Nostr notes by John T (the GRA is silent)

you know you read it to the music 😅

2026-10-28T06:31:43Z

In reply to nevent1q…zj0n
_________________________

you know you read it to the music 😅

that's no problem: when it gets done, you flip it over again. ...

2026-10-27T21:50:32Z

In reply to nevent1q…0ny7
_________________________

that's no problem: when it gets done, you flip it over again. That shouldn't really get you down.

I am now at about 1000m, and I feel like I can breathe through my ...

2026-10-26T15:36:56Z

I am now at about 1000m, and I feel like I can breathe through my skin.

Did a 200m climb on a hike today without a pack and it felt like taking an elevator.

Weirdly, I couldn't get my HR past about 140 no matter how hard I tried. Reverse altitude acclimatization is a thing, I guess?

Of all of the things I expected from a town in the high Himalayas ...

2026-10-23T14:42:44Z

Of all of the things I expected from a town in the high Himalayas that's inaccessible by road...

...a Vengaboys cover definitely wasn't on the list.

(Video proof will have to wait for a better connection)

and now customized, because I can never leave things well enough ...

2026-09-27T23:39:41Z

In reply to nevent1q…2gzq
_________________________

and now customized, because I can never leave things well enough alone.

hey hey, there we go! Now I just need a project... ...

2026-09-27T23:19:12Z

In reply to nevent1q…hjxu
_________________________

hey hey, there we go!

Now I just need a project...

all built! Now I just have to dig out an FTDI cable and see if it ...

2026-09-27T23:05:55Z

In reply to nevent1q…9afk
_________________________

all built! Now I just have to dig out an FTDI cable and see if it works...

Finally getting around to putting together my @npub14su…09w8 ...

2026-09-27T20:27:24Z

Finally getting around to putting together my RC2014 (npub14su…09w8) Mini II Picasso, and let me tell you, it's a delight to build.

wait, you've BUILT yours? You're ahead of me then. ...

2026-09-19T13:30:41Z

In reply to nevent1q…zxku
_________________________

wait, you've BUILT yours? You're ahead of me then.

(Actually trying to 'finish' another project while I actually should be doing other more time-sensitive things.)

Way to call me out, music app. ...

2026-09-19T12:19:34Z

Way to call me out, music app.

Tiny geared stepper motor testing! ...

2026-09-03T20:23:00Z

Tiny geared stepper motor testing!

this is exactly why I insist on the lightest carryon luggage I ...

2026-08-15T19:04:50Z

In reply to nevent1q…h0vh
_________________________

this is exactly why I insist on the lightest carryon luggage I can find.

ARE YOU HAPPY NOW?! ...

2026-07-29T19:42:22Z

In reply to nevent1q…hu54
_________________________

ARE YOU HAPPY NOW?!

I can't believe I was nerdsniped into making the most cursed ...

2026-07-29T19:20:59Z

In reply to nevent1q…dv6u
_________________________

I can't believe I was nerdsniped into making the most cursed #hexpansion ever.

One of the things I ordered but didn't turn into an emfcamp ...

2026-07-28T23:15:51Z

One of the things I ordered but didn't turn into an emfcamp thing were these tiny flame effect filaments.

Going to have to think of a project to do with them!

One of the wonderful things I traded for at #emfcamp was this ...

2026-07-27T15:02:05Z

One of the wonderful things I traded for at #emfcamp was this tiny keychain-sized 2.4GHz spectrum analyzer.

If this was you, please let me know who you are!

I did not at all expect those eyes to be as popular as they were.

2026-07-26T17:57:38Z

In reply to nevent1q…pa57
_________________________

I did not at all expect those eyes to be as popular as they were.

I went with easy mode and got one of these cheap before they shut ...

