Project dead?

[aadithya96]

After waiting for more than a year to get this delivered, it seems like development has slowed died off too much like the hype around this. It seems like the last commit was made more than a year ago. Has anyone heard anything about this or is this project dead?

[msiqx9]

Yes, the project is dead. My v1 and v2 keys still work ok.

[digital-idiot]

I tried to contact them at hello@solokeys.com regarding the NFC issue. I never heard back from over a month. I contacted them requesting replacement as it seems like manufacturing defect but still no response. After the whole delay fiasco these kinds of things are simply unacceptable.

[BarsMonster]

@alexjmoore @digital-idiot There were comments in the indiegogo that to make NFC work one would need to disable pin and it's android limitation, not solo's. Unfortunately I don't know how to disable pin without resetting the key.

[digital-idiot]

@BarsMonster Can you link to the Indiegogo comment? Also if that is the case why mention it somewhere officially, like FAQ or something?

[digital-idiot]

The strange thing is for me the NFC do work with Android if the Key is powered separately through USB. Also several users reported that NFC works with Android for their keys as expected.

Example: #165 (comment)

[BarsMonster]

@digital-idiot Comment is on second page of user comments at the moment, not possible to link spcific user comment:

Aldo Bleeker 1 month ago

Backer #2845, my USB A arrived today. It was scheduled to arrive while I was on holiday, but Solokeys held it until I had returned. That’s great service!
I’ve tested it with webauth.me, and webauthn.io, and it has worked without a hitch. I’ve also added it to my Google account, and that worked too. I can even use it on my phone over USB, and NFC. (Remove the PIN first when you try to register it on Google, or you won’t be able to enter a name. I just added the PIN afterwards again.)

Aldo Bleeker 18 days ago
I've removed the PIN with Windows Settings > Accounts > Sign-in options > Security key > Manage (touch key) > Reset Security Key. I'm assuming this will not just remove the PIN, but reset the entire key, and remove all data. That's fine by me, but this may not apply to others.

[BarsMonster]

@aadithya96 I got mine delivered like a month ago, so they are going through backlog. One of the latest updates was that team had to get full time jobs elsewhere, but they still trying to deliver everything. Also, it might be possible to backport features from NitroKey firmware, which is somewhat compatible as far as I understand.

[BarsMonster]

The question is is there anyone in the community who is interested to fork and/or take leadership in firmware development? :-)

[purepani]

I think this project is exceptionally cool. I know absolutely nothing about firmware development, and very little about hardware development, but I might just spend the time hacking with this stuff anyway.

[jugendhacker]

So I finally got my 2C too, sadly it seems to be completely dead now :(

Would have been better if I had selected NitroKey from the beginning on

[jugendhacker]

@msiqx9 oh I didn't mean dead in the sense of hardware (although I'll probably try a warranty replacement because the connector is dent and it makes strange crackling sound on disconnect) but rather software wise

[savely-krasovsky]

They sent me replacement of Solo 2C, though I didn't receive it yet.

[savely-krasovsky]

@jugendhacker mine also does crackling sound on disconnect, but works perfectly. I don't understand what it cracking though...

[rugk]

@savely-krasovsky did you receive it yet? 👀

[savely-krasovsky]

@rugk yes, I received the replacement key and it works.

[sbusch]

Strange crackling is a good description :-)

I have this sound for both of my USB-C Solokeys. But despite this (and the known software bugs) they still work.

[jugendhacker]

Yeah, it works, but still kind of bugged, see solo2-cli#108 for example. And also there were more features promised for the successful Indiegogo campaign (like the PGP smart-card for example), which seems like they will never get developed (at least not by solokeys themselves)

[schildbach]

I'm a bit more concerned about the USB-C-Ports I plug my Solo2 into.

[jugendhacker]

Yeah, sounds like a condensator going rogue or something

[sbusch]

Never thought this could come from the port , I always suspected the key 👀

And yes, since there are no noticable loose parts I really could be due to the electronic.

[schildbach]

I'm pretty sure it comes from the key, but I'm afraid it could damage the port.

