solokeys / solo-webupdate Goto Github PK

Hello,

today I can't update my solokey secure. The website says: SITE FIRMWARE OUT OF DATE!

The latest release 2.4.3 is not available on the website. It still shows that the latest version is 2.4.2

One way to prevent the "many flashing popups" when updating firmware would be to use WebUSB to talk to the bootloader as HID device directly. A drawback is that only Chrome supports WebUSB (Firefox explicitly declares it will not support it): https://developer.mozilla.org/en-US/docs/Web/API/USB#Browser_compatibility

Update website (https://update.solokeys.com/) doesn't detect key when using "Inspect Key" button on Ubuntu.
Tested on latest Firefox.
Solo Secure key.

On Ubuntu (18.04) using Firefox nothing is detected, and yellow LED does not flash.
On Windows using Firefox it worked.

vivaldi dims down the entire browser window (and I do not mean fade, it just gets dark immediately) when the popup for pressing the button comes up, which while it does make sense to get attention this is really ugly to look at when updating or reflashing, and obviously may result in bad stuff with people senstivive to such rapid flashing of the whole screen when the browser is maximized.

there are 3 pin prompts when going to "Inspect key", might it not be useful to use "discouraged" for userverification so that it is a bit easier to use?

Could the relevant release notes for the upgrade being performed be included on the update page?

Failing that, it might be worth adding a link over to the general release notes page

Last link in readme file is broken. The text "fetched and hosted" is linked to https://github.com/solokeys/solo-webupdate/blob/master/fetch-firmware.sh but that serves a 404 error.

Recently _blank was added to index.html, as a new target for opened links. It might be maliciously used. Please use the suggested alternative, or complementary attribute.
References:

• https://www.quora.com/Is-it-wrong-and-why-to-use-target-_-blank-for-a-html-link
• https://medium.com/@ali.dev/how-to-fix-target-blank-a-security-and-performance-issue-in-web-pages-2118eba1ce2f
• https://blog.dareboost.com/en/2017/03/target-blank-links-rel-noopener-performance-security/

Commit: defb625
Source:

cc: @StoyanDimitrov

After attempting to update my Solo (secure) key, it got stuck in the bootloader mode (LED flashes red rapidly as soon as I plug it in)
I've tried reflashing it but it doesn't do much. The console lists this error among other things:

Uncaught (in promise) TypeError: Cannot read property 'status' of undefined at update (main.js:289) at async update_secure (main.js:252)

I wanted to try reflashing it using the Python tool with no succes:

C:\Users\user>solo key update --secure
`No Solo key found!`
If you are on Linux, are your udev rules up to date?
Try adding a rule line such as the following:
ATTRS{idVendor}=="0483", ATTRS{idProduct}=="a2ca", TAG+="uaccess"
For more, see https://docs.solokeys.io/solo/udev/

I'm guessing it's bricked. Is there a way to reflash the firmware at this point?

edit: So I've tried running solo program bootloader firmware-secure-2.2.0.json but that also results in a solo.exceptions.NoSoloFoundError: no Solo found

Neither the bootloader interface, the dfu interface or the aux commands work.

I'm trying to update my Solo Key with my machine, which is running the latest Windows Insider preview (build 18358.1) and Google Chrome 72.0.3626.121.
Chrome is able to detect the key, but when I enable bootloader mode it keeps complaining that the device isn't in bootloader mode at all.
Here are the steps I've taken:

1. I've plugged the key
2. I've pressed the "Check for updates" button on the website
3. I've inserted my PIN, followed by the press of the Solo Key button
4. The website finds my Solo Key and prompts me to perform the update.
5. I unplug the Solo Key, then I plug it back by keeping pressed the button
6. After a few seconds the led starts to quickly pulse
7. I press the Update Solo Secure button on the website.
8. I get the error: DEVICE IS NOT IN BOOTLOADER MODE. Please unplug your key, and plug in while keeping pressed until the LED blinks. Then try to flash again

Tried updating the Solo Hacker as it would not work correctly as a security key, but having problems updating the firmware.

Should add a deprecation message to README.md, since this project seems to be deprecated. Possibly provide links to the desktop and/or solo-python

Has anyone else noticed that this no longer works in Chrome. Recently it looks like Chrome changed how they do FIDO2, maybe to add resident key support? The browser now sends out a getinfo request first, then it does the CTAP_GET_ASSERTION. Anyway it looks like the update site doesn't work anymore.

(Not sure if this is the right place to request this...)

I've just randomly stumbled across https://update.solokeys.com/ and updated my keys to 2.0.0.

As an end-consumer I didn't know about this webpage or any available firmware updates. I missed the note at the end of the last Kickstarter update mail.

I suggest setting up a dedicated update newsletter.

https://update.solokeys.com/ currently returns:

SITE FIRMWARE OUT OF DATE!

Please inform SoloKeys!
Firmware flashing deactivated.

On https://update.solokeys.com/:

You are running Vue in development mode.
Make sure to turn on production mode when deploying for production.
See more tips at https://vuejs.org/guide/deployment.html

I'm trying to update my Solo to the latest firmware. I followed the instruction. When I insert the key, it's current firmware release is recognized. However, when choosing 'Inspect Key', every browser (Firefox, Edge, Chrome) asks me to setup a PIN. So I enter a PIN, but the Solo's LED turns into a solid red and Windows complains it is unable to setup the PIN.

When I cancel out of that screen, the inspect key button never works.

• Do I need to have a PIN to update?
• If so, how do I setup a PIN, since Windows seems unable to do so?

Thanks!