2026-07-25T11:04:27Z

In reply to nevent1q…g3sr
_________________________

I went with easy mode and got one of these cheap before they shut down.

https://shkspr.mobi/blog/2024/02/giving-the-finger-to-mfa-a-review-of-the-z1-encrypter-ring-from-cybernetic/

(Not quite the same thing, but somewhat adjacent)

quoting
note17hs…j55d

##

Giving the finger to MFA - a review of the Z1 Encrypter Ring from Cybernetic
https://shkspr.mobi/blog/2024/02/giving-the-finger-to-mfa-a-review-of-the-z1-encrypter-ring-from-cybernetic/

I have mixed feelings about Multi-Factor Authentication. I get why it is necessary to rely on something which isn't a password but - let's be honest here - it is a pain juggling between SMS, TOTP apps, proprietary apps, and magic links.

I'm also not a fan of PassKeys0. It feels weird to me that my computer *is* the password. I get the theoretical way it works - but it rubs me up the wrong way.

So, Yubikeys? [I find them an annoyance](https://shkspr.mobi/blog/2017/11/a-grumpy-look-at-using-a-yubico-neo-nfc-on-ubuntu-android/ ). I never have my keys to hand - which sort of defeats the purpose of them.

A little while ago, I wondered "[Where are the U2F Rings?](https://shkspr.mobi/blog/2022/02/where-are-the-u2f-rings/ )" If I could have a *wearable* MFA token, that would solve many of my issues1.

Enter the [Cybernetic Z1 Encrypter Ring](https://getcybernetic.com/product/ring/ ). It is a US$300 zirconia ring with a built-in range of JavaCard-based NFC apps - including the ability to unlock your Tesla2. It is powered by the [VivoKey Apex chip](https://vivokey.com/apex/ ) (NXP JCOP 4 P71) which provides all the security and functionality. Your money also gets you an NFC reader/writer which connects to your computer via USB. The team have sent me a demo version of the ring to review on the proviso that I give them feedback.##

[Demo](#demo )Here's a quick video showing how it works:##

[The Good](#the-good )It works! Seriously, in a world of vapourware and vaguely-worded Kickstarters, it is refreshing to have a product which actually delivers. I was able to enrol it on my BitWarden account and then use it to log in - all via my Android phone. Similarly, I tested it working with Amazon, BitWarden, CodeBerg, Discord, Gandi, GitLab, GoDaddy, Google, PorkBun, Proton, WordPress and a few others.

It's a good looking, plainly designed, unibody ring. It is waterproof and survived the daily abuse I give my hands. It was washed with soap and blasted with a hand-dryer and it kept on chugging. No need to recharge it either - NFC runs off the power of radio waves like magic.

It is completely smooth, no built in scanners or LEDs or power-ports. The antenna appears to be all the way around the ring - so you can use either side of your finger on a scanner.

There is an [Android app](https://play.google.com/store/apps/details?id=com.vivokey.apexmanager.cybernetic ) which you can use to send information to the ring. That's designed for being able to share contact details and has a generous 4KB of storage3.

But, the nice thing is, **you don't *need* the app!** By default the ring will work as a FIDO2 token suitable for logging in to a variety of services.

The code on the Ring is (somewhat) Open Source. You can write your own JavaCard applets and load them on to the ring.##

[The Bad](#the-bad )It works well... until it doesn't. Mostly this is a criticism of FIDO2. I initially was unable to use the ring with GitHub:

I tried both Firefox and Chrome but got the same error. Similarly, CoinBase wouldn't register the key and didn't tell me why.

I contacted the Ring's manufacturer and they sent me details of a [firmware update](#updates ) which claimed to fixed the issue.

Google worked - but gave me this rather weird default name and icon:

I was able to rename it, but the icon can't be changed.

Amazon had the same issue, but with no way to rename.

Both LinkedIn and WhatsApp would only let me create a phone-based PassKey. They didn't give me a prompt to scan my NFC ring.

NFC *only* is also a bit of a limitation. Until every laptop comes with built-in NFC, you'll need to use a dongle / reader if you want to use the ring. For a phone or tablet with NFC, you're fine. Well, as long as you know where your phone's NFC reader is!

The Android app isn't open source, which feels like a bit of a missed opportunity. It is pretty bare-bones, only providing the ability to add contact details and see how much free storage and RAM there is. In the future, the app promises to offer "Smart PGP" and a few other services.

