Live data from Hacker News

Show HN: PunchCard Key Backup

github.com

21–30 of 51 posts

Re: Show HN: PunchCard Key Backup

#21
post #2

It's so stupid, I love it. I wouldn't personally use this format but maybe rather just... Print the text on the slate.

Provided that the information one wants to keep safe is sensitive and important long term, there are two main issues with printing (either text, QRCode, or anything): * (paranoia) can you trust your printer not to leak the secret? (either in local memory, or to send it to its cloud mother-ship?) you can encrypt your information and print that, but then you are back to square one: where do you backup the password; * a…

Or drill more holes.

Re: Show HN: PunchCard Key Backup

#22
post #2

It's so stupid, I love it. I wouldn't personally use this format but maybe rather just... Print the text on the slate.

Provided that the information one wants to keep safe is sensitive and important long term, there are two main issues with printing (either text, QRCode, or anything): * (paranoia) can you trust your printer not to leak the secret? (either in local memory, or to send it to its cloud mother-ship?) you can encrypt your information and print that, but then you are back to square one: where do you backup the password; * a…

For point 1 I recall the creator of Age, Filippo Valsorda suggesting something similar:

>The .age-recipients files also include the public key for an offline disaster recovery key. I generated the key with age-keygen, encrypted it with age -p, printed the ciphertext as a QR code, and wrote the random passphrase in pen. This is a bit convoluted, but I don’t trust printers. All this was done in a tmpfs, so nothing reached storage. Only had to do this once, and have been using that key as the anchor for all my disaster recovery data. https://words.filippo.io/dispatches/passage/

Re: Show HN: PunchCard Key Backup

#23
post #17

Cool but wouldn’t you forget how to decode it after some time? I.e. wouldn’t engraving regular characters be simpler?

> Cool but wouldn’t you forget how to decode it after some time?

Not necessarily.

First of all there isn't much decoding to be done: if one follows the recommendation, and one uses the hex input variant as the password (or secret), then decoding is as simple as just writing the number is binary base. For example this password `d74ae47dc6f599d3f9cb847bd77d6b7c` can be recovered by simply starting a Python interpreter and writing `"%032x" % b1101011101001010...`

Moreover, by just providing the card to a computer science graduate / enthusiast, his first hunch would be to just try to convert the bits into a number and use that (either base10 or base16), perhaps after rotating / flipping the card (if he didn't knew about the alignment). (This can easily be deduced because there are 2 groups of 8x8 bits.)

(Alternatively, if one scratches on the card the URL `purl.org/999/1`, provided Archive.org, which currently hosts PURL.org, doesn't delete the links like Google just did with `goo.gl`. I intend to update the redirect from this PURL to a page hosted by Archive.org.)

> I.e. wouldn’t engraving regular characters be simpler?

The first, and perhaps greatest issue, is that not many people have access to engraving hardware. One could go to a shop and have the characters engraved, but then they wouldn't be secret.

So, the main purpose is this: how could one with minimal access to power or precision tools, create the sturdiest physical backup of a small piece of information.

Thus this proposal: with a sheet of metal, a nail, and a hammer, one could just encode the 128 bits by banging with the hammer on the nail through the sheet of metal. :)

Re: Show HN: PunchCard Key Backup

#24
post #17

Cool but wouldn’t you forget how to decode it after some time? I.e. wouldn’t engraving regular characters be simpler?

You could laser etch redundant instructions on the back of the card. Sure, a few particular pieces of information might be punched out, but should be enough guide posts to reconstruct the encoding.

Re: Show HN: PunchCard Key Backup

#26
I like the survivability, and the constraint to be doable with common hand tools.

For more information density, and easier readability by a less-technical person who inherits it -- at the cost of requiring special tools -- I wonder about using number&letter stamps with a hammer.

Or, if you permit very special tools, laser-cut alphanumerics (base16, base58, or base64, for arbitrary bits; or alphabetic passphrases). Either engraved, or cut fully through, like an old drafting lettering stencil.

Re: Show HN: PunchCard Key Backup

#27
Make sure it's stored in an electrochemically inoffensive environment, including considerations like dissimilar-metal contact, etc. Aluminium is a good choice here especially for being both easily worked and self-passivating in air, but it has some more obscure vulnerabilities which can have impact over decades.

Re: Show HN: PunchCard Key Backup

#29

Wouldn't printing a QR code be way easier? If it's just for retro fun / Rube Goldberginess than nevermind, carry on :)

It needs a new kind of punch that can't easily be photographed and it needs to be waterproof. Magnets seem good. Could make them disc shaped.... wait...

Re: Show HN: PunchCard Key Backup

#30
post #13

I love this so much. This, this right here is why I still visit Hacker News. I'm going to use this today and pave a path to my CNC router to make it stupidly easy to generate these plates on-demand.

Thus defeating the entire purpose! Unless you plan to wipe your router's firmware after every one.

The CNC router's firmware? The CNC controller itself is dumb as hell. It's connected via serial to an old offline computer that's only job is to pipe G-code over RS-232. Not even to "load a program" to hold in memory on the controller. Literally to stream the commands to the machine.
Post reply on HN