[BarsMonster]

Crackling noise must be from ceramic capacitor. They do emit sound on sharp voltage gradients. This alone is not dangerous and not a defect. If key does not get hot during work (for example due to short circuit) - I would not worry about it.

[sbusch]

@jugendhacker I thought about Nitrokey this too, but was reluctant because they used the same software framework as Solo:

https://github.com/Nitrokey/nitrokey-3-firmware

The Nitrokey 3 firmware is written in Rust. It uses the Trussed firmware framework and is developed in collaboration with SoloKeys (see the solo2 repository).

But Nitrokey has recent updates.

Are your projects still related @robin-nitrokey @sosthene-nitrokey

[robin-nitrokey]

Solo2 and Nitrokey 3 share many firmware components that we collaborate on, but the hardware and firmware are developed independently. For questions regarding the Nitrokey 3, please use the nitrokey-3-firmware repository.

[sbusch]

Thanks for your response!

Is there still activity in your collaboration with Solo? I you don't want to talk about this, no problem...

[BarsMonster]

I wonder if it is possible to backport Nitrokey 3 software to Solokey...

[savely-krasovsky]

@BarsMonster the problem is that even if it's possible, only Hacker Edition could be reflashed. Otherwise Solo team will need to sign it by their keys to allow us to update.

[nyabinary]

rip ig :<

[msiqx9]

Now that I'm into using passkeys, I haven't needed to use my physical Solo/Yubico keys for months.

[kenjikato]

I was just about to switch over to using the Solo v2 keys that I purchased (4 of them back during the kickstarter) only to come here and find out this project is effectively dead. 🤬
I love the idea of a hardware key, but I have now backed 5 different projects over the last 10ish years with all but one of them having died.
At this point I would be happy to pay a yearly "maintenance" fee if it would keep at leas one of these projects going beyond the initial production stage of the product.
Ugh! 🙄

[theerror]

Yep, it's indeed sad. I wondering, if Nitrokey actually working better, or it have same problems with support and development. Anyway, seems Solo is dead indeed.

[kenjikato]

My current goto hardware key and the only one that is still fully supported out of all the hardware keys I've backed is the OnlyKey.
My goal with the Solo v2 was to use it for FIDO access for work and give several of my co-workers their own keys to access the same services.
This way I could use my OnlyKey for my personal passwords and things like SSH keys access. Keeping my work and personal stuff separated nicely.
At this point I'm just going to go buy multiple more OnlyKeys (I like the Duo but the pin touch zones are a bit hard to hit sometimes without an extension cable from my computer) and keep using them. I'm not even going to mess with the Nitrokey at this point.

[nyabinary]

May I recommend tillitis key?, it's a spinoff company from Mullvad VPN so it's pretty reputable.

[kenjikato]

Thanks for the recommendation. It looks cool but it doesn't do FIDO/U2F yet (unless I missed something.) Which was going to be my main usage purpose for the Solo v2. I can get FIDO 2 / U2F from OnlyKey already.

[msiqx9]

In recent months I've not used physical keys; I'm now relying solely on passkeys stored in Bitwarden Password Manager and in Apple iCloud. Passkeys work really well, they are based on FIDO2 and they are free.

[BarsMonster]

You just need to trust Apple on that ) Not your physical key - not your... passwords :-)

[synthgab]

It's funny, I do exactly the opposite: I never really used my Solo 2 except from time to time, until a few months ago when passkeys became a trend and all websites ask to register one.

Ok, maybe I'm over paranoid, but I don't feel confident with having logins, passwords and passkeys stored in the same database/device...

[Edit] : typo

[msiqx9]

There seems to be some code activity yesterday.

[rugk]

Maybe they also should get off Twitter… time has passend and things™ happened…

[manuel-domke]

Imho, this kind of negativity might be better suited for Twitter, where it's easy to vent frustrations.

I understand that some people had, and still have, higher expectations. Open-source projects and crowdfunding ventures often have their ups and downs, and SoloKeys is no exception. The project is clearly going through a tough phase, but labeling it as dead doesn't help anyone.

As someone who still believes in this project and is actively working to move it forward, I find comments like this disheartening.
Instead of adding to the negativity, why not think about how we can support the project...