The contact card stuff is a bit underwhelming. Rather than embed a VCARD, it takes users to a separate website which has your contact details on it.

Weirdly, it zips the content of your contact details and uses them to populate the website with data. Because there's only a limited amount of space available, contact images end up very pixellated. The website also uses external JavaScript without using SRI - which isn't what I'd expect from a security focussed company.

If you use a 3rd party NFC app, you can change the NDEF share to be *any* URl you want. I think that's probably a sensible thing to do.

Obviously, $300 is a chunk of change. You can [buy a basic U2F USB/NFC **key** for £20 - £50](https://amzn.to/49rsPMT ). So, with this, you're paying a higher price for a small-run product with a niche form-factor.##

[The Ugly?](#the-ugly )Do you want to wear jewellery? The Z1 is plain black and unobtrusive - unlike the garish designs of some fashion rings - but perhaps a few different styles and colours would be nice?

I already wear a wedding ring, so having another to wear wasn't too much of an adjustment. The ring comes in a number of US ring sizes, so you may need to compensate if you're used to a different sizing system. However, it is a bit of a chunky beast. You will certainly notice it while wearing it.

Would an attacker rip it off your finger or even chop your finger off? It is a niche risk - but if you're using this to digitally safeguard your billions of crypto-riches, worth thinking about.##

[Updates](#updates )The Z1 Encrypter runs JavaCard applets so, in theory, you can load any compatible app onto it. By default, it runs [Bryan Jacobs' FIDO2Applet](https://github.com/BryanJacobs/FIDO2Applet ). It recently received [an update](https://github.com/BryanJacobs/FIDO2Applet/commit/1f406ec383f7b447c7752d4d35b2f3bbd3c079d3 ) which should make it work with GitHub.

To install or update apps, you'll need the Fidesmo [Android app](https://play.google.com/store/apps/details?id=com.fidesmo.sec.android ) or [iOS app](https://apps.apple.com/us/app/fidesmo/id1504891446 ).

**WARNING!** Before installing a new app, you have to destroy the old one. This will wipe *all* your previous registrations.

However, I just couldn't get this to work. I tried using the Fidesmo app to uninstall the Tesla applet - but it failed.

Despite it asking me to uninstall again, there was no option to do so.

I find it a bit weird that the Ring relies on a 3rd party app to do this. I'd much rather see it built into the same app which controls the ring.##

[Security](#security )By default, the ring has no password set on its internal memory. That means you can write whatever content you want to the NDEF share. Of course, this means someone sat next to you can *also* change your saved URl! If you use the Fidesmo app, you can lock the contents of the share. Once locked it cannot be overwritten unless you destroy the applet.

So I was able to change the default URl to one I controlled, and I was able to lock it.

But *anyone* with the Fidesmo app can delete *any* applet on your ring. Simply open the app, tap the phone against the ring to read the data, select the app you want to delete, and hold the phone against the ring for a few seconds.

It isn't unobtrusive. You'd probably notice someone clutching your hand for a several seconds. But you probably wouldn't notice if you were asleep.

The only damage is rendering your PassKey inoperable. So you would have to revert back to using a different 2FA method. An attacker couldn't steal your data, but they could provide a denial of service attack on you.

It would be great if the ring came with a password. However, there is the risk that if you lost your own password, you'd be unable to write data to it.

I am unqualified to audit the hardware security. If an attacker had physical access to the Ring, could they crack it open and extract the keys from hardware? I don't know.##

[Linux Support & Open Source](#linux-support-open-source )The Cybernetic website says the Z1 supports "iOS, Android, Windows. MacOS coming June 2024." But how well does it work with Linux?

There are [several open source tools repositories available from VivoKey](https://github.com/VivoKey ) - although none specifically related to the ring.

I took a look at a bunch of [compatible readers](https://ccid.apdu.fr/ccid/section.html ) and got the ACR1252u-MF (full review later). There are a couple of Linux utilities which claim to work as NFC U2F readers - but the only one I could get working was Bryan Jacob's [FIDO2 HID Bridge](https://github.com/BryanJacobs/fido2-hid-bridge ). Installing was a bit of a faff (yay various Python incompatibilities) and using it means invoking an obscure command on the terminal. But... it worked!

