Why should this tool be removed? I think we should add security key criteria to require: FIDO2 Level 1 or higher certification on the key itself (some websites/applications will only work with FIDO certified keys!) Uses a secure element with a CC EAL6 or higher certification Currently, only a sin…

I think removing them makes sense. Trying to parse it to a specific model is likely to sow confusion. As for Yubikey alternatives; it seems Google’s Titan Security Key is FIDO 1 certified and may be worth a look. [image] Google | FIDO Alliance

Google doesn’t disclose which secure element they are using, which is unfortunate in terms of the proposed EAL6 requirement. Maybe this particular requirement is unnecessary, it mainly pertains to physical attacks which is not the primary use-case of security keys in the first place.

[image] TOKEN2 Sàrl is a Swiss cybersecurity company specialized in the area of... FIDO2 USB Key, U2F USB Key, Cheap Yubico alternative, FIDO2, fido alliance certified security keys Replace your mobile authenticator with secure hardware OTP token! Easily programmed via NFC. Designed to …

[image] jonah: We can warn against this, but in general it does not really inspire confidence that Nitrokey has not sought out certification for their other products in the first place. If missing features from other products are to be considered when recommending a single model, then I would…

This is a bigger issue than FIDO certification: Nitrokey 3 key assembly - FIDO2 / Nitrokey 3 - Nitrokey Support Potting is important.

[image] jonah: because some websites/applications will only work with FIDO certified keys Any examples? Only case I’m aware of “in the wild” is Entra ID tenants if so configured by the admin.

[image] FIDO Devices - Future of Cybersecurity FIDO devices offer the best solution to the global password challenge, using passwordless authentication with multi-factor (MFA) hardware. Also Thales makes good keys these days. So i would say there are enough o…

Could requiring certification influence the future market such that it increases prices to a point beyond the typical consumer? I mention because I think there are some keys that are in the $20 price point and it may be counter to your goals if you see less user adoption. I’m somewhat asking if th…

I don’t think so. Level 1 certification has no hardware requirements. It literally just has to work. I’ve found this $19.50 one which is Level 1 certified, and it’s name-brand: [image] Amazon.com: Identiv uTrust FIDO2 NFC Security Key USB-C (FIDO2, U2F, WebAuthn) :... Identiv’s uTrust …

Require security key certifications & remove Nitrokey

Site Development Tool Suggestions

Lukas July 26, 2026, 6:27am 13

I think that Nitrokey removal is warranted, as per one of the reasons here: Security Key Comparison - #19 by Lukas

While Nitrokey 3 has a secure element and encrypts some secrets against the PIN, passkeys and FIDO2 credentials are not stored in that secure element and aren’t encrypted against the PIN either. Combined with no potting, this is not good.

Topic		Replies	Views
Remove Nitrokey Tool Suggestions	39	2908	May 6, 2025
Mention Nitrokey 3A's FIDO2 certification Site Development completed	17	1393	September 15, 2025
Nitrokey 3 (Hardware Security Key) Tool Suggestions	3	2115	January 21, 2024
Yubikey 5 supports FIDO2 Level 2 Site Development completed	0	377	April 14, 2025
TrustKey (Security Key) Tool Suggestions	5	424	May 30, 2024

Require security key certifications & remove Nitrokey

Related topics