **Nitrokey 3A Mini** has [FIDO Level 1 Certification](https://nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification).
|
||||
|
||||
[:octicons-home-16: Homepage](https://nitrokey.com){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://nitrokey.com/data-privacy-policy){ .card-link title="Privacy Policy" }
|
||||
@@ -96,26 +96,14 @@ The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://
|
||||
|
||||
</div>
|
||||
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys) shows how the different Nitrokey models compare to each other in terms of features and other specifications.
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys#:~:text=The%20Nitrokey%20Family) shows how the different Nitrokey models compare to each other in terms of features and other specifications. Refer to Nitrokey's [documentation](https://docs.nitrokey.com/nitrokeys/features) for more details about the features available on your Nitrokey.
|
||||
|
||||
Nitrokey models can be configured using the [Nitrokey app](https://nitrokey.com/download).
|
||||
|
||||
The Nitrokey 3 Series can act as a password manager. They can store up to 50 different entries, and each entry can contain login, password, comment and OTP.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Varning</p>
|
||||
|
||||
Excluding the Nitrokey 3, Nitrokeys with HOTP and TOTP storage do not have it encrypted, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
**Nitrokey** also has the **Nitrokey Passkey**, a lower-price security key capable of [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online). This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- Password Manager
|
||||
- PIV
|
||||
- OpenPGP
|
||||
- Tamper-resistant smart card
|
||||
- TOTP and HOTP
|
||||
Excluding the Nitrokey 3, Nitrokeys which support HOTP and TOTP do not have encrypted storage, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: "Köp faktorly tanamak"
|
||||
icon: 'material/two-factor-authentication'
|
||||
title: Köp faktorly tanamak
|
||||
icon: material/two-factor-authentication
|
||||
description: MFA is a critical security mechanism for securing your online accounts, but some methods are stronger than others.
|
||||
---
|
||||
|
||||
@@ -64,7 +64,7 @@ If your threat model requires you to have different identities on different webs
|
||||
|
||||
#### FIDO (Fast IDentity Online)
|
||||
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was U2F and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) which includes the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was [U2F](https://en.wikipedia.org/wiki/Universal_2nd_Factor) and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) which includes the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
|
||||
U2F and FIDO2 refer to the [Client to Authenticator Protocol](https://en.wikipedia.org/wiki/Client_to_Authenticator_Protocol), which is the protocol between the security key and the computer, such as a laptop or phone. It complements WebAuthn which is the component used to authenticate with the website (the "Relying Party") you're trying to log in on.
|
||||
|
||||
|
||||
@@ -96,7 +96,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, and view their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, view and edit their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
|
||||
[:octicons-home-16: Homepage](https://peergos.org){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://peergos.net/privacy.html){ .card-link title="Privacy Policy" }
|
||||
@@ -109,9 +109,9 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=peergos.android)
|
||||
- [:simple-github: GitHub](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-apple: macOS](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-linux: Linux](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://peergos.org/download#windows)
|
||||
- [:simple-apple: macOS](https://peergos.org/download#macos)
|
||||
- [:simple-linux: Linux](https://peergos.org/download#linux)
|
||||
- [:octicons-browser-16: Web](https://peergos.net)
|
||||
|
||||
</details>
|
||||
@@ -120,9 +120,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
Peergos is built on top of the [InterPlanetary File System (IPFS)](https://ipfs.tech), a peer-to-peer architecture that protects against [:material-close-outline: Censorship](basics/common-threats.md#avoiding-censorship ""){.pg-blue-gray}.
|
||||
|
||||
Peergos is primarily a web app, but you can self-host the server either as a local cache for your remote Peergos account, or as a standalone storage server which negates the need to register for a remote account and subscription. The Peergos server is a `.jar` file, which means the Java 17+ Runtime Environment ([OpenJDK download](https://azul.com/downloads)) should be installed on your machine to get it working.
|
||||
|
||||
Running a local version of Peergos alongside a registered account on their paid, hosted service allows you to access your Peergos storage without any reliance on DNS or TLS certificate authorities, and keep a copy of your data backed up to their cloud. The user experience should be the same whether you run their desktop server or just use their hosted web interface.
|
||||
Peergos has a web app, desktop apps and an Android app and you can also self-host the server. Client, server and command line interface all run from the same binary. There is a sync engine included (accessible via the desktop or android apps) for bi-directionally synchronizing a local folder with a Peergos folder, and a webdav bridge to allow other applications to access your Peergos storage.
|
||||
|
||||
Peergos was [audited](https://peergos.org/posts/security-audit-2024) in November 2024 by Radically Open Security and all issues were fixed. They were previously [audited](https://cure53.de/pentest-report_peergos.pdf) by Cure53 in June 2019, and all found issues were subsequently fixed.
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
title: "Security Keys"
|
||||
title: Security Keys
|
||||
icon: material/key-chain
|
||||
description: These security keys provide a form of phishing-immune authentication for accounts that support it.
|
||||
cover: Çok Faktörlü Kimlik Doğrulama
|
||||
@@ -10,7 +10,7 @@ cover: Çok Faktörlü Kimlik Doğrulama
|
||||
- [:material-target-account: Targeted Attacks](basics/common-threats.md#attacks-against-specific-individuals){ .pg-red }
|
||||
- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange }
|
||||
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the FIDO2 security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the [FIDO2](basics/multi-factor-authentication.md#fido-fast-identity-online) security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
|
||||
## Yubico Security Key
|
||||
|
||||
@@ -20,7 +20,7 @@ A physical **security key** adds a very strong layer of protection to your onlin
|
||||
{ width="315" }
|
||||
</figure>
|
||||
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO U2F, and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO Universal 2nd Factor (U2F), and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/security-key){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -35,10 +35,10 @@ These keys are available in both USB-C and USB-A variants, and both options supp
|
||||
This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- [Yubico Authenticator](https://yubico.com/products/yubico-authenticator)
|
||||
- CCID Smart Card support (PIV-compatibile)
|
||||
- CCID Smart Card support (PIV-compatible)
|
||||
- OpenPGP
|
||||
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) of products instead.
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) series instead.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
@@ -55,7 +55,7 @@ The firmware of Yubico's Security Keys is not updatable. If you want features in
|
||||
{ width="400" }
|
||||
</figure>
|
||||
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The YubiKey 5 Series has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), [Yubico OTP](basics/multi-factor-authentication.md#yubico-otp), [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), [OpenPGP](https://developers.yubico.com/PGP), and [TOTP and HOTP](https://developers.yubico.com/OATH) authentication.
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The **YubiKey 5 Series** has a wide range of features such as FIDO2/WebAuthn and FIDO U2F, [TOTP and HOTP](https://developers.yubico.com/OATH) authentication, [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), and [OpenPGP](https://developers.yubico.com/PGP).
