From e021ce3560bf86298e5c0c9b321356aceaf7ca48 Mon Sep 17 00:00:00 2001 From: T Date: Mon, 7 Sep 2026 21:40:55 -0400 Subject: [PATCH 1/7] Docs for firmware 3.1.0: user input modes, web derive mode, CLI additions, retired quick setup / plausible deniability / Travel Edition - command-line: `capabilities`; `storedkeymode`/`derivedkeymode` now 0/1/2 with Button Press as the default and config mode required; new `webderivemode`; `2ndprofilemode` only accepts 1; `sysadminmode`/`lockbutton` descriptions were copy-pasted from the challenge-mode entries and are corrected; `setkey`/`genkey` gain `c` (X25519 - `x` was documented as X25519 but is Ed25519), `m`, `w`. - usersguide / duousersguide: the three user input modes described once with the new default, plus the Web Derived Key User Input Mode section; quick setup section replaced by a note that it was removed; button definitions for an unconfigured device updated. - onlykey-agent: button-press default, GPG notes, `--skey derived-v2` (HKDF derivation added alongside the released one). - ite / pdguide: rewritten as retirement notices. pdguide documents the automatic migration of an existing plausible deniability profile (first primary-PIN unlock converts it; second PIN does not unlock until then) and the removal of legacy support in the following release. features / index / faq / webcrypt updated to match. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_0159zPxi7DCuucC1ZcqYBB8W --- docs/command-line.md | 54 +++++++++++++++++-------- docs/duousersguide.md | 8 +++- docs/faq.md | 2 +- docs/features.md | 10 ++--- docs/index.md | 4 +- docs/ite.md | 92 ++++++------------------------------------ docs/onlykey-agent.md | 10 +++-- docs/pdguide.md | 93 +++++++------------------------------------ docs/usersguide.md | 29 ++++---------- docs/webcrypt.md | 2 +- 10 files changed, 93 insertions(+), 211 deletions(-) diff --git a/docs/command-line.md b/docs/command-line.md index e8dbaf9..9a7d217 100644 --- a/docs/command-line.md +++ b/docs/command-line.md @@ -131,6 +131,12 @@ Displays the version of the app #### fwversion Displays the version of the OnlyKey firmware +#### capabilities +Asks the firmware what it supports (firmware 3.1.0 or later): firmware version and commit +hashes, protocol version, supported key types, build flags (PQC, DUO, debug build, whether the +"no press" user input mode is compiled in) and the user input modes each of derivedkeymode / +storedkeymode / webderivemode accepts. Older firmware is reported as not supporting the report. + #### wink OnlyKey flashes blue (winks), may be used for visual confirmation of connectivity @@ -206,18 +212,28 @@ WARNING: Setting button's touch sensitivity lower than 5 is not recommended as t 2 = highest sensitivity; 100 = lowest sensitivity [12 = default] #### 2ndprofilemode [num] -Set during init (Initial Configuration) to set 2nd profile type 1 = standard (default); 2 = plausible deniability +Set during init (Initial Configuration) to set 2nd profile type. 1 = standard is the only supported value. +Value 2 (plausible deniability) is retired as of firmware 3.1.0 and is refused; see the +[Plausible Deniability Setup Guide](/pdguide) for what happens to devices that already use it. #### storedkeymode [num] -Enable or disable challenge for stored keys (SSH/PGP) -0 = Challenge Code Required (default); 1 = Button Press Required +User input required to use a stored key (RSA1-4, ECC1-16) for SSH/PGP +0 = Challenge Code Required; 1 = Button Press Required (default); 2 = No Press (only on firmware built with `OK_ALLOW_NO_PRESS`, refused otherwise) +Device must be in config mode to change this setting. [More info](/usersguide#stored-challenge-mode) #### derivedkeymode [num] -Enable or disable challenge for stored keys (SSH/PGP) -0 = Challenge Code Required (default); 1 = Button Press Required +User input required to use a derived key (OnlyKey Agent SSH/PGP identities) +0 = Challenge Code Required; 1 = Button Press Required (default); 2 = No Press (only on firmware built with `OK_ALLOW_NO_PRESS`, refused otherwise) +Device must be in config mode to change this setting. [More info](/usersguide#derived-challenge-mode) +#### webderivemode [num] +User input required to use a web derived key (keys derived per label for the browser apps at onlyagent.app and for `age-plugin-onlykey`, X25519 and X-Wing) +0 = Challenge Code Required; 1 = Button Press Required (default); 2 = No Press +Device must be in config mode to change this setting. The key itself never depends on this setting - a file encrypted to a label always decrypts regardless of how the user confirms. +[More info](/usersguide#web-derive-mode) + #### hmackeymode [num] Enable or disable button press for HMAC challenge-response 0 = Button Press Required (default); 1 = Button Press Not Required. @@ -228,15 +244,13 @@ Enable or disable button press for HMAC challenge-response WARNING - Once set to "Locked" this cannot be changed unless a factory reset occurs. [More info](/usersguide#backup-key-mode) -#### sysadminmode -Enable or disable challenge for stored keys (SSH/PGP) -0 = Challenge Code Required (default); 1 = Button Press Required -[More info](/usersguide#derived-challenge-mode) +#### sysadminmode [num] +Enable or disable sysadmin mode (modifier keys in slots). Device must be in config mode to change this setting. +[More info](/usersguide#sysadmin-mode) -#### lockbutton -Enable or disable challenge for stored keys (SSH/PGP) -0 = Challenge Code Required (default); 1 = Button Press Required -[More info](/usersguide#derived-challenge-mode) +#### lockbutton [num] +Set which button locks the device (per profile). +[More info](/usersguide#configurable-lock-button) ### Slot Config Options @@ -271,9 +285,12 @@ Sets raw private keys and key labels, to set PEM format keys use the OnlyKey App - [key slot] must be key number RSA1 - RSA4, ECC1 - ECC16, HMAC1 - HMAC2 - [type] must be one of the following: - label - set to have a descriptive key label i.e. My GPG signing key - - x - X25519 Key Type (32 bytes) + - x - Ed25519 Key Type (32 bytes, signing) - n - NIST256P1 Key Type (32 bytes) - s - SECP256K1 Key Type (32 bytes) + - c - X25519 (Curve25519) Key Type (32 bytes, decryption only) + - m - ML-KEM-768 seed (64 bytes, decryption only, firmware 3.1.0+) + - w - X-Wing seed (32 bytes, decryption only, firmware 3.1.0+) - 2 - RSA Key Type 2048bits (256 bytes) - 4 - RSA Key Type 4096bits (512 bytes) - h - HMAC Key Type (20 bytes) @@ -287,9 +304,12 @@ Sets raw private keys and key labels, to set PEM format keys use the OnlyKey App Generates random private key on device - [key slot] must be key number ECC1 - ECC16 (only ECC keys supported) - [type] must be one of the following: - - x - X25519 Key Type (32 bytes) - - n - NIST256P1 Key Type (32 bytes) - - s - SECP256K1 Key Type (32 bytes) + - x - Ed25519 Key Type + - n - NIST256P1 Key Type + - s - SECP256K1 Key Type + - c - X25519 (Curve25519) Key Type + - m - ML-KEM-768 Key Type (firmware 3.1.0+) + - w - X-Wing Key Type (firmware 3.1.0+) - [features] must be one of the following: - s - Use for signing - d - Use for decryption diff --git a/docs/duousersguide.md b/docs/duousersguide.md index 658a3f3..3cc77ee 