I registered the ring on a service using my Android device, then I was able to sign in to the same service using Firefox on Linux!

Even better - I was *finally* able to register the ring with GitHub! And, once I'd registered it using Linux, I could sign on with Android. HASHTAG INTEROPERABILITY!##

[The Broken](#the-broken )And then I kinda broke it. Somehow, the Fidesmo app ended up [locking the entire card](https://forum.dangerousthings.com/t/cant-destroy-applets-with-fidesmo/21264/ ). Everything still worked - both NDEF and WebAuthN - but I couldn't update the firmware or applets. On the one hand, no one can wipe my OS! But on the other, I can't load new software or fix any bugs.

NFC is *fragile technology*. Send the wrong obscure command to the device and it will behave unpredictably.##

[Final Verdict](#final-verdict )For a certain type of nerd, this is awesome. It doesn't have aggressive "geek-chic" branding - it just quietly lets you augment your body with a useful bit of tech. Now I don't need to search for my key-ring every time I want to log into a secure service.

The flaws with this product are mostly to do with the ecosystem. Mostly.

U2F / FIDO2 / Whatever is pretty nifty technology. When it works, it is just like magic. Wave your hand near your phone and you are authenticated.

When it doesn't work, you might get stuck in a loop trying to work out why things are going wrong. It's terrifyingly easy to accidentally break something.

FIDO2 is still a pain. Do you know [the difference between CTAP1 and U2F, or how they relate to WebAuthn](https://www.beyondidentity.com/developers/blog/fido2-vs-u2f-whats-difference )? Does your favourite service [support 2FA at all](https://2fa.directory/gb/ )? Are you happy running a Python script on the CLI if you want to log in?

But that's not the ring's fault. It is early days for the tech and there are teething troubles.

The built-in contact-card portion of the ring is a bit daft. Pointing users to a 3rd party site doesn't seem like the right call for the type of people who'll buy this. I'm glad it could be pointed to a site that I control - albeit by using a different app to write the data.

I got used to wearing the ring after a few days, and it was the exact size that I requested. Although it is chunky, it is a subtle piece of jewellery and unlikely to draw unwanted attention. There are no LEDs or batteries to worry about.

Despite the teething issues and the price, I'm rather keen on this. Waving my hand next to my phone to exchange cryptographic information makes me feel part-way to being a cyborg-wizard. Is this the future of wearable technology? I don't know - but it is rather fun. I'm happy to be an early-adopter and to bash out the bugs in the tech.

If you want, VivoKey will also sell you an [NFC Implant](https://vivokey.com/spark/ ) which you can inject under your skin and use as an MFA token. Personally, I think I'll stick with the ring!

You can [buy the ring directly from Cybernetic](https://getcybernetic.com/ ).
FIDO2? U2F? MFA? PassKeys? Some of these are technologies and some are marketing terms. In most cases it is transparent to the user. They type in their username and password, then they have to present another credential. That could be a code sent by a text message, or generated by an app. In this case, they present their NFC token. Technically, a PassKey is designed to replace usernames and password - present your key and that's the only credential you'll need. The reality is that various sites use these terms interchangeably. ↩︎
Technical issues. Obviously my many personal issues remain load-bearing. ↩︎
I don't have a Tesla to test it on. And I'd rather keep it that way! ↩︎
Not a typo. NFC is designed for low power and fairly low speed. https://shkspr.mobi/blog/2020/06/gadget-review-ysshui-ntag215-nfc-tags/">Most commercial NFC tags have about 500 bytes of storage. The memory on this ring will let you share up to 32KB of data - if you remove the other applets. ↩︎

#2fa #fido #gadget #MFA #nfc #review #rfid

If you already left #emfcamp, you're missing shenanigans to ...

2026-07-19T21:12:15Z

If you already left #emfcamp, you're missing shenanigans to prepare for the next one!