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/yubikey-5-overview){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -69,7 +69,7 @@ The [comparison table](https://yubico.com/store/compare) shows how the YubiKeys
|
||||
|
||||
YubiKeys can be programmed using the [YubiKey Manager](https://yubico.com/support/download/yubikey-manager) or [YubiKey Personalization Tools](https://yubico.com/support/download/yubikey-personalization-tools). For managing TOTP codes, you can use the [Yubico Authenticator](https://yubico.com/products/yubico-authenticator). All of Yubico's clients are open source.
|
||||
|
||||
For models which support HOTP and TOTP, there are 2 slots in the OTP interface which could be used for HOTP and 32 slots to store TOTP secrets. These secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
For models which [support HOTP and TOTP](https://support.yubico.com/hc/articles/360013790319-How-many-accounts-can-I-register-my-YubiKey-with), the secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
@@ -86,7 +86,7 @@ The firmware of YubiKey is not updatable. If you want features in newer firmware
|
||||
{ width="300" }
|
||||
</figure>
|
||||
|
||||
The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://www.nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification). The Nitrokey 3 Series in general has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), Personal Identity Verification (PIV), OpenPGP, and TOTP and HOTP authentication.
|
||||
**Nitrokey** has a cost-effective security key capable of FIDO2/WebAuthn and FIDO U2F called the **Nitrokey Passkey**. For support for features such as PIV, OpenPGP, and TOTP and HOTP authentication, you need to purchase one of their other keys like the **Nitrokey 3**. Currently, only the **Nitrokey 3A Mini** has [FIDO Level 1 Certification](https://nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification).
|
||||
|
||||
[:octicons-home-16: Homepage](https://nitrokey.com){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://nitrokey.com/data-privacy-policy){ .card-link title="Privacy Policy" }
|
||||
@@ -96,26 +96,14 @@ The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://
|
||||
|
||||
</div>
|
||||
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys) shows how the different Nitrokey models compare to each other in terms of features and other specifications.
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys#:~:text=The%20Nitrokey%20Family) shows how the different Nitrokey models compare to each other in terms of features and other specifications. Refer to Nitrokey's [documentation](https://docs.nitrokey.com/nitrokeys/features) for more details about the features available on your Nitrokey.
|
||||
|
||||
Nitrokey models can be configured using the [Nitrokey app](https://nitrokey.com/download).
|
||||
|
||||
The Nitrokey 3 Series can act as a password manager. They can store up to 50 different entries, and each entry can contain login, password, comment and OTP.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Excluding the Nitrokey 3, Nitrokeys with HOTP and TOTP storage do not have it encrypted, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
**Nitrokey** also has the **Nitrokey Passkey**, a lower-price security key capable of [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online). This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- Parola Yöneticisi
|
||||
- PIV
|
||||
- OpenPGP
|
||||
- Tamper-resistant smart card
|
||||
- TOTP and HOTP
|
||||
Excluding the Nitrokey 3, Nitrokeys which support HOTP and TOTP do not have encrypted storage, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: "Multifactor Authentication"
|
||||
icon: 'material/two-factor-authentication'
|
||||
title: Multifactor Authentication
|
||||
icon: material/two-factor-authentication
|
||||
description: MFA is a critical security mechanism for securing your online accounts, but some methods are stronger than others.
|
||||
---
|
||||
|
||||
@@ -64,7 +64,7 @@ If your threat model requires you to have different identities on different webs
|
||||
|
||||
#### FIDO (Fast IDentity Online)
|
||||
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was U2F and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) which includes the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was [U2F](https://en.wikipedia.org/wiki/Universal_2nd_Factor) and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) which includes the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
|
||||
U2F and FIDO2 refer to the [Client to Authenticator Protocol](https://en.wikipedia.org/wiki/Client_to_Authenticator_Protocol), which is the protocol between the security key and the computer, such as a laptop or phone. It complements WebAuthn which is the component used to authenticate with the website (the "Relying Party") you're trying to log in on.
|
||||
|
||||
|
||||
@@ -96,7 +96,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, and view their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, view and edit their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
|
||||
[:octicons-home-16: Homepage](https://peergos.org){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://peergos.net/privacy.html){ .card-link title="Privacy Policy" }
|
||||
@@ -109,9 +109,9 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=peergos.android)
|
||||
- [:simple-github: GitHub](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-apple: macOS](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-linux: Linux](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://peergos.org/download#windows)
|
||||
- [:simple-apple: macOS](https://peergos.org/download#macos)
|
||||
- [:simple-linux: Linux](https://peergos.org/download#linux)
|
||||
- [:octicons-browser-16: Web](https://peergos.net)
|
||||
|
||||
</details>
|
||||
@@ -120,9 +120,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
Peergos is built on top of the [InterPlanetary File System (IPFS)](https://ipfs.tech), a peer-to-peer architecture that protects against [:material-close-outline: Censorship](basics/common-threats.md#avoiding-censorship ""){.pg-blue-gray}.
|
||||
|
||||
Peergos is primarily a web app, but you can self-host the server either as a local cache for your remote Peergos account, or as a standalone storage server which negates the need to register for a remote account and subscription. The Peergos server is a `.jar` file, which means the Java 17+ Runtime Environment ([OpenJDK download](https://azul.com/downloads)) should be installed on your machine to get it working.
|
||||
|
||||
Running a local version of Peergos alongside a registered account on their paid, hosted service allows you to access your Peergos storage without any reliance on DNS or TLS certificate authorities, and keep a copy of your data backed up to their cloud. The user experience should be the same whether you run their desktop server or just use their hosted web interface.
|
||||
Peergos has a web app, desktop apps and an Android app and you can also self-host the server. Client, server and command line interface all run from the same binary. There is a sync engine included (accessible via the desktop or android apps) for bi-directionally synchronizing a local folder with a Peergos folder, and a webdav bridge to allow other applications to access your Peergos storage.
|
||||
|
||||
Peergos was [audited](https://peergos.org/posts/security-audit-2024) in November 2024 by Radically Open Security and all issues were fixed. They were previously [audited](https://cure53.de/pentest-report_peergos.pdf) by Cure53 in June 2019, and all found issues were subsequently fixed.
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
title: "Security Keys"
|
||||
title: Security Keys
|
||||
icon: material/key-chain
|
||||
description: These security keys provide a form of phishing-immune authentication for accounts that support it.
|
||||
cover: multi-factor-authentication.webp
|
||||
@@ -10,7 +10,7 @@ cover: multi-factor-authentication.webp
|
||||
- [:material-target-account: Targeted Attacks](basics/common-threats.md#attacks-against-specific-individuals){ .pg-red }
|
||||
- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange }
|
||||
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the FIDO2 security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the [FIDO2](basics/multi-factor-authentication.md#fido-fast-identity-online) security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
|
||||
## Yubico Security Key
|
||||
|
||||
@@ -20,7 +20,7 @@ A physical **security key** adds a very strong layer of protection to your onlin
|
||||
{ width="315" }
|
||||
</figure>
|
||||
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO U2F, and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO Universal 2nd Factor (U2F), and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/security-key){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -35,10 +35,10 @@ These keys are available in both USB-C and USB-A variants, and both options supp
|
||||
This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- [Yubico Authenticator](https://yubico.com/products/yubico-authenticator)
|
||||
- CCID Smart Card support (PIV-compatibile)
|
||||
- CCID Smart Card support (PIV-compatible)
|
||||
- OpenPGP
|
||||
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) of products instead.