100644 --- a/docs/duousersguide.md +++ b/docs/duousersguide.md @@ -576,13 +576,17 @@ Note: These additional keyboard layouts are available but cannot currently be se OnlyKey supports automatic generation of keys that may be used for SSH and PGP/GPG with the [OnlyKey Agent](/onlykey-agent). -The default setting is "Challenge Code Required" which requires a 3 digit challenge code to be entered on OnlyKey to perform SSH or PGP/GPG operation. This is great for security but for some users a more convenient approach may be preferred. With "Button Press Required", a physical press on any key is all that is required to perform the operation. +This setting chooses how you confirm each use of a derived key. Since firmware 3.1.0 the default is **Button Press Required**: a physical press on any of the three buttons completes the operation. **Challenge Code Required** asks for a 3 digit code instead (the agent prints the code; on a DUO each digit is 1-3); it is the stronger choice when the host might issue requests you did not initiate. A third value, **No Press**, exists for unattended use but is only honoured by firmware built with `OK_ALLOW_NO_PRESS`; production firmware refuses it. The setting can only be changed with the device in config mode, and the key itself never depends on it. ### Stored Key User Input Mode {#stored-challenge-mode} OnlyKey supports [import of existing OpenPGP keys](/importpgp#loading-keys) using the [OnlyKey app](/app). These keys once imported are securely stored in OnlyKey hardware and may be used to perform SSH or PGP/GPG operations with the [OnlyKey Agent](/onlykey-agent) or in the browser with the [OnlyKey WebCrypt](/webcrypt). -By default, you must enter a 3 digit challenge code on OnlyKey to perform SSH or PGP/GPG operation. If a more convenient approach is preferred "Button Press Required" may be set so that a physical press on any key is all that is required. +The same three choices as the derived key setting apply, independently: Challenge Code Required, Button Press Required (default since firmware 3.1.0) and No Press (development firmware only). Config mode is required to change it. + +### Web Derived Key User Input Mode {#web-derive-mode} + +Browser apps at [onlyagent.app](https://onlyagent.app) and the `age-plugin-onlykey` command line tool can derive an X25519 or X-Wing (post-quantum hybrid) key from a label you choose; the device never stores the key and the same label always yields the same key, in the browser and on the command line. This setting chooses how those derivations are confirmed: Challenge Code Required (the page or tool shows the 3 digit code), Button Press Required (default) or No Press. It is set from the OnlyKey App preferences or `onlykey-cli webderivemode`, in config mode. As with the other two settings, changing it never changes the derived key, so files encrypted to a label always decrypt. ### HMAC Mode {#hmac-mode} diff --git a/docs/faq.md b/docs/faq.md index d1490ee..d28fdd5 100644 --- a/docs/faq.md +++ b/docs/faq.md @@ -81,7 +81,7 @@ There are a variety of hardware and software tokens out there. Some support FIDO ## What specifically are the differences between the Standard Edition firmware and the International Travel Edition firmware? -The International Travel Edition firmware is essentially a feature limited version of the OnlyKey. It is a fully functional password manager but does not utilize encryption and may be usable in countries where encryption is banned/restricted. More information [here](/ite). +The International Travel Edition firmware was a feature limited version of the OnlyKey: a password manager that did not use encryption, for countries where encryption is banned or restricted. It is retired as of firmware 3.1.0 and there is one firmware edition. More information, including what to do with a device still running it, [here](/ite). ## What does entering the self destruct PIN do? diff --git a/docs/features.md b/docs/features.md index 210235f..b772e23 100644 --- a/docs/features.md +++ b/docs/features.md @@ -71,10 +71,8 @@ In a pinch and want to wipe your OnlyKey? Enter your self-destruct PIN to wipe E * [What does entering the self destruct PIN do?](/faq#what-does-entering-the-self-destruct-pin-do) -### PLAUSIBLE DENIABILITY FEATURE -The first and only hardware solution where only you hold the keys + no proof there even are keys! Travel abroad without having to give up your encryption keys/passwords. - -* [International Travel Edition Guide](/ite) +### PLAUSIBLE DENIABILITY FEATURE (RETIRED) +The plausible deniability second profile and the International Travel Edition firmware are retired as of firmware 3.1.0. Every profile is encrypted under its PIN; there is one firmware edition. See the [Plausible Deniability Setup Guide](/pdguide) for what changes on devices that already use it. ### ENCRYPTED BACKUP ANYWHERE OnlyKey types out the encrypted backup so it works anywhere independent of apps. Save the encrypted backup to a file or email it to yourself. @@ -155,9 +153,7 @@ OnlyKey is the world's first device to allow changing your keyboard layout on th #### Unconfigured OnlyKey {#uninitialized-onlykey} -* Hold button #3 down for 5+ seconds to start quick setup - See [OnlyKey Quick Setup](/usersguide#quick-setup) for more information. -* Hold button #1 down for 5+ seconds to start quick setup in manual mode. -* Hold button #2 down for 5+ seconds to start quick setup in auto mode. +* An unconfigured OnlyKey does nothing on button presses; set it up with the [OnlyKey App](/usersguide#onlykey-setup). (Firmware before 3.1.0 started the removed keyboard quick setup here.) #### Locked OnlyKey {#locked-onlykey} diff --git a/docs/index.md b/docs/index.md index 9bf9045..82a3653 100644 --- a/docs/index.md +++ b/docs/index.md @@ -80,7 +80,7 @@ The Knowledge Base contains guides and information for using OnlyKey in specific **[Works with OnlyKey](/workswithonlykey)** - A list of applications and things that work with OnlyKey -**[International Travel Edition Guide](/ite)** - Follow this guide to use the International Travel Edition OnlyKey. +**[International Travel Edition Guide](/ite)** - Retired as of firmware 3.1.0; the guide explains what to do with a device running it. -**[Plausible Deniability Setup Guide](/pdguide)** - Follow this guide to use the plausible deniability feature of OnlyKey +**[Plausible Deniability Setup Guide](/pdguide)** - Retired as of firmware 3.1.0; the guide explains how existing plausible deniability profiles are migrated. diff --git a/docs/ite.md b/docs/ite.md index 91a8b8a..ce55e45 100644 --- a/docs/ite.md +++ b/docs/ite.md @@ -1,93 +1,27 @@ --- title: International Travel Edition Guide -description: Follow this guide to use the International Travel Edition OnlyKey +description: The International Travel Edition firmware is retired; what to do with a device running it slug: ite -last_updated: June, 6, 2024 +last_updated: September, 7, 2026 keywords: OnlyKey, International Travel Edition, Plausible Deniability --- -## What is the International Travel Edition? +## The International Travel Edition is retired -This version of OnlyKey firmware is designed to meet all international requirements