The team and community are doing their best with the resources they have. Let's channel our energy into something constructive rather than tearing each other down.

[purepani]

I would like to point out that labeling as dead does in fact help people make informed purchasing and contribution investment decisions if the project is in fact dead(which it certainly looked like it was), but otherwise I fully agree.

[manuel-domke]

True. But from what I know, work is still being done on the USB-C version to address the issues discussed earlier in this thread. But hardware production of such a product isn't an easy task.

While the project has faced challenges, the basic functionality of an open-source FIDO2 stick works as intended. FIDO2 attestation remains an open task, but it's something the team is actively working on.

So while it's not perfect, I wouldn't call it dead just yet. There's still progress being made, even if it's slower than some might have hoped.

[savely-krasovsky]

@manuel-domke while I agree on overall point of your messages, I wouldn't agree that "the team are doing their best". Surely I hope they finally have some time to resume their work on firmware and probably complete FIDO certification, but their complete lack of communication for almost entire year is not what I would expect from the project.

I totally understand that they have faced with some problems, need to work and earn money other ways, but instead of just ghosting the community they could write a blog post explaining the situation, difficulties they faced and realistically what is the future of the project. I would accept anything they would wrote, because the risks was known, but instead they were radio silent all that time until recently.

Of course I am still happy to see some activity now, but it's still would be nice to see the explanation with at least their hypothetical roadmap.

[hoos97]

Hey guys...figured I'd drop in to give some color to what has gone on as the most active member of the SoloKeys team. Unfortunately, I am not a developer! I've handled all of the behind the scenes works and communications.
Everyone remembers we launched Solo V2 (now labeled as Solo 2) the year following covid. The impacts to supply chain were significant and made delivery very challenging for crowdsourcing campaigns. However, we truly struggled with USB-C, and our manufacturer, and our PCB supplier. We also needed employment as SoloKeys, intended to be our number 1 thing, wasn't ready to be our number 1. As a result, our team was onboarded by another company to build an entirely separate product. The payer of bills got the lion share of our work. Developer hours are our most constrained resource.

So, business operations have simmered, development has simmered. And capital mostly used up to source machinery to resolve USB-C issues.

We have a solution in place for USB-C. Manufacturing is figured out. And crowdsourcing is completed. Stores are reopening in Europe and US. Product is ready for the sales cycle and can satisfy the majority of the 2FA market. So, the firmware enables product sale for the average user.

Meanwhile, we are partnered with NitroKey to further firmware development. This progress can be seen at https://github.com/trussed-dev. As cash flow goes positive and we benefit from sales cycle, dev work will start to increase again at solokeys, to include porting updates from trussed in order to complete tests for the FIDO certification. After that, we will expect to use cash flow to build in developer work for some more of the features that is expected of the product.
I greatly appreciate everyone's patience...it has been a long 3 years.

I will say that SoloKeys is a completely bootstrapped team. All moneys have come from crowd sourcing campaigns, some development funds and even our own pockets for the past year. We have a product that is ready...if you know anyone that wants to contribute to the code base...get the word out. Even better, if you know someone who wants to invest in a product that is now ready to sell...get the word out!

[rugk]

I agree, especially as during the kickstarter campaign, we had such updates frequently, at some time then it stopped…

[andrebrei]

I'm super happy to see that update too. In fact I had given up on the keys (one of my requirements was that it works of Microsoft entra/aad) because there was so little comms/info for such a long time.

I returned here because I spotted the solo and somu are on Microsoft's attestation list now. So clearly there was some progress.
(obviously, it won't work with the hacker version but I'll have go with a normal solo/somu once I'm back from travel).
edit: yes, I noticed, the list entry is for the solo v1 not 2.

[savely-krasovsky]

AFAIK Solo v1 has FIDO2 attestation since it release, so I don't think it's a recent change. The main problem is Solo v2...

[shrimpwtf]

Does this mean we'll need to move to trussed's firmware at a later point?

[savely-krasovsky]

Current Solo2 firmware is already built on top of Trussed. It just uses an older version of framework without a lot of newer features and bug fixes which Nitrokey team added and fixed later.