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) series instead.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
@@ -55,7 +55,7 @@ The firmware of Yubico's Security Keys is not updatable. If you want features in
|
||||
{ width="400" }
|
||||
</figure>
|
||||
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The YubiKey 5 Series has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), [Yubico OTP](basics/multi-factor-authentication.md#yubico-otp), [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), [OpenPGP](https://developers.yubico.com/PGP), and [TOTP and HOTP](https://developers.yubico.com/OATH) authentication.
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The **YubiKey 5 Series** has a wide range of features such as FIDO2/WebAuthn and FIDO U2F, [TOTP and HOTP](https://developers.yubico.com/OATH) authentication, [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), and [OpenPGP](https://developers.yubico.com/PGP).
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/yubikey-5-overview){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -69,7 +69,7 @@ The [comparison table](https://yubico.com/store/compare) shows how the YubiKeys
|
||||
|
||||
YubiKeys can be programmed using the [YubiKey Manager](https://yubico.com/support/download/yubikey-manager) or [YubiKey Personalization Tools](https://yubico.com/support/download/yubikey-personalization-tools). For managing TOTP codes, you can use the [Yubico Authenticator](https://yubico.com/products/yubico-authenticator). All of Yubico's clients are open source.
|
||||
|
||||
For models which support HOTP and TOTP, there are 2 slots in the OTP interface which could be used for HOTP and 32 slots to store TOTP secrets. These secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
For models which [support HOTP and TOTP](https://support.yubico.com/hc/articles/360013790319-How-many-accounts-can-I-register-my-YubiKey-with), the secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
@@ -86,7 +86,7 @@ The firmware of YubiKey is not updatable. If you want features in newer firmware
|
||||
{ width="300" }
|
||||
</figure>
|
||||
|
||||
The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://www.nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification). The Nitrokey 3 Series in general has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), Personal Identity Verification (PIV), OpenPGP, and TOTP and HOTP authentication.
|
||||
**Nitrokey** has a cost-effective security key capable of FIDO2/WebAuthn and FIDO U2F called the **Nitrokey Passkey**. For support for features such as PIV, OpenPGP, and TOTP and HOTP authentication, you need to purchase one of their other keys like the **Nitrokey 3**. Currently, only the **Nitrokey 3A Mini** has [FIDO Level 1 Certification](https://nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification).
|
||||
|
||||
[:octicons-home-16: Homepage](https://nitrokey.com){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://nitrokey.com/data-privacy-policy){ .card-link title="Privacy Policy" }
|
||||
@@ -96,26 +96,14 @@ The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://
|
||||
|
||||
</div>
|
||||
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys) shows how the different Nitrokey models compare to each other in terms of features and other specifications.
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys#:~:text=The%20Nitrokey%20Family) shows how the different Nitrokey models compare to each other in terms of features and other specifications. Refer to Nitrokey's [documentation](https://docs.nitrokey.com/nitrokeys/features) for more details about the features available on your Nitrokey.
|
||||
|
||||
Nitrokey models can be configured using the [Nitrokey app](https://nitrokey.com/download).
|
||||
|
||||
The Nitrokey 3 Series can act as a password manager. They can store up to 50 different entries, and each entry can contain login, password, comment and OTP.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Excluding the Nitrokey 3, Nitrokeys with HOTP and TOTP storage do not have it encrypted, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
**Nitrokey** also has the **Nitrokey Passkey**, a lower-price security key capable of [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online). This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- Password Manager
|
||||
- PIV
|
||||
- OpenPGP
|
||||
- Tamper-resistant smart card
|
||||
- TOTP and HOTP
|
||||
Excluding the Nitrokey 3, Nitrokeys which support HOTP and TOTP do not have encrypted storage, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: "Multifactor Authentication"
|
||||
icon: 'material/two-factor-authentication'
|
||||
title: Multifactor Authentication
|
||||
icon: material/two-factor-authentication
|
||||
description: MFA is a critical security mechanism for securing your online accounts, but some methods are stronger than others.
|
||||
---
|
||||
|
||||
@@ -64,7 +64,7 @@ If your threat model requires you to have different identities on different webs
|
||||
|
||||
#### FIDO (Fast IDentity Online)
|
||||
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was U2F and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) which includes the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was [U2F](https://en.wikipedia.org/wiki/Universal_2nd_Factor) and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) which includes the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
|
||||
U2F and FIDO2 refer to the [Client to Authenticator Protocol](https://en.wikipedia.org/wiki/Client_to_Authenticator_Protocol), which is the protocol between the security key and the computer, such as a laptop or phone. It complements WebAuthn which is the component used to authenticate with the website (the "Relying Party") you're trying to log in on.
|
||||
|
||||
|
||||
@@ -96,7 +96,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, and view their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, view and edit their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
|
||||
[:octicons-home-16: Homepage](https://peergos.org){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://peergos.net/privacy.html){ .card-link title="Privacy Policy" }
|
||||
@@ -109,9 +109,9 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=peergos.android)
|
||||
- [:simple-github: GitHub](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-apple: macOS](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-linux: Linux](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://peergos.org/download#windows)
|
||||
- [:simple-apple: macOS](https://peergos.org/download#macos)
|
||||
- [:simple-linux: Linux](https://peergos.org/download#linux)
|
||||
- [:octicons-browser-16: Web](https://peergos.net)
|
||||
|
||||
</details>
|
||||
@@ -120,9 +120,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
Peergos is built on top of the [InterPlanetary File System (IPFS)](https://ipfs.tech), a peer-to-peer architecture that protects against [:material-close-outline: Censorship](basics/common-threats.md#avoiding-censorship ""){.pg-blue-gray}.
|
||||
|
||||
Peergos is primarily a web app, but you can self-host the server either as a local cache for your remote Peergos account, or as a standalone storage server which negates the need to register for a remote account and subscription. The Peergos server is a `.jar` file, which means the Java 17+ Runtime Environment ([OpenJDK download](https://azul.com/downloads)) should be installed on your machine to get it working.
|
||||
|
||||
Running a local version of Peergos alongside a registered account on their paid, hosted service allows you to access your Peergos storage without any reliance on DNS or TLS certificate authorities, and keep a copy of your data backed up to their cloud. The user experience should be the same whether you run their desktop server or just use their hosted web interface.
|
||||
Peergos has a web app, desktop apps and an Android app and you can also self-host the server. Client, server and command line interface all run from the same binary. There is a sync engine included (accessible via the desktop or android apps) for bi-directionally synchronizing a local folder with a Peergos folder, and a webdav bridge to allow other applications to access your Peergos storage.
|
||||
|
||||
Peergos was [audited](https://peergos.org/posts/security-audit-2024) in November 2024 by Radically Open Security and all issues were fixed. They were previously [audited](https://cure53.de/pentest-report_peergos.pdf) by Cure53 in June 2019, and all found issues were subsequently fixed.