in regards to encryption. It does this by not utilizing encryption at all. Because this version does not encrypt any data on device it can be used in areas where data encryption is forbidden and/or there are mandatory key disclosure requirements. This is particularly useful for international travel where the traveler would like to have secure portable access to accounts. +The International Travel Edition was a separate OnlyKey firmware build that did not use encryption, intended for countries where encryption is banned or restricted. It was a fully functional password manager without PGP, SSH, backup encryption, or the second (encrypted) profile. -## How are accounts secure without encryption? +As of firmware 3.1.0 there is one OnlyKey firmware edition, and every profile is encrypted under its PIN. The Travel Edition build is no longer produced, and the standard firmware no longer contains the non-encrypted mode it relied on. -Even though data is not encrypted, there is physical security of the accounts on the OnlyKey. This is accomplished through locking the flash memory and requiring a PIN code to access accounts. The accounts stored on the device can only be accessed with the correct PIN. Entering 10 incorrect PINs will completely wipe the device. Unlike a device like a flash/jump drive, the OnlyKey is locked so that there is no way of reading the data stored on the device. +## If your OnlyKey is running the International Travel Edition -## Limited features +Your device keeps working as it is; nothing changes until you load new firmware. When you are ready to move to the standard firmware: -The International Travel Edition has a limited feature set, including: +1. Take a backup of your slots with the [OnlyKey App](/app) (backups made on the Travel Edition are not encrypted - treat the file accordingly). +2. Load the standard firmware following the [firmware loading guide](/firmware). +3. Set the device up again with the App (PINs, backup passphrase) and restore your backup. -- Storage of 12 slots, each slot may contain: - - Label - A reminder of what account is stored - - URL - The site to log into may be automatically typed in the browser address bar - - Username - - Password - - 2FA - Google Authenticator OTP (TOTP) is supported +There is no in-place upgrade path from the Travel Edition, because the device has no encryption keys to migrate. -- Firmware loading through the app - You can switch back and forth from the International Travel Edition and Standard edition firmware through the OnlyKey app. - -- Preferences - - Type Speed - - Keyboard layout (International keyboard profiles are helpful for international travel) - - Wipe mode - - Inactivity lockout period - -Features not included in the International Travel Edition OnlyKey that are available in the Standard Edition OnlyKey: -- Secure backup and restore -- FIDO U2F / Yubikey OTP -- SSH/OpenPGP -- Second Profile - -## Switch to Standard Edition Firmware - -It is easy to switch between the International Travel Edition firmware and the Standard Edition firmware. Keep in mind that switching from the Standard Edition to the International Travel Edition will disable features not available such as the second profile. In order to switch to Standard Edition firmware ensure that your International Travel Edition OnlyKey is in a factory default state and select [Load Firmware] in the OnlyKey App. - -- Download OnlyKey Standard Edition firmware -- Download OnlyKey International Travel Edition firmware - -:::note -You can ensure the integrity of your downloaded file by verifying the checksum.
Signed_OnlyKey_3_0_4_STD.txt f895100a2f828b66ec5335fd676ef659daf87d51bfeecca5fb8bf9b7c8e259bd
Signed_OnlyKey_3_0_4_IN_TRVL.txt 0c4d2f33c5b934c422b7bc9642d0f696c5674c2cf307756c5dee0933a70cd745 -::: - -- Select the [Load Firmware] button as shown below and follow the instructions in the app to load firmware - -![](/assets/ite6.png) - -:::tip "💡 Pro Tip" -***Factory Default?***

-To perform a factory default you have two options: -
-
-**Method #1** - Enter your self-destruct PIN. -
-
-**Method #2** - Enter 10 incorrect PINs. You will notice that after entering 3 incorrect PINs your OnlyKey is steadily blinking red. This is an intentional safeguard so that your OnlyKey will not be inadvertently wiped by repeatedly pressing buttons. You must remove and reinsert your OnlyKey and enter 3 more incorrect PINs. Repeat this until 10 incorrect PINs have been entered. The device will then have a solid green light on that indicates that it is in a factory default state. -::: - -## Setup guide - -In order to setup an OnlyKey with the International Travel Edition first ensure you have loaded the International Travel Edition firmware and you have installed the OnlyKey app. - -Step 1 - Select [Next] to get started. -![](/assets/ite1.png) - -Step 2 - Enter a PIN code, check the disclaimer box, and select [Next]. -![](/assets/ite2.png) - -Step 3 - Re-enter PIN code, and select [Next]. - -Step 4 - Select [I don't want a second profile, skip this step] -![](/assets/ite4.png) - -Step 5 - If you wish to set a self-destruct PIN enter a PIN code, check the disclaimer box, and select [Next]. -![](/assets/ite5.png) - -Step 6 - Re-enter PIN code, and select [Next]. - -Your device is now set up, remove and reinsert OnlyKey to set up accounts. - -### Set Wipe Mode - -The wipe mode setting determines what is wiped when a factory default occurs. The default setting is to just wipe the sensitive data, there is also the option to do a "Full Wipe" which wipes sensitive data and firmware. If keeping the type and version of firmware that is loaded confidential is desired, go to preferences in the OnlyKey app and set the wipe mode of your OnlyKey to "Full Wipe". More information on this setting is available here - [Wipe Mode Feature](/usersguide#configurable-wipe-mode). +## Related +- [Plausible Deniability Setup Guide](/pdguide) - the plausible deniability second profile, which used the same non-encrypted mode, is retired at the same time and is migrated automatically. diff --git a/docs/onlykey-agent.md b/docs/onlykey-agent.md index 495f972..c64ef71 100644 --- a/docs/onlykey-agent.md +++ b/docs/onlykey-agent.md @@ -59,7 +59,7 @@ Cut and paste the whole string into your server ~/.ssh/authorized_keys file, you $ onlykey-agent identity@myhost -c ``` -You will be prompted for a challenge code, type this on your OnlyKey to complete log in. If you wish to just require any button press to login, in the OnlyKey App -> Preferences choose to [disable challenge code](/usersguide#derived-challenge-mode) (device must be in config mode to change setting). +Press any button on your OnlyKey to complete log in (the default since firmware 3.1.0). If your OnlyKey is set to [Challenge Code Required](/usersguide#derived-challenge-mode) the agent prints a 3 digit code instead; type it on the OnlyKey. The setting is changed in the OnlyKey App -> Preferences with the device in config mode. ### Common SSH Use Cases @@ -716,8 +716,12 @@ onlykey-agent user@host -e rsa -sk RSA2 ### Setting Derived Key User Input Mode {#setting-derived-key-user-input-mode} -Currently it is not possible to