This is also #emfcamp ...

2026-07-19T16:34:40Z

This is also #emfcamp

These are hard to photograph! #emfcamp #tildagon #hexpansions ...

2026-07-10T19:07:29Z

These are hard to photograph! #emfcamp #tildagon #hexpansions

Would you like a large and pretty stamp at #emfcamp ? Come find ...

2026-07-10T14:19:26Z

Would you like a large and pretty stamp at #emfcamp ?

Come find me at the Guild of (Bread) Makers!

This is the first time I've seen definite Starlink trails on ...

2026-07-09T15:28:24Z

This is the first time I've seen definite Starlink trails on the meteor camera (given how busy my skies are, it's not a big problem for it).

Nostr event nevent1qqsre52caw4z7hrm756n5pyz3fz2jrd5wpsreaeg2muczjdadzhxy9gzyq6zdu4ha8steju6nnsxd9dt690ycmerenz2zcqekzd6pmg3fhr25vdaryw

2026-07-05T22:06:01Z

Well, no one is going to work in #Norway tomorrow. Heia Norge!

This is what the inside of everyone's camper van looks like, ...

2026-06-19T15:52:02Z

This is what the inside of everyone's camper van looks like, right?

Ah yes, the four food groups. ...

2026-06-14T18:18:39Z

Ah yes, the four food groups.

Overcoming an ADHD executive function block is like trying to ...

2026-06-05T20:09:22Z

Overcoming an ADHD executive function block is like trying to open a door where the hinges are mostly rust. A tremendous effort is required to budge it at all. The adrenaline rush of being chased by a tiger/zombie would do it, but when it's not something you *have* to do...

Anyways, I started working on a project I've had in my head for ~8 years. I've been trying to do this all spring, and now I have one week left.

Solar panels have really come a long way. Currently getting ready ...

2026-05-10T18:42:16Z

Solar panels have really come a long way. Currently getting ready for a trek this fall, and I'm testing this $25 10W foldable panel that is actually putting out 10W.

Charging a big USB battery at 5V@1.9A right now.

I've seen a few satellite breakups, and they also move *much ...

2026-03-22T02:09:58Z

In reply to nevent1q…zu94
_________________________

I've seen a few satellite breakups, and they also move *much slower* across the sky than a meteor.

hah, I was actually going to recommend a place to you, but ...

2026-03-20T10:27:28Z

In reply to nevent1q…79y0
_________________________

hah, I was actually going to recommend a place to you, but didn't want to tempt you into spending money 😅

Well, that seems to work...time for a major revision to the ...

2026-03-19T23:22:59Z

Well, that seems to work...time for a major revision to the concept.

this may be unrelated to the story, but regular people are often ...

2026-02-27T15:45:02Z

In reply to nevent1q…u2na
_________________________

this may be unrelated to the story, but regular people are often so unprepared for that particular corner of the US. I've had some alarming GPS route suggestions in that area.

Google Maps in particular should be much better at alerting you when something is on a gravel or unimproved road. You're also not likely to have phone signal, so if you lose GPS and your route, its easy to get lost.

One of the more ludicrous (but delightful) boards I was given at ...

2025-11-06T15:16:00Z

One of the more ludicrous (but delightful) boards I was given at #Supercon was this one - the CapKey. It's a capacitive-touch keyboard the size of a keycap.

Would tag the maker, but can't seem to find him!

An unbearably good sighting of a mama and two cubs in Kings ...

2025-09-12T03:33:39Z

An unbearably good sighting of a mama and two cubs in Kings Canyon today! (Only one cub pictured)

I could use some #retrocomputing help! I recently acquired a ...

2025-07-29T00:49:11Z

I could use some #retrocomputing help!

I recently acquired a (homebuilt) device from a friend, and as a labor of love, I'm trying to restore it for him.

It has a single broken key (contacts are broken), which I don't see any good way to fix without replacement.

Anyone have any idea what this keyboard is?

Boosts are appreciated!

The hike is not too bad, just 8km and 1100m of ascent the way I ...