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
title: "Security Keys"
|
||||
title: Security Keys
|
||||
icon: material/key-chain
|
||||
description: These security keys provide a form of phishing-immune authentication for accounts that support it.
|
||||
cover: multi-factor-authentication.webp
|
||||
@@ -10,7 +10,7 @@ cover: multi-factor-authentication.webp
|
||||
- [:material-target-account: Targeted Attacks](basics/common-threats.md#attacks-against-specific-individuals){ .pg-red }
|
||||
- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange }
|
||||
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the FIDO2 security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the [FIDO2](basics/multi-factor-authentication.md#fido-fast-identity-online) security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
|
||||
## Yubico Security Key
|
||||
|
||||
@@ -20,7 +20,7 @@ A physical **security key** adds a very strong layer of protection to your onlin
|
||||
{ width="315" }
|
||||
</figure>
|
||||
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO U2F, and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO Universal 2nd Factor (U2F), and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/security-key){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -35,10 +35,10 @@ These keys are available in both USB-C and USB-A variants, and both options supp
|
||||
This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- [Yubico Authenticator](https://yubico.com/products/yubico-authenticator)
|
||||
- CCID Smart Card support (PIV-compatibile)
|
||||
- CCID Smart Card support (PIV-compatible)
|
||||
- OpenPGP
|
||||
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) of products instead.
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) series instead.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
@@ -55,7 +55,7 @@ The firmware of Yubico's Security Keys is not updatable. If you want features in
|
||||
{ width="400" }
|
||||
</figure>
|
||||
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The YubiKey 5 Series has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), [Yubico OTP](basics/multi-factor-authentication.md#yubico-otp), [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), [OpenPGP](https://developers.yubico.com/PGP), and [TOTP and HOTP](https://developers.yubico.com/OATH) authentication.
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The **YubiKey 5 Series** has a wide range of features such as FIDO2/WebAuthn and FIDO U2F, [TOTP and HOTP](https://developers.yubico.com/OATH) authentication, [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), and [OpenPGP](https://developers.yubico.com/PGP).
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/yubikey-5-overview){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -69,7 +69,7 @@ The [comparison table](https://yubico.com/store/compare) shows how the YubiKeys
|
||||
|
||||
YubiKeys can be programmed using the [YubiKey Manager](https://yubico.com/support/download/yubikey-manager) or [YubiKey Personalization Tools](https://yubico.com/support/download/yubikey-personalization-tools). For managing TOTP codes, you can use the [Yubico Authenticator](https://yubico.com/products/yubico-authenticator). All of Yubico's clients are open source.
|
||||
|
||||
For models which support HOTP and TOTP, there are 2 slots in the OTP interface which could be used for HOTP and 32 slots to store TOTP secrets. These secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
For models which [support HOTP and TOTP](https://support.yubico.com/hc/articles/360013790319-How-many-accounts-can-I-register-my-YubiKey-with), the secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
@@ -86,7 +86,7 @@ The firmware of YubiKey is not updatable. If you want features in newer firmware
|
||||
{ width="300" }
|
||||
</figure>
|
||||
|
||||
The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://www.nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification). The Nitrokey 3 Series in general has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), Personal Identity Verification (PIV), OpenPGP, and TOTP and HOTP authentication.
|
||||
**Nitrokey** has a cost-effective security key capable of FIDO2/WebAuthn and FIDO U2F called the **Nitrokey Passkey**. For support for features such as PIV, OpenPGP, and TOTP and HOTP authentication, you need to purchase one of their other keys like the **Nitrokey 3**. Currently, only the **Nitrokey 3A Mini** has [FIDO Level 1 Certification](https://nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification).
|
||||
|
||||
[:octicons-home-16: Homepage](https://nitrokey.com){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://nitrokey.com/data-privacy-policy){ .card-link title="Privacy Policy" }
|
||||
@@ -96,26 +96,14 @@ The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://
|
||||
|
||||
</div>
|
||||
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys) shows how the different Nitrokey models compare to each other in terms of features and other specifications.
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys#:~:text=The%20Nitrokey%20Family) shows how the different Nitrokey models compare to each other in terms of features and other specifications. Refer to Nitrokey's [documentation](https://docs.nitrokey.com/nitrokeys/features) for more details about the features available on your Nitrokey.
|
||||
|
||||
Nitrokey models can be configured using the [Nitrokey app](https://nitrokey.com/download).
|
||||
|
||||
The Nitrokey 3 Series can act as a password manager. They can store up to 50 different entries, and each entry can contain login, password, comment and OTP.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Excluding the Nitrokey 3, Nitrokeys with HOTP and TOTP storage do not have it encrypted, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
**Nitrokey** also has the **Nitrokey Passkey**, a lower-price security key capable of [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online). This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- Password Manager
|
||||
- PIV
|
||||
- OpenPGP
|
||||
- Tamper-resistant smart card
|
||||
- TOTP and HOTP
|
||||
Excluding the Nitrokey 3, Nitrokeys which support HOTP and TOTP do not have encrypted storage, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: "多重要素驗證"
|
||||
icon: 'material/two-factor-authentication'
|
||||
title: 多重要素驗證
|
||||
icon: material/two-factor-authentication
|
||||
description: 多因素驗證是保護您線上帳戶的關鍵安全機制，但有些方法比其他方法更強大。
|
||||
---
|
||||
|
||||
@@ -64,7 +64,7 @@ Yubico 驗證伺服器是雲端服務，您把信任託付給 Yubico 相信他
|
||||
|
||||
#### FIDO （ 快速線上身份驗證）
|
||||
|
||||
[FIDO ](https://en.wikipedia.org/wiki/FIDO_Alliance) 包含許多標準，首先是U2F ，然後是 [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) ，其中包括 Web 標準 [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn)。
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was [U2F](https://en.wikipedia.org/wiki/Universal_2nd_Factor) and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) which includes the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
|
||||
U2F 和 FIDO2 指的是 [Client to Authenticator Protocol](https://en.wikipedia.org/wiki/Client_to_Authenticator_Protocol)，這是安全金鑰和電腦之間的協議，例如筆記型電腦或手機。 它補充了 WebAuthn ， WebAuthn 為驗證網站登錄（ “依賴方” ）之組件。
|
||||
|
||||
|
||||
@@ -96,7 +96,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Peergos** 是去中心化協定的儲存、社交媒體和應用程式開源平台。 其提供安全且私密的空間，用戶可以在其中儲存、分享和查看照片、影片、文件等。 Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
**Peergos** 是去中心化協定的儲存、社交媒體和應用程式開源平台。 It provides a secure and private space where users can store, share, view and edit their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
|
||||
[:octicons-home-16: Homepage](https://peergos.org){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://peergos.net/privacy.html){ .card-link title="Privacy Policy" }
|
||||
@@ -109,9 +109,9 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=peergos.android)
|
||||
- [:simple-github: GitHub](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-apple: macOS](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-linux: Linux](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://peergos.org/download#windows)
|
||||
- [:simple-apple: macOS](https://peergos.org/download#macos)
|
||||
- [:simple-linux: Linux](https://peergos.org/download#linux)
|
||||
- [:octicons-browser-16: Web](https://peergos.net)
|
||||
|
||||
</details>
|
||||
@@ -120,9 +120,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
Peergos is built on top of the [InterPlanetary File System (IPFS)](https://ipfs.tech), a peer-to-peer architecture that protects against [:material-close-outline: Censorship](basics/common-threats.md#avoiding-censorship ""){.pg-blue-gray}.