display the 3 digit challenge code to user through GPG. This feature is on the roadmap. To use derived keys with GPG go to preferences in the OnlyKey app and set 'Derived Key User Input Mode' to 'Button Press Required'. +Since firmware 3.1.0 the default is 'Button Press Required', which is what GPG needs: GPG cannot display the 3 digit challenge code. If you changed the setting to 'Challenge Code Required', set it back in the OnlyKey app preferences (config mode) before using derived keys with GPG. ### Setting Stored Key User Input Mode {#setting-stored-key-user-input-mode} -Currently it is not possible to display the 3 digit challenge code to user through GPG. This feature is on the roadmap. To use derived keys with GPG go to preferences in the OnlyKey app and set 'Stored Key User Input Mode' to 'Button Press Required'. +As above: 'Button Press Required' is the default and is required for GPG use of stored keys. + +### Derived key versions {#derived-key-versions} + +Derived SSH/GPG identities come from a key generation function on the device. Firmware 3.1.0 adds a second version of that function (HKDF-SHA256) alongside the released one; existing identities are unaffected and remain the default. To create identities with the new derivation, pass `--skey derived-v2` (and `--dkey derived-v2` for GPG) to `onlykey-agent` / `onlykey-gpg`, or set `--skey-slot=derived-v2` in `run-agent.sh`. The two versions produce different keys for the same identity string, so pick one per identity and keep it. diff --git a/docs/pdguide.md b/docs/pdguide.md index 26c8f0a..0cc9f03 100644 --- a/docs/pdguide.md +++ b/docs/pdguide.md @@ -1,94 +1,31 @@ --- title: Plausible Deniability Setup Guide -description: Follow this guide to use the plausible deniability feature of OnlyKey +description: The plausible deniability second profile is retired; how existing profiles are migrated slug: pdguide -last_updated: Oct, 5, 2020 +last_updated: September, 7, 2026 keywords: OnlyKey, International Travel Edition, Plausible Deniability --- -## About Plausible Deniability +## Plausible deniability is retired -Before setting up plausible deniability read the International Travel Edition Guide [here](/ite). Once enabled, an OnlyKey with the Standard Edition firmware that is in plausible deniability mode is identical in functionality to an OnlyKey with the International Travel Edition (ITE) firmware. Since the ITE firmware has only one profile and does not utilize any data encryption a user may if forced to unlock their OnlyKey, unlock the plausible deniability profile. It is then plausible that the user's OnlyKey only has this one profile (the standard profile essentially becomes a hidden profile), and it is plausible that the user is not in possession of a data encryption device (useful where encryption my be banned as the ITE firmware does not encrypt any data). +The plausible deniability option for the second profile stored that profile's slots without encryption so that the device could be presented as having only one profile. As of firmware 3.1.0 it can no longer be selected: the OnlyKey App setup no longer offers it, and `onlykey-cli 2ndprofilemode 2` is refused with `Error plausible deniability profile is no longer supported`. Both profiles are encrypted under their PINs. -## Steps to Setup Plausible Deniability +Reasons for retiring it: profile 2's usernames, passwords and URLs were stored in the clear on the device; the "no second profile" story does not hold against an adversary who can image the chip; and every profile-aware feature had to be tested twice. Users who need to travel without secrets on the device should take an [encrypted backup](/usersguide#backup-key-mode), wipe the device with the self-destruct PIN, and restore afterwards. -:::note -Before getting started make sure you have OnlyKey firmware Beta 7 or later and the OnlyKey app is installed. OnlyKey must be in a factory default state to set up a plausible deniability profile. -::: +## If your OnlyKey already has a plausible deniability second profile -:::callout -**Step 1.** Select the Advanced checkbox and then select [Next] to get started. -::: +When you load firmware 3.1.0 or later, the device converts the profile the first time you unlock **profile 1**: -![](/assets/ite1.png) +1. Load the new firmware and enter your **primary** PIN once. The conversion runs during that unlock: profile 2's slot data is encrypted, its TOTP and challenge-response keys are re-keyed, and the second profile becomes a standard second profile. On a debug build the serial console prints `Migrating plausible-deniability profile 2 to a standard profile` and `Profile 2 migration complete`. +2. From then on your second PIN unlocks profile 2 exactly as before, with the same slot contents. -:::callout -**Step 2.** Enter a PIN code, check the disclaimer box, and select [Next]. -::: +Until that first primary-PIN unlock, the second PIN will **not** unlock profile 2 on the new firmware. If you cannot unlock profile 1, load the previous firmware, and everything is as it was. -![](/assets/ite2.png) +If you never set a second PIN, nothing is converted and the device works as a one-profile device. -:::callout -**Step 3.** Re-enter PIN code, and select [Next]. -::: +Support for reading unconverted plausible deniability profiles will be removed in the release after 3.1.0. Devices that skip 3.1.0 must install it (and unlock profile 1 once) before going further. -:::callout -**Step 4.** Enter a PIN code for second profile, check the disclaimer box, check the Plausible Deniability Profile radio button, and select [Next]. -::: - -![](/assets/ite4.png) - -:::callout -**Step 5.** If you wish to set a self-destruct PIN enter a PIN code, check the disclaimer box, and select [Next]. -::: - -![](/assets/ite5.png) - -:::callout -**Step 6.** Re-enter PIN code, and select [Next]. -::: - -:::callout -**Step 7.** Follow the instructions to enter a Backup Passphrase and select [Next]. -::: - -![](/assets/setup7-2.png) - -:::callout -**Step 8.** If you have an OnlyKey backup to restore, select [Choose File] and select your OnlyKey backup file and then select [Next] to load it onto your OnlyKey. If you do not have a backup just select [Next] to complete the setup. -::: - -![](/assets/setup10.png) - -:::note -Since plausible deniability mode does not support encryption, if accounts in your second profile of your backup have U2F or Yubikey 2FA set this will not be restored. TOTP mode will work in plausible deniability mode. -::: - -:::callout -**Step 9.** Your device will now automatically reboot. Enter the PIN for you first profile to unlock OnlyKey. -::: - -:::callout -**Step 10.** Select [Preferences] from the top menu and then click [Set Wipe Mode]. Full wipe will completely erase both the OnlyKey data and firmware in the event of a factory default. This is an important step as if this is not set it is possible to determine which firmware edition is loaded after doing a factory default, more information [here](/usersguide#configurable-wipe-mode) -::: - -![](/assets/pref.png) - -## Plausible Deniability FAQ - -Q - Is it believable that my OnlyKey only has one profile (only 12 slots used)?
