Why not using Trezor for FIDO?

Privacy Questions
1

Why not using Trezor for FIDO? Was thinking about using a Trezor hardware wallet instead of a Yubikey. Not only you have a FIDO security key and a crypto wallet!

2

Security.

3

You mean Yubico is more secure? If so how?

1 Like
4

i would say firstly there is a cost comparision. A normal yubikey fido2 key comes for $25 , whereas the lowest trezor device comes for $60.

Also the fact that , trezor devices actually have an updatable firmware. so there is a slight risk of supply chain attacks . Whereas Yubikeys generally don’t have a updatable firmware.

Also a Yubikey 5 would have much more functionality than trezor device like totp and password manager

Trezor and yubikeys both had their share of vulneribilities.

Honestly if you are already buying trezor for crypto then you could use it as a fido2 device too , it wouldn’t harm much.

But if you are not into crypto , yubikeys should be fine.

1 Like
5

How would a security key be more secure than a fingerprint unlocking on a macOS and Android? Thanks!

6

your fingerprint can be cloned. Also biometric authentication would rely heavily on the OS to execute it in a safe environment. Not all implementations would be safe. For ex not sure how secure is face id if someone creates a 3D model of your face.
Though the question also comes to your convenience vs security.
If your threat model isn’t that high a biometric would suffice most use cases and be relatively secure.

Usage of security key could be reserved for some important logins like password manager , email etc.

1 Like
7

Regarding cloning fingerprints, would an ultrasonic fingerprint reader (e.g. Pixel 9 and later presumably) remove most of the threat for anyone who doesn’t have the most serious of threat models?

1 Like
8

An ultrasonic fingerprint sensor captures depth information in contrast to an optical fingerprint sensor and is therefore more accurate, more secure, and harder to fool via cloned fingerprints. Just keep in mind that it’s definitely not impossible to fool ultrasonic sensors and they won’t protect against certain threats like coercion.

1 Like
9

Thanks for the reply! I would say that Secure keys have other problems and every method you use will have pros and cons. Thanks!