|
||||
|
||||
Peergos is primarily a web app, but you can self-host the server either as a local cache for your remote Peergos account, or as a standalone storage server which negates the need to register for a remote account and subscription. The Peergos server is a `.jar` file, which means the Java 17+ Runtime Environment ([OpenJDK download](https://azul.com/downloads)) should be installed on your machine to get it working.
|
||||
|
||||
Running a local version of Peergos alongside a registered account on their paid, hosted service allows you to access your Peergos storage without any reliance on DNS or TLS certificate authorities, and keep a copy of your data backed up to their cloud. The user experience should be the same whether you run their desktop server or just use their hosted web interface.
|
||||
Peergos has a web app, desktop apps and an Android app and you can also self-host the server. Client, server and command line interface all run from the same binary. There is a sync engine included (accessible via the desktop or android apps) for bi-directionally synchronizing a local folder with a Peergos folder, and a webdav bridge to allow other applications to access your Peergos storage.
|
||||
|
||||
Peergos was [audited](https://peergos.org/posts/security-audit-2024) in November 2024 by Radically Open Security and all issues were fixed. They were previously [audited](https://cure53.de/pentest-report_peergos.pdf) by Cure53 in June 2019, and all found issues were subsequently fixed.
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
title: "安全金鑰"
|
||||
title: 安全金鑰
|
||||
icon: material/key-chain
|
||||
description: These security keys provide a form of phishing-immune authentication for accounts that support it.
|
||||
cover: multi-factor-authentication.webp
|
||||
@@ -10,7 +10,7 @@ cover: multi-factor-authentication.webp
|
||||
- [:material-target-account: 針對性攻擊](basics/common-threats.md#attacks-against-specific-individuals){ .pg-red }
|
||||
- [:material-bug-outline: 被動攻擊](basics/common-threats.md#security-and-privacy){ .pg-orange }
|
||||
|
||||
實體**安全金鑰**可為線上帳戶添加強大的保護層。 與[驗證器應用程式](multi-factor-authentication.md) 相比，FIDO2 安全金鑰協定不受網路釣魚的影響，在沒持有金鑰的情況下不會受到侵害。 Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
實體**安全金鑰**可為線上帳戶添加強大的保護層。 Compared to [authenticator apps](multi-factor-authentication.md), the [FIDO2](basics/multi-factor-authentication.md#fido-fast-identity-online) security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
|
||||
## YubiKey 安全金鑰
|
||||
|
||||
@@ -20,7 +20,7 @@ cover: multi-factor-authentication.webp
|
||||
{ width="315" }
|
||||
</figure>
|
||||
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. 它支援 FIDO2/WebAuthn 和 FIDO U2F，並且可以與大多數支援安全金鑰作為第二因素的服務以及許多密碼管理器一起使用。
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO Universal 2nd Factor (U2F), and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/security-key){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -35,10 +35,10 @@ The **Yubico Security Key** series is the most cost-effective hardware security
|
||||
此金鑰僅提供基本的 FIDO2 功能，但對於大多數人來說就足夠其需求。 安全金鑰系列**不具備**的功能為：
|
||||
|
||||
- [Yubico Authenticator](https://yubico.com/products/yubico-authenticator)
|
||||
- CCID 智慧卡支援 (PIV-compatibile)
|
||||
- CCID Smart Card support (PIV-compatible)
|
||||
- OpenPGP
|
||||
|
||||
如需要這些功能，則應該考慮高階版 [YubiKey](#yubikey) 產品。
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) series instead.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">警告</p>
|
||||
@@ -55,7 +55,7 @@ Yubico 安全金鑰的韌體不可更新。 如果您想要使用較新韌體版
|
||||
{ width="400" }
|
||||
</figure>
|
||||
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The YubiKey 5 Series has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), [Yubico OTP](basics/multi-factor-authentication.md#yubico-otp), [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), [OpenPGP](https://developers.yubico.com/PGP), and [TOTP and HOTP](https://developers.yubico.com/OATH) authentication.
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The **YubiKey 5 Series** has a wide range of features such as FIDO2/WebAuthn and FIDO U2F, [TOTP and HOTP](https://developers.yubico.com/OATH) authentication, [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), and [OpenPGP](https://developers.yubico.com/PGP).
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/yubikey-5-overview){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -69,7 +69,7 @@ The [comparison table](https://yubico.com/store/compare) shows how the YubiKeys
|
||||
|
||||
YubiKey 可以使用 [YubiKey Manager](https://yubico.com/support/download/yubikey-manager) 或 [YubiKey Personalization Tools](https://yubico.com/support/download/yubikey-personalization-tools) 來設定它。 若要管理 TOTP 程式碼，可用 [Yubico Authenticator](https://yubico.com/products/yubico-authenticator)。 Yubico 所有客戶端軟體都是開源的。
|
||||
|
||||
支援 HOTP 和 TOTP 的機型， OTP 介面中有2個插槽可用於HOTP 和32個插槽來儲存 TOTP 機密。 These secrets are stored encrypted on the key and never exposed to the devices they are plugged into. 一旦向 Yubico Authenticator 提供種子（共享祕密） ，它將只會給出六位數的代碼，但永遠不會提供種子。 此安全模型有助於限制攻擊者，即便運行 Yubico Authenticator的設備受到破壞，讓受到物理攻擊時 Yubikey 仍具抵抗力。
|
||||
For models which [support HOTP and TOTP](https://support.yubico.com/hc/articles/360013790319-How-many-accounts-can-I-register-my-YubiKey-with), the secrets are stored encrypted on the key and never exposed to the devices they are plugged into. 一旦向 Yubico Authenticator 提供種子（共享祕密） ，它將只會給出六位數的代碼，但永遠不會提供種子。 此安全模型有助於限制攻擊者，即便運行 Yubico Authenticator的設備受到破壞，讓受到物理攻擊時 Yubikey 仍具抵抗力。
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">警告</p>
|
||||
@@ -86,7 +86,7 @@ Yubikey 安全金鑰的韌體不可更新。 如果您想要使用較新韌體
|
||||
{ width="300" }
|
||||
</figure>
|
||||
|
||||
The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://www.nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification). The Nitrokey 3 Series in general has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), Personal Identity Verification (PIV), OpenPGP, and TOTP and HOTP authentication.
|
||||
**Nitrokey** has a cost-effective security key capable of FIDO2/WebAuthn and FIDO U2F called the **Nitrokey Passkey**. For support for features such as PIV, OpenPGP, and TOTP and HOTP authentication, you need to purchase one of their other keys like the **Nitrokey 3**. Currently, only the **Nitrokey 3A Mini** has [FIDO Level 1 Certification](https://nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification).
|
||||
|
||||
[:octicons-home-16: Homepage](https://nitrokey.com){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://nitrokey.com/data-privacy-policy){ .card-link title="Privacy Policy" }
|
||||
@@ -96,26 +96,14 @@ The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://
|
||||
|
||||
</div>
|
||||
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys) shows how the different Nitrokey models compare to each other in terms of features and other specifications.