2025-06-24T16:08:38Z

In reply to nevent1q…ly0u
_________________________

The hike is not too bad, just 8km and 1100m of ascent the way I went, but the weather will get you quick.

I caught the cog railway back down, and as it turns out if you ...

2025-06-24T15:58:38Z

In reply to nevent1q…ysql
_________________________

I caught the cog railway back down, and as it turns out if you catch the first one, it's empty, so I was the only passenger!

Goodness. It is indeed somewhat windy up here. ...

2025-06-24T13:14:49Z

In reply to nevent1q…uq7u
_________________________

Goodness. It is indeed somewhat windy up here.

I'm planning on climbing a famously-windy peak tomorrow. Just ...

2025-06-24T00:04:57Z

I'm planning on climbing a famously-windy peak tomorrow. Just saw the forecast:

Wind: W shifting NW at 45-60 mph w/ gusts up to 70 mph decreasing to 35-50 mph w/ gusts up to 60 mph

This was also fun (it's the same CEO). ...

2025-05-22T21:51:09Z

In reply to nevent1q…kwzy
_________________________

This was also fun (it's the same CEO).

Oh, also: ...

2025-05-22T21:45:55Z

In reply to nevent1q…wufs
_________________________

Oh, also:

I'm describing the current state of LLMs for a talk I'm ...

2025-05-22T21:44:39Z

I'm describing the current state of LLMs for a talk I'm giving soon.

Am I wrong?

This is, quite literally, the physical manifestation of technical ...

2025-03-31T20:14:13Z

In reply to nevent1q…y8tt
_________________________

This is, quite literally, the physical manifestation of technical debt.

A bunch of bad choices have led me here, but unless things go wrong, there's no turning back now, even though I know it will need a full rebuild.

Oh god, now the solder pot is out. What have I gotten myself ...

2025-03-31T18:09:53Z

In reply to nevent1q…zu3q
_________________________

Oh god, now the solder pot is out. What have I gotten myself into...

When you don't have the right terminal strips on hand, but ...

2025-03-31T17:46:00Z

When you don't have the right terminal strips on hand, but you do have a lot of knock-off wagos, you end up making stupid things like wago cascades.

Every once in a while, something truly great is on the ...

2025-03-05T11:37:51Z

Every once in a while, something truly great is on the neighborhood Facebook pages.

By using the camera app on your smart watch, you can generate an ...

2025-02-16T22:43:06Z

By using the camera app on your smart watch, you can generate an infinite portal through your wrist.

A really serendipitous sunset captured with my Seestar S50 in ...

2024-11-09T03:52:13Z

A really serendipitous sunset captured with my Seestar S50 in time lapse mode. Organ Pipe Cactus National Monument with its eponymous cacti providing a backdrop.

Nice dark skies here in Big Bend National Park tonight ...

2024-10-29T12:31:36Z

Nice dark skies here in Big Bend National Park tonight

I had a second look, and if I really stretched the fabric, I ...

2024-10-21T20:41:28Z

In reply to nevent1q…fkmc
_________________________

I had a second look, and if I *really* stretched the fabric, I figured I might be able to get it to work, and sure enough...

Super-pleased with this!

100% inspired by @npub14ef…nkew I was side-quested from ...

2024-10-20T02:07:24Z

100% inspired by John Rogers (npub14ef…nkew) I was side-quested from cleaning out the garage to reupholster this office chair that I have had for 25 years. It has spent the last decade stained and dirty taking up space in the garage and slowly getting grungier.

I would have done the whole thing, but sadly don't have enough #emfcamp fabric! Maybe Morag (npub1csu…fqqy) will take pity on me and come up with some more.

Still love it as-is, though.

This is an Azorean tea-infused APA, and it was delicious! ...

2024-08-23T18:04:48Z

This is an Azorean tea-infused APA, and it was delicious!

Bit cloudy for #solar imaging, but still pretty easy today the ...

2024-07-30T20:06:09Z

Bit cloudy for #solar imaging, but still pretty easy today the crop of #sunspots up there!