-A - We sell quite a few [International Travel Edition (ITE) Onlykeys](https://onlykey.io/products/onlykey-international-travel-edition-w-stealth-black-case?variant=8661476737068) so yes it is believable that you are using one of these. It is also believable that even if you purchased a standard OnlyKey you then followed the guide [here](/ite) to load the ITE firmware in order to prepare for traveling. The ITE firmware is made for use in places where strong encryption may be controlled or banned. - -Q - Is having wipe mode set to "Full Wipe" an indicator that device is using plausible deniability?
-A - We recommend that all users desiring the highest level of security enable full wipe. This is described in the user's guide and in the [International Travel Edition Guide](/ite) as it ensures that no data or meta data such as what version of firmware was loaded is available to an adversary. - -Q - Why not just give an adversary your self-destruct PIN?
-A - If you are not concerned with plausible deniability then yes the self-destruct pin would be fine. The adversary would obviously know that this was intentional. - -Q - Wouldn't it be possible for an adversary to brute force the unknown primary profile PIN by trying 9 pins and then entering the known secondary profile pin?
-A - When using a plausible deniability profile there is a counter that counts how many failed login attempts since the last primary profile login. You have a maximum of 20 failed attempts since the last successful login to the primary profile. Once that is reached the primary profile hash is deleted, essentially the primary profile is gone forever. - -:::warning "⚠️ Warning" -This means if you have a plausible deniability profile you have to occasionally log into your standard profile. If you use the plausible deniability profile 20 times in a row the standard profile will no longer be accessible. -::: +## Related +- [International Travel Edition Guide](/ite) - the separate non-encrypted firmware build, retired at the same time. +- [Wipe Mode](/usersguide#configurable-wipe-mode) - "Full Wipe" remains available for users who want the self-destruct PIN to erase everything. diff --git a/docs/usersguide.md b/docs/usersguide.md index 4756e28..fc24463 100644 --- a/docs/usersguide.md +++ b/docs/usersguide.md @@ -28,27 +28,10 @@ Prefer a how-to video? Watch one [here](https://vimeo.com/967163806) that demons ### OnlyKey Quick Setup {#quick-setup} -:::warning "⚠️ Warning" -Quick setup is an alternative way to set up a new OnlyKey with no apps required. However, a computer with a US layout keyboard is required and to take advantage of many of the OnlyKey features the OnlyKey app is required. -::: - -To complete OnlyKey quick setup follow the instructions below: - -- Open a text editor such as Notepad (Windows) or TextEdit (Mac) on a trusted computer -- Click inside the text editor -- Insert OnlyKey into the USB port on your computer -- Hold button #3 on your OnlyKey down for 5+ seconds and then release - :::callout -OnlyKey will type out instructions for you to follow into the text editor. Follow these instructions to set PINs on OnlyKey and a backup passphrase. You can choose to have OnlyKey automatically generate random PINs or set PINs yourself. When setting a PIN keep in mind that remembering a pattern may be easier than remembering numbers. +Quick setup - holding a button on a new OnlyKey and having it type a setup walkthrough as a keyboard - was removed in firmware 3.1.0. New devices are set up with the [OnlyKey App](#onlykey-setup), which sets all three PINs and the backup passphrase. Devices set up with quick setup on earlier firmware are unaffected. ::: -- When you are complete the quick setup you will see the text 'SETUP COMPLETE, DELETE THIS TEXT' -- Make sure you have carefully written down your PINs and backup passphrase and store this in a secure location -- When finished enter your PIN onto OnlyKey to start using your new device, OnlyKey is ready for use as a security key (FIDO2/U2F) and for challenge-response - - ***To use OnlyKey for password management, file encryption, and other two factor authentication methods use the steps below to install the OnlyKey app***. - ### Install OnlyKey Desktop App {#app-desktop} :::callout @@ -82,7 +65,7 @@ As you use the OnlyKey app you can hover over icons for tooltips and click on ic ### OnlyKey Setup Using OnlyKey App {#onlykey-setup} -If you have already setup OnlyKey using quick setup proceed to [Account Setup](#account-setup) +If you have already set up OnlyKey proceed to [Account Setup](#account-setup) ::: steps 1. Insert OnlyKey and select [Next] to get started. @@ -786,13 +769,17 @@ Note: These additional keyboard layouts are available but cannot currently be se OnlyKey supports automatic generation of keys that may be used for SSH and PGP/GPG with the [OnlyKey Agent](/onlykey-agent). -The default setting is "Challenge Code Required" which requires a 3 digit challenge code to be entered on OnlyKey to perform SSH or PGP/GPG operation. This is great for security but for some users a more convenient approach may be preferred. With "Button Press Required", a physical press on any key is all that is required to perform the operation. +This setting chooses how you confirm each use of a derived key. Since firmware 3.1.0 the default is **Button Press Required**: a physical press on any button completes the operation. **Challenge Code Required** asks for a 3 digit code instead (the agent prints the code); it is the stronger choice when the host might issue requests you did not initiate. A third value, **No Press**, exists for unattended use but is only honoured by firmware built with `OK_ALLOW_NO_PRESS`; production firmware refuses it. The setting can only be changed with the device in config mode, and the key itself never depends on it. ### Stored Key User Input Mode {#stored-challenge-mode} OnlyKey supports [import of existing OpenPGP keys](/importpgp#loading-keys) using the [OnlyKey app](/app). These keys once imported are securely stored in OnlyKey hardware and may be used to perform SSH or PGP/GPG operations with the [OnlyKey Agent](/onlykey-agent) or in the browser with the [OnlyKey WebCrypt](/webcrypt). -By default, you must enter a 3 digit challenge code on OnlyKey to perform SSH or PGP/GPG operation. If a more convenient approach is preferred "Button Press Required" may be set so that a physical press on any key is all that is required. +The same three choices as the derived key setting apply, independently: Challenge Code Required, Button Press Required (default since firmware 3.1.0) and No Press (development firmware only). Config mode is required to change it. + +### Web Derived Key User Input Mode {#web-derive-mode} + +Browser apps at [onlyagent.app](https://onlyagent.app) and the `age-plugin-onlykey` command line tool can derive an X25519 or X-Wing (post-quantum hybrid) key from a label you choose; the device never stores the key and the same label always yields the same key, in the browser and on the command line. This setting chooses how those derivations are confirmed: Challenge Code