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys#:~:text=The%20Nitrokey%20Family) shows how the different Nitrokey models compare to each other in terms of features and other specifications. Refer to Nitrokey's [documentation](https://docs.nitrokey.com/nitrokeys/features) for more details about the features available on your Nitrokey.
|
||||
|
||||
Nitrokey 模式可用 [Nitrokey 應用程式](https://nitrokey.com/download) 來設定。
|
||||
|
||||
The Nitrokey 3 Series can act as a password manager. They can store up to 50 different entries, and each entry can contain login, password, comment and OTP.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">警告</p>
|
||||
|
||||
Excluding the Nitrokey 3, Nitrokeys with HOTP and TOTP storage do not have it encrypted, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
**Nitrokey** also has the **Nitrokey Passkey**, a lower-price security key capable of [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online). 此金鑰僅提供基本的 FIDO2 功能，但對於大多數人來說就足夠其需求。 安全金鑰系列**不具備**的功能為：
|
||||
|
||||
- 密碼管理器。
|
||||
- PIV
|
||||
- OpenPGP
|
||||
- Tamper-resistant smart card
|
||||
- TOTP and HOTP
|
||||
Excluding the Nitrokey 3, Nitrokeys which support HOTP and TOTP do not have encrypted storage, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: "多重要素驗證"
|
||||
icon: 'material/two-factor-authentication'
|
||||
title: 多重要素驗證
|
||||
icon: material/two-factor-authentication
|
||||
description: 多因素驗證是保護您線上帳戶的關鍵安全機制，但有些方法比其他方法更強大。
|
||||
---
|
||||
|
||||
@@ -64,7 +64,7 @@ Yubico 驗證伺服器是雲端服務，您把信任託付給 Yubico 相信他
|
||||
|
||||
#### FIDO （ 快速線上身份驗證）
|
||||
|
||||
[FIDO ](https://en.wikipedia.org/wiki/FIDO_Alliance) 包含許多標準，首先是U2F ，然後是 [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) ，其中包括 Web 標準 [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn)。
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was [U2F](https://en.wikipedia.org/wiki/Universal_2nd_Factor) and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) which includes the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
|
||||
U2F 和 FIDO2 指的是 [Client to Authenticator Protocol](https://en.wikipedia.org/wiki/Client_to_Authenticator_Protocol)，這是安全金鑰和電腦之間的協議，例如筆記型電腦或手機。 它補充了 WebAuthn ， WebAuthn 為驗證網站登錄（ “依賴方” ）之組件。
|
||||
|
||||
|
||||
@@ -96,7 +96,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Peergos** 是去中心化協定的儲存、社交媒體和應用程式開源平台。 其提供安全且私密的空間，用戶可以在其中儲存、分享和查看照片、影片、文件等。 Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
**Peergos** 是去中心化協定的儲存、社交媒體和應用程式開源平台。 It provides a secure and private space where users can store, share, view and edit their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
|
||||
[:octicons-home-16: Homepage](https://peergos.org){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://peergos.net/privacy.html){ .card-link title="Privacy Policy" }
|
||||
@@ -109,9 +109,9 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=peergos.android)
|
||||
- [:simple-github: GitHub](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-apple: macOS](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-linux: Linux](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://peergos.org/download#windows)
|
||||
- [:simple-apple: macOS](https://peergos.org/download#macos)
|
||||
- [:simple-linux: Linux](https://peergos.org/download#linux)
|
||||
- [:octicons-browser-16: Web](https://peergos.net)
|
||||
|
||||
</details>
|
||||
@@ -120,9 +120,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
Peergos is built on top of the [InterPlanetary File System (IPFS)](https://ipfs.tech), a peer-to-peer architecture that protects against [:material-close-outline: Censorship](basics/common-threats.md#avoiding-censorship ""){.pg-blue-gray}.
|
||||
|
||||
Peergos is primarily a web app, but you can self-host the server either as a local cache for your remote Peergos account, or as a standalone storage server which negates the need to register for a remote account and subscription. The Peergos server is a `.jar` file, which means the Java 17+ Runtime Environment ([OpenJDK download](https://azul.com/downloads)) should be installed on your machine to get it working.
|
||||
|
||||
Running a local version of Peergos alongside a registered account on their paid, hosted service allows you to access your Peergos storage without any reliance on DNS or TLS certificate authorities, and keep a copy of your data backed up to their cloud. The user experience should be the same whether you run their desktop server or just use their hosted web interface.
|
||||
Peergos has a web app, desktop apps and an Android app and you can also self-host the server. Client, server and command line interface all run from the same binary. There is a sync engine included (accessible via the desktop or android apps) for bi-directionally synchronizing a local folder with a Peergos folder, and a webdav bridge to allow other applications to access your Peergos storage.
|
||||
|
||||
Peergos was [audited](https://peergos.org/posts/security-audit-2024) in November 2024 by Radically Open Security and all issues were fixed. They were previously [audited](https://cure53.de/pentest-report_peergos.pdf) by Cure53 in June 2019, and all found issues were subsequently fixed.
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
title: "安全金鑰"
|
||||
title: 安全金鑰
|
||||
icon: material/key-chain
|
||||
description: These security keys provide a form of phishing-immune authentication for accounts that support it.
|
||||
cover: multi-factor-authentication.webp
|
||||
@@ -10,7 +10,7 @@ cover: multi-factor-authentication.webp
|
||||
- [:material-target-account: 針對性攻擊](basics/common-threats.md#attacks-against-specific-individuals){ .pg-red }
|
||||
- [:material-bug-outline: 被動攻擊](basics/common-threats.md#security-and-privacy){ .pg-orange }
|
||||
|
||||
實體**安全金鑰**可為線上帳戶添加強大的保護層。 與[驗證器應用程式](multi-factor-authentication.md) 相比，FIDO2 安全金鑰協定不受網路釣魚的影響，在沒持有金鑰的情況下不會受到侵害。 Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
實體**安全金鑰**可為線上帳戶添加強大的保護層。 Compared to [authenticator apps](multi-factor-authentication.md), the [FIDO2](basics/multi-factor-authentication.md#fido-fast-identity-online) security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
|
||||
## YubiKey 安全金鑰
|
||||
|
||||
@@ -20,7 +20,7 @@ cover: multi-factor-authentication.webp
|
||||
{ width="315" }
|
||||
</figure>
|
||||
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. 它支援 FIDO2/WebAuthn 和 FIDO U2F，並且可以與大多數支援安全金鑰作為第二因素的服務以及許多密碼管理器一起使用。
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO Universal 2nd Factor (U2F), and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/security-key){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -35,10 +35,10 @@ The **Yubico Security Key** series is the most cost-effective hardware security
|
||||
此金鑰僅提供基本的 FIDO2 功能，但對於大多數人來說就足夠其需求。 安全金鑰系列**不具備**的功能為：
|
||||
|
||||
- [Yubico Authenticator](https://yubico.com/products/yubico-authenticator)
|
||||
- CCID 智慧卡支援 (PIV-compatibile)
|
||||
- CCID Smart Card support (PIV-compatible)
|
||||
- OpenPGP
|
||||
|
||||
如需要這些功能，則應該考慮高階版 [YubiKey](#yubikey) 產品。
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) series instead.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">警告</p>
|
||||
@@ -55,7 +55,7 @@ Yubico 安全金鑰的韌體不可更新。 如果您想要使用較新韌體版
|
||||
{ width="400" }
|
||||
</figure>
|
||||
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The YubiKey 5 Series has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), [Yubico OTP](basics/multi-factor-authentication.md#yubico-otp), [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), [OpenPGP](https://developers.yubico.com/PGP), and [TOTP and HOTP](https://developers.yubico.com/OATH) authentication.
