solo1 VS rust-u2f

All phones ask for PIN or pattern in addition to face/fingerprint. Use that.

For the average user this is safe enough. (i.e) keep google/apple password safe. Then all is fine.

> exporting and FAANG lock-in

You don't ever have to even sign into FAANG if you can put up with inconvenience.

- Buy a U2F FIDO key like OPEN SOURCE https://solokeys.com/ or Yubikey etc

Try Solokeys https://solokeys.com v2 is open source USB-C and NFC compatible work with FIDO and web Auth.

Also take a look at solokeys. They are very affordable and support FIDO2 and FIDO U2F -- meaning they have overlapping protocols with Bitwarden, and they certainly work on Google.

Try This

You might want to check out https://solokeys.com/ then. They're pretty new (shipping for about a year) but they do full FOSS firmware & software as well as most hardware being FOSS as well.

This project aims to support U2F / FIDO2 using fingerprint reader on Linux (via libfprint). The goal is to have the same user experience with 2FA using Windows Hello.

This project is based on https://github.com/danstiner/rust-u2f with minor modification (see my fork: https://github.com/ngxson/rust-u2f-pkexec)

Link to the project: https://github.com/ngxson/softu2f-fprintd-docker

I've considered adding FIDO2 support to the software-only U2F token I wrote ( https://github.com/danstiner/rust-u2f). It's a fair bit of work though, and I am not sure how comfortable I am with passwordless login unless the keys are kept purely in hardware such as a TPM.

That said, my reading of this post is that FIDO2 support will get built into Chromium directly, which is itself open source. Or if you do want a hardware key but running open software, I'd definitely recommend https://solokeys.com/, I've been following them for a long time.

Also there was some related discussion on this same article last week: https://news.ycombinator.com/item?id=31274677

On a Workspace account you only need U2F token emulator (https://github.com/danstiner/rust-u2f woks fine) and thenn you can setup u2f first and add normal TOTP in second step. But u2f must stay there. I don't have a personal account to try if it works the same.

As it becomes easier to emulate hardware tokens[1], Google may start limiting which ones it accepts. I believe they can use attestation keys to do that.

This is just a softer layer of security to slow down less sophisticated mass signup attempts.

They may very well eventually phase out TOTP, under the justification that it is not as secure, but I would be shocked if they ever retire the highly insecure SMS verification.

TOTP is really easy to implement, and adds a ton of value. I have a oneliner that takes a screenshot, extracts the QR code with zbarimg, and adds it to my pass[2] password database, which then hooks back into my browser. I use it whenever it is available because it is so low effort.

[1]: https://github.com/danstiner/rust-u2f

GitHub has a couple of others listed, but I have not tested them personally: Example https://github.com/danstiner/rust-u2f