Required (the page or tool shows the 3 digit code), Button Press Required (default) or No Press. It is set from the OnlyKey App preferences or `onlykey-cli webderivemode`, in config mode. As with the other two settings, changing it never changes the derived key, so files encrypted to a label always decrypt. ### HMAC Mode {#hmac-mode} diff --git a/docs/webcrypt.md b/docs/webcrypt.md index ec1b249..4f32722 100644 --- a/docs/webcrypt.md +++ b/docs/webcrypt.md @@ -177,7 +177,7 @@ Many journalists may travel and may have to make do with whatever internet conne It is often the case that secure solutions are not adopted not because of lack of availability but that they require considerable technical skills. For example, installing smart card software may require command line utilities and a high level of technical proficiency. At-risk communities may not have the technical proficiency to do this, with OnlyKey there are no commands necessary, setup is as easy as following step by step directions to generate a private key on Keybase and load onto the OnlyKey. This opens up the solution to a much wider range of at-risk communities. ### Plausible Deniability -Human rights activists and journalists may reside in or travel to countries with encryption bans or mandatory key disclosure. OnlyKey already has a feature for this to provide plausible deniability. Full details of this feature are available [here](/pdguide). +The plausible deniability second profile is retired as of firmware 3.1.0; see [here](/pdguide). ## Technical Specs From cc158b94f179d5cc1d1b7f2f96b90bb7b4a111d4 Mon Sep 17 00:00:00 2001 From: T Date: Mon, 7 Sep 2026 21:53:24 -0400 Subject: [PATCH 2/7] Remove the 2ndprofilemode CLI entry; the setting itself is gone Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_0159zPxi7DCuucC1ZcqYBB8W --- docs/command-line.md | 5 ----- docs/pdguide.md | 2 +- 2 files changed, 1 insertion(+), 6 deletions(-) diff --git a/docs/command-line.md b/docs/command-line.md index 9a7d217..910a683 100644 --- a/docs/command-line.md +++ b/docs/command-line.md @@ -211,11 +211,6 @@ Change the OnlyKey's button touch sensitivity. WARNING: Setting button's touch sensitivity lower than 5 is not recommended as this could result in inadvertent button press. 2 = highest sensitivity; 100 = lowest sensitivity [12 = default] -#### 2ndprofilemode [num] -Set during init (Initial Configuration) to set 2nd profile type. 1 = standard is the only supported value. -Value 2 (plausible deniability) is retired as of firmware 3.1.0 and is refused; see the -[Plausible Deniability Setup Guide](/pdguide) for what happens to devices that already use it. - #### storedkeymode [num] User input required to use a stored key (RSA1-4, ECC1-16) for SSH/PGP 0 = Challenge Code Required; 1 = Button Press Required (default); 2 = No Press (only on firmware built with `OK_ALLOW_NO_PRESS`, refused otherwise) diff --git a/docs/pdguide.md b/docs/pdguide.md index 0cc9f03..1e22fe2 100644 --- a/docs/pdguide.md +++ b/docs/pdguide.md @@ -8,7 +8,7 @@ keywords: OnlyKey, International Travel Edition, Plausible Deniability ## Plausible deniability is retired -The plausible deniability option for the second profile stored that profile's slots without encryption so that the device could be presented as having only one profile. As of firmware 3.1.0 it can no longer be selected: the OnlyKey App setup no longer offers it, and `onlykey-cli 2ndprofilemode 2` is refused with `Error plausible deniability profile is no longer supported`. Both profiles are encrypted under their PINs. +The plausible deniability option for the second profile stored that profile's slots without encryption so that the device could be presented as having only one profile. As of firmware 3.1.0 it can no longer be selected: the second profile type setting is gone from the OnlyKey App setup and from `onlykey-cli` (`2ndprofilemode` has been removed), and the firmware refuses the value if an older app sends it. Both profiles are encrypted under their PINs. Reasons for retiring it: profile 2's usernames, passwords and URLs were stored in the clear on the device; the "no second profile" story does not hold against an adversary who can image the chip; and every profile-aware feature had to be tested twice. Users who need to travel without secrets on the device should take an [encrypted backup](/usersguide#backup-key-mode), wipe the device with the self-destruct PIN, and restore afterwards. From 2f0d1e625512594099328c488c81cd49e8108c91 Mon Sep 17 00:00:00 2001 From: T Date: Mon, 7 Sep 2026 21:59:15 -0400 Subject: [PATCH 3/7] Docs: drop references to development-only firmware options Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_0159zPxi7DCuucC1ZcqYBB8W --- docs/command-line.md | 9 ++++----- docs/duousersguide.md | 4 ++-- docs/pdguide.md | 2 +- docs/usersguide.md | 4 ++-- 4 files changed, 9 insertions(+), 10 deletions(-) diff --git a/docs/command-line.md b/docs/command-line.md index 910a683..f768700 100644 --- a/docs/command-line.md +++ b/docs/command-line.md @@ -133,9 +133,8 @@ Displays the version of the OnlyKey firmware #### capabilities Asks the firmware what it supports (firmware 3.1.0 or later): firmware version and commit -hashes, protocol version, supported key types, build flags (PQC, DUO, debug build, whether the -"no press" user input mode is compiled in) and the user input modes each of derivedkeymode / -storedkeymode / webderivemode accepts. Older firmware is reported as not supporting the report. +hashes, protocol version, supported key types, device type (OnlyKey or DUO), post-quantum support and the +user input modes each of derivedkeymode / storedkeymode / webderivemode accepts. Older firmware is reported as not supporting the report. #### wink OnlyKey flashes blue (winks), may be used for visual confirmation of connectivity @@ -213,13 +212,13 @@ WARNING: Setting button's touch sensitivity lower than 5 is not recommended as t #### storedkeymode [num] User input required to use a stored key (RSA1-4, ECC1-16) for SSH/PGP -0 = Challenge Code Required; 1 = Button Press Required (default); 2 = No Press (only on firmware built with `OK_ALLOW_NO_PRESS`, refused otherwise) +0 = Challenge Code Required; 1 = Button Press Required (default) Device must be in config mode to change this setting. [More info](/usersguide#stored-challenge-mode) #### derivedkeymode [num] User input required to use a derived key (OnlyKey Agent SSH/PGP identities) -0 = Challenge Code Required; 1 = Button Press Required (default); 2 = No Press (only on firmware built with `OK_ALLOW_NO_PRESS`, refused otherwise) +0 = Challenge Code Required; 1 = Button Press Required (default) Device must be in config mode to change this setting. [More info](/usersguide#derived-challenge-mode) diff --git a/docs/duousersguide.md b/docs/duousersguide.md index 3cc77ee..2a502af 100644 --- a/docs/duousersguide.md +++ b/docs/duousersguide.md @@ -576,13 +576,13 @@ Note: These additional keyboard layouts are available but cannot currently be se OnlyKey supports automatic generation of keys that may be used for SSH and PGP/GPG with the [OnlyKey Agent](/onlykey-agent). -This