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The **YubiKey 5 Series** has a wide range of features such as FIDO2/WebAuthn and FIDO U2F, [TOTP and HOTP](https://developers.yubico.com/OATH) authentication, [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), and [OpenPGP](https://developers.yubico.com/PGP).
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/yubikey-5-overview){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -69,7 +69,7 @@ The [comparison table](https://yubico.com/store/compare) shows how the YubiKeys
|
||||
|
||||
YubiKey 可以使用 [YubiKey Manager](https://yubico.com/support/download/yubikey-manager) 或 [YubiKey Personalization Tools](https://yubico.com/support/download/yubikey-personalization-tools) 來設定它。 若要管理 TOTP 程式碼，可用 [Yubico Authenticator](https://yubico.com/products/yubico-authenticator)。 Yubico 所有客戶端軟體都是開源的。
|
||||
|
||||
支援 HOTP 和 TOTP 的機型， OTP 介面中有2個插槽可用於HOTP 和32個插槽來儲存 TOTP 機密。 These secrets are stored encrypted on the key and never exposed to the devices they are plugged into. 一旦向 Yubico Authenticator 提供種子（共享祕密） ，它將只會給出六位數的代碼，但永遠不會提供種子。 此安全模型有助於限制攻擊者，即便運行 Yubico Authenticator的設備受到破壞，讓受到物理攻擊時 Yubikey 仍具抵抗力。
|
||||
For models which [support HOTP and TOTP](https://support.yubico.com/hc/articles/360013790319-How-many-accounts-can-I-register-my-YubiKey-with), the secrets are stored encrypted on the key and never exposed to the devices they are plugged into. 一旦向 Yubico Authenticator 提供種子（共享祕密） ，它將只會給出六位數的代碼，但永遠不會提供種子。 此安全模型有助於限制攻擊者，即便運行 Yubico Authenticator的設備受到破壞，讓受到物理攻擊時 Yubikey 仍具抵抗力。
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">警告</p>
|
||||
@@ -86,7 +86,7 @@ Yubikey 安全金鑰的韌體不可更新。 如果您想要使用較新韌體
|
||||
{ width="300" }
|
||||
</figure>
|
||||
|
||||
The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://www.nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification). The Nitrokey 3 Series in general has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), Personal Identity Verification (PIV), OpenPGP, and TOTP and HOTP authentication.
|
||||
**Nitrokey** has a cost-effective security key capable of FIDO2/WebAuthn and FIDO U2F called the **Nitrokey Passkey**. For support for features such as PIV, OpenPGP, and TOTP and HOTP authentication, you need to purchase one of their other keys like the **Nitrokey 3**. Currently, only the **Nitrokey 3A Mini** has [FIDO Level 1 Certification](https://nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification).
|
||||
|
||||
[:octicons-home-16: Homepage](https://nitrokey.com){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://nitrokey.com/data-privacy-policy){ .card-link title="Privacy Policy" }
|
||||
@@ -96,26 +96,14 @@ The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://
|
||||
|
||||
</div>
|
||||
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys) shows how the different Nitrokey models compare to each other in terms of features and other specifications.
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys#:~:text=The%20Nitrokey%20Family) shows how the different Nitrokey models compare to each other in terms of features and other specifications. Refer to Nitrokey's [documentation](https://docs.nitrokey.com/nitrokeys/features) for more details about the features available on your Nitrokey.
|
||||
|
||||
Nitrokey 模式可用 [Nitrokey 應用程式](https://nitrokey.com/download) 來設定。
|
||||
|
||||
The Nitrokey 3 Series can act as a password manager. They can store up to 50 different entries, and each entry can contain login, password, comment and OTP.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">警告</p>
|
||||
|
||||
Excluding the Nitrokey 3, Nitrokeys with HOTP and TOTP storage do not have it encrypted, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
**Nitrokey** also has the **Nitrokey Passkey**, a lower-price security key capable of [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online). 此金鑰僅提供基本的 FIDO2 功能，但對於大多數人來說就足夠其需求。 安全金鑰系列**不具備**的功能為：
|
||||
|
||||
- 密碼管理器。
|
||||
- PIV
|
||||
- OpenPGP
|
||||
- Tamper-resistant smart card
|
||||
- TOTP and HOTP
|
||||
Excluding the Nitrokey 3, Nitrokeys which support HOTP and TOTP do not have encrypted storage, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: "Multifactor Authentication"
|
||||
icon: 'material/two-factor-authentication'
|
||||
title: Multifactor Authentication
|
||||
icon: material/two-factor-authentication
|
||||
description: MFA is a critical security mechanism for securing your online accounts, but some methods are stronger than others.
|
||||
---
|
||||
|
||||
@@ -64,7 +64,7 @@ Yubico验证服务器是一个基于云的服务，你需要相信Yubico在安
|
||||
|
||||
#### FIDO（快速在线身份认证）
|
||||
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) 包括许多标准，首先是U2F，后来是 [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) ，其中包括web标准 [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn)。
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was [U2F](https://en.wikipedia.org/wiki/Universal_2nd_Factor) and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) which includes the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
|
||||
U2F和FIDO2指的是 [客户端到验证器协议](https://en.wikipedia.org/wiki/Client_to_Authenticator_Protocol)，这是安全密钥和计算机（如笔记本电脑或手机）之间的协议。 它带有WebAuthn作为补充，WebAuthn是用来对你试图登录的网站（"信赖方"）进行认证的组件。
|
||||
|
||||
|
||||
@@ -96,7 +96,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, and view their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
**Peergos** is a decentralized protocol and open-source platform for storage, social media, and applications. It provides a secure and private space where users can store, share, view and edit their photos, videos, documents, etc. Peergos secures your files with quantum-resistant E2EE and ensures all data about your files remains private.
|
||||
|
||||
[:octicons-home-16: Homepage](https://peergos.org){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://peergos.net/privacy.html){ .card-link title="Privacy Policy" }
|
||||
@@ -109,9 +109,9 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=peergos.android)
|
||||
- [:simple-github: GitHub](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-apple: macOS](https://github.com/Peergos/web-ui/releases)
|
||||
- [:simple-linux: Linux](https://github.com/Peergos/web-ui/releases)
|
||||
- [:fontawesome-brands-windows: Windows](https://peergos.org/download#windows)
|
||||
- [:simple-apple: macOS](https://peergos.org/download#macos)
|
||||
- [:simple-linux: Linux](https://peergos.org/download#linux)
|
||||
- [:octicons-browser-16: Web](https://peergos.net)
|
||||
|
||||
</details>
|
||||
@@ -120,9 +120,7 @@ They have also received the Digital Trust Label, a certification from the [Swiss
|
||||
|
||||
Peergos is built on top of the [InterPlanetary File System (IPFS)](https://ipfs.tech), a peer-to-peer architecture that protects against [:material-close-outline: Censorship](basics/common-threats.md#avoiding-censorship ""){.pg-blue-gray}.
|
||||
|
||||
Peergos is primarily a web app, but you can self-host the server either as a local cache for your remote Peergos account, or as a standalone storage server which negates the need to register for a remote account and subscription. The Peergos server is a `.jar` file, which means the Java 17+ Runtime Environment ([OpenJDK download](https://azul.com/downloads)) should be installed on your machine to get it working.
|
||||
|
||||
Running a local version of Peergos alongside a registered account on their paid, hosted service allows you to access your Peergos storage without any reliance on DNS or TLS certificate authorities, and keep a copy of your data backed up to their cloud. The user experience should be the same whether you run their desktop server or just use their hosted web interface.
|
||||
Peergos has a web app, desktop apps and an Android app and you can also self-host the server. Client, server and command line interface all run from the same binary. There is a sync engine included (accessible via the desktop or android apps) for bi-directionally synchronizing a local folder with a Peergos folder, and a webdav bridge to allow other applications to access your Peergos storage.
|
||||
|
||||
Peergos was [audited](https://peergos.org/posts/security-audit-2024) in November 2024 by Radically Open Security and all issues were fixed. They were previously [audited](https://cure53.de/pentest-report_peergos.pdf) by Cure53 in June 2019, and all found issues were subsequently fixed.
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
title: "Security Keys"
|
||||
title: Security Keys
|
||||
icon: material/key-chain
|
||||
description: These security keys provide a form of phishing-immune authentication for accounts that support it.
|
||||
cover: multi-factor-authentication.webp
|
||||
@@ -10,7 +10,7 @@ cover: multi-factor-authentication.webp
|
||||
- [:material-target-account: Targeted Attacks](basics/common-threats.md#attacks-against-specific-individuals){ .pg-red }
|
||||
- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange }
|
||||
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the FIDO2 security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the [FIDO2](basics/multi-factor-authentication.md#fido-fast-identity-online) security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
||||
|
||||
## Yubico Security Key
|
||||
|
||||
@@ -20,7 +20,7 @@ A physical **security key** adds a very strong layer of protection to your onlin
|
||||
{ width="315" }
|
||||
</figure>
|
||||
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO U2F, and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO Universal 2nd Factor (U2F), and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/security-key){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -35,10 +35,10 @@ These keys are available in both USB-C and USB-A variants, and both options supp
|
||||
This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- [Yubico Authenticator](https://yubico.com/products/yubico-authenticator)
|
||||
- CCID Smart Card support (PIV-compatibile)
|
||||
- CCID Smart Card support (PIV-compatible)
|
||||
- OpenPGP
|
||||
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) of products instead.
|
||||
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) series instead.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">警告</p>
|
||||
@@ -55,7 +55,7 @@ The firmware of Yubico's Security Keys is not updatable. If you want features in
|
||||
{ width="400" }
|
||||
</figure>
|
||||
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The YubiKey 5 Series has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), [Yubico OTP](basics/multi-factor-authentication.md#yubico-otp), [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), [OpenPGP](https://developers.yubico.com/PGP), and [TOTP and HOTP](https://developers.yubico.com/OATH) authentication.
|
||||
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The **YubiKey 5 Series** has a wide range of features such as FIDO2/WebAuthn and FIDO U2F, [TOTP and HOTP](https://developers.yubico.com/OATH) authentication, [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), and [OpenPGP](https://developers.yubico.com/PGP).
|
||||
|
||||
[:octicons-home-16: Homepage](https://yubico.com/products/yubikey-5-overview){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
||||
@@ -69,7 +69,7 @@ The [comparison table](https://yubico.com/store/compare) shows how the YubiKeys
|
||||
|
||||
YubiKeys can be programmed using the [YubiKey Manager](https://yubico.com/support/download/yubikey-manager) or [YubiKey Personalization Tools](https://yubico.com/support/download/yubikey-personalization-tools). For managing TOTP codes, you can use the [Yubico Authenticator](https://yubico.com/products/yubico-authenticator). All of Yubico's clients are open source.
|
||||
|
||||
For models which support HOTP and TOTP, there are 2 slots in the OTP interface which could be used for HOTP and 32 slots to store TOTP secrets. These secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
For models which [support HOTP and TOTP](https://support.yubico.com/hc/articles/360013790319-How-many-accounts-can-I-register-my-YubiKey-with), the secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">警告</p>
|
||||
@@ -86,7 +86,7 @@ The firmware of YubiKey is not updatable. If you want features in newer firmware
|
||||
{ width="300" }
|
||||
</figure>
|
||||
|
||||
The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://www.nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification). The Nitrokey 3 Series in general has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), Personal Identity Verification (PIV), OpenPGP, and TOTP and HOTP authentication.
|
||||
**Nitrokey** has a cost-effective security key capable of FIDO2/WebAuthn and FIDO U2F called the **Nitrokey Passkey**. For support for features such as PIV, OpenPGP, and TOTP and HOTP authentication, you need to purchase one of their other keys like the **Nitrokey 3**. Currently, only the **Nitrokey 3A Mini** has [FIDO Level 1 Certification](https://nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification).
|
||||
|
||||
[:octicons-home-16: Homepage](https://nitrokey.com){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://nitrokey.com/data-privacy-policy){ .card-link title="Privacy Policy" }
|
||||
@@ -96,26 +96,14 @@ The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://
|
||||
|
||||
</div>
|
||||
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys) shows how the different Nitrokey models compare to each other in terms of features and other specifications.
|
||||
The [comparison table](https://nitrokey.com/products/nitrokeys#:~:text=The%20Nitrokey%20Family) shows how the different Nitrokey models compare to each other in terms of features and other specifications. Refer to Nitrokey's [documentation](https://docs.nitrokey.com/nitrokeys/features) for more details about the features available on your Nitrokey.
|
||||
|
||||
Nitrokey models can be configured using the [Nitrokey app](https://nitrokey.com/download).
|
||||
|
||||
The Nitrokey 3 Series can act as a password manager. They can store up to 50 different entries, and each entry can contain login, password, comment and OTP.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">警告</p>
|
||||
|
||||
Excluding the Nitrokey 3, Nitrokeys with HOTP and TOTP storage do not have it encrypted, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
**Nitrokey** also has the **Nitrokey Passkey**, a lower-price security key capable of [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online). This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
||||
|
||||
- 密码管理器
|
||||
- PIV
|
||||
- OpenPGP
|
||||
- Tamper-resistant smart card
|
||||
- TOTP and HOTP
|
||||
Excluding the Nitrokey 3, Nitrokeys which support HOTP and TOTP do not have encrypted storage, making them vulnerable to physical attacks.
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
Reference in New Issue
Block a user