setting chooses how you confirm each use of a derived key. Since firmware 3.1.0 the default is **Button Press Required**: a physical press on any of the three buttons completes the operation. **Challenge Code Required** asks for a 3 digit code instead (the agent prints the code; on a DUO each digit is 1-3); it is the stronger choice when the host might issue requests you did not initiate. A third value, **No Press**, exists for unattended use but is only honoured by firmware built with `OK_ALLOW_NO_PRESS`; production firmware refuses it. The setting can only be changed with the device in config mode, and the key itself never depends on it. +This setting chooses how you confirm each use of a derived key. Since firmware 3.1.0 the default is **Button Press Required**: a physical press on any of the three buttons completes the operation. **Challenge Code Required** asks for a 3 digit code instead (the agent prints the code; on a DUO each digit is 1-3); it is the stronger choice when the host might issue requests you did not initiate. The setting can only be changed with the device in config mode, and the key itself never depends on it. ### Stored Key User Input Mode {#stored-challenge-mode} OnlyKey supports [import of existing OpenPGP keys](/importpgp#loading-keys) using the [OnlyKey app](/app). These keys once imported are securely stored in OnlyKey hardware and may be used to perform SSH or PGP/GPG operations with the [OnlyKey Agent](/onlykey-agent) or in the browser with the [OnlyKey WebCrypt](/webcrypt). -The same three choices as the derived key setting apply, independently: Challenge Code Required, Button Press Required (default since firmware 3.1.0) and No Press (development firmware only). Config mode is required to change it. +The same two choices as the derived key setting apply, independently: Challenge Code Required and Button Press Required (default since firmware 3.1.0). Config mode is required to change it. ### Web Derived Key User Input Mode {#web-derive-mode} diff --git a/docs/pdguide.md b/docs/pdguide.md index 1e22fe2..c78f62e 100644 --- a/docs/pdguide.md +++ b/docs/pdguide.md @@ -16,7 +16,7 @@ Reasons for retiring it: profile 2's usernames, passwords and URLs were stored i When you load firmware 3.1.0 or later, the device converts the profile the first time you unlock **profile 1**: -1. Load the new firmware and enter your **primary** PIN once. The conversion runs during that unlock: profile 2's slot data is encrypted, its TOTP and challenge-response keys are re-keyed, and the second profile becomes a standard second profile. On a debug build the serial console prints `Migrating plausible-deniability profile 2 to a standard profile` and `Profile 2 migration complete`. +1. Load the new firmware and enter your **primary** PIN once. The conversion runs during that unlock: profile 2's slot data is encrypted, its TOTP and challenge-response keys are re-keyed, and the second profile becomes a standard second profile. 2. From then on your second PIN unlocks profile 2 exactly as before, with the same slot contents. Until that first primary-PIN unlock, the second PIN will **not** unlock profile 2 on the new firmware. If you cannot unlock profile 1, load the previous firmware, and everything is as it was. diff --git a/docs/usersguide.md b/docs/usersguide.md index fc24463..47d8efe 100644 --- a/docs/usersguide.md +++ b/docs/usersguide.md @@ -769,13 +769,13 @@ Note: These additional keyboard layouts are available but cannot currently be se OnlyKey supports automatic generation of keys that may be used for SSH and PGP/GPG with the [OnlyKey Agent](/onlykey-agent). -This setting chooses how you confirm each use of a derived key. Since firmware 3.1.0 the default is **Button Press Required**: a physical press on any button completes the operation. **Challenge Code Required** asks for a 3 digit code instead (the agent prints the code); it is the stronger choice when the host might issue requests you did not initiate. A third value, **No Press**, exists for unattended use but is only honoured by firmware built with `OK_ALLOW_NO_PRESS`; production firmware refuses it. The setting can only be changed with the device in config mode, and the key itself never depends on it. +This setting chooses how you confirm each use of a derived key. Since firmware 3.1.0 the default is **Button Press Required**: a physical press on any button completes the operation. **Challenge Code Required** asks for a 3 digit code instead (the agent prints the code); it is the stronger choice when the host might issue requests you did not initiate. The setting can only be changed with the device in config mode, and the key itself never depends on it. ### Stored Key User Input Mode {#stored-challenge-mode} OnlyKey supports [import of existing OpenPGP keys](/importpgp#loading-keys) using the [OnlyKey app](/app). These keys once imported are securely stored in OnlyKey hardware and may be used to perform SSH or PGP/GPG operations with the [OnlyKey Agent](/onlykey-agent) or in the browser with the [OnlyKey WebCrypt](/webcrypt). -The same three choices as the derived key setting apply, independently: Challenge Code Required, Button Press Required (default since firmware 3.1.0) and No Press (development firmware only). Config mode is required to change it. +The same two choices as the derived key setting apply, independently: Challenge Code Required and Button Press Required (default since firmware 3.1.0). Config mode is required to change it. ### Web Derived Key User Input Mode {#web-derive-mode} From 490e3a00a8a16eab077637f933243195f5da8e33 Mon Sep 17 00:00:00 2001 From: T Date: Mon, 7 Sep 2026 22:01:59 -0400 Subject: [PATCH 4/7] FAQ: drop the Travel Edition question Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_0159zPxi7DCuucC1ZcqYBB8W --- docs/faq.md | 4 ---- 1 file changed, 4 deletions(-) diff --git a/docs/faq.md b/docs/faq.md index d28fdd5..23ba1ff 100644 --- a/docs/faq.md +++ b/docs/faq.md @@ -79,10 +79,6 @@ In addition to on-device PIN security OnlyKey has functionality that smart cards There are a variety of hardware and software tokens out there. Some support FIDO U2F and others support Yubikey OTP and yet others support Google Authenticator (TOTP). Unfortunately for users not all websites support all of these. There is no standardization of two-factor support among websites so in order to log in using a token you often need multiple tokens and apps. OnlyKey set out to address this issue and make two-factor authentication usable by supporting the methods most commonly used by websites. Additionally, by combining this with password management we can provide users with a secure login with the touch of a button. -## What specifically are the differences between the Standard Edition firmware and the International Travel Edition firmware? - -The International Travel Edition firmware was a feature limited version of the OnlyKey: a password manager that did not use encryption, for countries where encryption is banned or restricted. It is retired as of firmware 3.1.0 and there is one firmware edition. More information, including what to do with a device still running it, [here](/ite). - ## What does entering the self destruct PIN do? Depending on what your wipe mode is set to it either wipes all sensitive data (erases your usernames, passwords, keys etc.) or if you are using full wipe mode it does a complete erase of the OnlyKey including sensitive data and all firmware (this requires reloading firmware). From 67c730e070a301f22a95ce85c65729bb5d5f6249 Mon Sep 17 00:00:00 2001 From: T Date: Mon, 7 Sep 2026 22:04:34 -0400 Subject: [PATCH 5/7] Drop remaining quick setup mentions Quick setup no longer exists, so the docs no longer describe it, not even as removed. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_0159zPxi7DCuucC1ZcqYBB8W --- docs/features.md | 2 +- docs/usersguide.md | 6 ------ 2 files changed, 1 insertion(+), 7 deletions(-) diff --git a/docs/features.md b/docs/features.md index b772e23..5596f88 100644 --- a/docs/features.md +++ b/docs/features.md @@ -153,7 +153,7 @@ OnlyKey is the world's first device to allow changing your keyboard layout on th #### Unconfigured OnlyKey {#uninitialized-onlykey} -* An unconfigured OnlyKey does nothing on button presses; set it up with the [OnlyKey App](/usersguide#onlykey-setup). (Firmware before 3.1.0 started the removed keyboard quick setup here.) +* An unconfigured OnlyKey does nothing on button presses; set it up with the [OnlyKey App](/usersguide#onlykey-setup). #### Locked OnlyKey {#locked-onlykey} diff --git a/docs/usersguide.md b/docs/usersguide.md index 47d8efe..4d195f8 100644 --- a/docs/usersguide.md +++ b/docs/usersguide.md @@ -26,12 +26,6 @@ Prefer a how-to video? Watch one [here](https://vimeo.com/967163806) that demons ::: embed https://vimeo.com/967163806 -### OnlyKey Quick Setup {#quick-setup} - -:::callout -Quick setup - holding a button on a new OnlyKey and having it type a setup walkthrough as a keyboard - was removed in firmware 3.1.0. New devices are set up with the [OnlyKey App](#onlykey-setup), which sets all three PINs and the backup passphrase. Devices set up with quick setup on earlier firmware are unaffected. -::: - ### Install OnlyKey Desktop App {#app-desktop} :::callout From 0a703062a5cc740a253ff1e64b7f7ebe9594a4b8 Mon Sep 17 00:00:00 2001 From: T Date: Mon, 7 Sep 2026 22:06:01 -0400 Subject: [PATCH 6/7] Stop advertising the retired Travel Edition guide Remove /ite from the sidebar and the guide index, and trim the features note to plausible deniability only. The ite page stays as a retirement notice for people who reach it by its old URL. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_0159zPxi7DCuucC1ZcqYBB8W --- docmd.config.js | 1 - docs/features.md | 2 +- docs/index.md | 2 -- 3 files changed, 1 insertion(+), 4 deletions(-) diff --git a/docmd.config.js b/docmd.config.js index 9140b6c..3808a47 100644 --- a/docmd.config.js +++ b/docmd.config.js @@ -38,7 +38,6 @@ module.exports = defineConfig({ { title: 'Works with OnlyKey', path: '/workswithonlykey' }, { title: 'Upgrade Guide', path: '/upgradeguide' }, { title: 'Legacy Firmware Upgrade Guide', path: '/legacyupgradeguide' }, - { title: 'International Travel Edition Guide', path: '/ite' }, { title: 'Plausible Deniability Setup Guide', path: '/pdguide' }, { title: 'Windows Active Directory Guide', path: '/activedirectory' }, { title: 'Linux - Using OnlyKey with Linux', path: '/linux' }, diff --git a/docs/features.md b/docs/features.md index 5596f88..22b84de 100644 --- a/docs/features.md +++ b/docs/features.md @@ -72,7 +72,7 @@ In a pinch and want to wipe your OnlyKey? Enter your self-destruct PIN to wipe E * [What does entering the self destruct PIN do?](/faq#what-does-entering-the-self-destruct-pin-do) ### PLAUSIBLE DENIABILITY FEATURE (RETIRED) -The plausible deniability second profile and the International Travel Edition firmware are retired as of firmware 3.1.0. Every profile is encrypted under its PIN; there is one firmware edition. See the [Plausible Deniability Setup Guide](/pdguide) for what changes on devices that already use it. +The plausible deniability second profile is retired as of firmware 3.1.0; every profile is encrypted under its PIN. See the [Plausible Deniability Setup Guide](/pdguide) for what changes on devices that already use it. ### ENCRYPTED BACKUP ANYWHERE OnlyKey types out the encrypted backup so it works anywhere independent of apps. Save the encrypted backup to a file or email it to yourself. diff --git a/docs/index.md b/docs/index.md index 82a3653..7e23403 100644 --- a/docs/index.md +++ b/docs/index.md @@ -80,7 +80,5 @@ The Knowledge Base contains guides and information for using OnlyKey in specific **[Works with OnlyKey](/workswithonlykey)** - A list of applications and things that work with OnlyKey -**[International Travel Edition Guide](/ite)** - Retired as of firmware 3.1.0; the guide explains what to do with a device running it. - **[Plausible Deniability Setup Guide](/pdguide)** - Retired as of firmware 3.1.0; the guide explains how existing plausible deniability profiles are migrated. From cec97678f440b6987f039d7ddd06870fe0fcdff3 Mon Sep 17 00:00:00 2001 From: T Date: Mon, 7 Sep 2026 22:32:21 -0400 Subject: [PATCH 7/7] Drop plausible deniability from the index and trim the retirement page Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_0159zPxi7DCuucC1ZcqYBB8W --- docs/index.md | 2 -- docs/pdguide.md | 2 -- 2 files changed, 4 deletions(-) diff --git a/docs/index.md b/docs/index.md index 7e23403..23a3a79 100644 --- a/docs/index.md +++ b/docs/index.md @@ -80,5 +80,3 @@ The Knowledge Base contains guides and information for using OnlyKey in specific **[Works with OnlyKey](/workswithonlykey)** - A list of applications and things that work with OnlyKey -**[Plausible Deniability Setup Guide](/pdguide)** - Retired as of firmware 3.1.0; the guide explains how existing plausible deniability profiles are migrated. - diff --git a/docs/pdguide.md b/docs/pdguide.md index c78f62e..9224169 100644 --- a/docs/pdguide.md +++ b/docs/pdguide.md @@ -10,8 +10,6 @@ keywords: OnlyKey, International Travel Edition, Plausible Deniability The plausible deniability option for the second profile stored that profile's slots without encryption so that the device could be presented as having only one profile. As of firmware 3.1.0 it can no longer be selected: the second profile type setting is gone from the OnlyKey App setup and from `onlykey-cli` (`2ndprofilemode` has been removed), and the firmware refuses the value if an older app sends it. Both profiles are encrypted under their PINs. -Reasons for retiring it: profile 2's usernames, passwords and URLs were stored in the clear on the device; the "no second profile" story does not hold against an adversary who can image the chip; and every profile-aware feature had to be tested twice. Users who need to travel without secrets on the device should take an [encrypted backup](/usersguide#backup-key-mode), wipe the device with the self-destruct PIN, and restore afterwards. - ## If your OnlyKey already has a plausible deniability second profile When you load firmware 3.1.0 or later, the device converts the profile the first time you unlock **profile 1**: