Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: A secure, open source U2F token you can make with $4.5 worth of parts

github.com

Post reply on HN
Print view View original

71–80 of 94 posts

Re: Show HN: A secure, open source U2F token you can make with $4.5 worth of parts

#71

Post by JshWright »

toomanybeersies wrote: post #65
the_mitsuhiko wrote: post #60

Earlier quoted context omitted.

You should not be using low security keys for home and office in the first place.

Plenty of people rent, and can't easily change the locks or add more locks to the house. Upon saying that, I've added extra locks (bedroom locks) to the past 2 houses I've lived in, and the landlord had no issues, but that's student flats and cheap landlords. That's not to mention that it's a lot easier to just break a window than pick a lock. I have never heard of a burglar breaking into a house by picking the lock.…

> That's not to mention that it's a lot easier to just break a window than pick a lock.

Or in the case of residential interior doors, lean on the door kinda hard...

Re: Show HN: A secure, open source U2F token you can make with $4.5 worth of parts

#73

Post by amluto »

conorpp wrote: post #6
amluto wrote: post #5

This is neat! Is there also source for the firmware that runs on the secure element?

No it is purely a hardware peripheral that just has configuration options. http://www.atmel.com/Images/Atmel-8923S-CryptoAuth-ATECC508A...

Hmm. If the "insecure" processor is compromised, does that mean that it could ask the SE to sign an attestation even for a key that wasn't generated on the SE?

Re: Show HN: A secure, open source U2F token you can make with $4.5 worth of parts

#74

Post by dsl »

fasteo wrote: post #46
devy wrote: post #12

The author, Connor Patrick's personal site has a "looking for work" page[1]. It reads: I want to work on projects that do good. I don’t want to work on projects regarding surveilance or the weaking of existing cryptosystems. Way to go Connor! [1]: https://conorpp.com/work/

>>> I’m currently looking for work in the U.S. government. A crypto work in the goverment not related with surveilance - directly or not- seems difficult to find. Or am I missing something ?

Vast parts of the NSA are full of good people doing good work.

The Information Assurance Directorate is advancing the state of the art in cryptography and is leading the charge in developing quantum-resistant algorithms.

(https://www.iad.gov/iad/library/ia-guidance/ia-solutions-for...)

Re: Show HN: A secure, open source U2F token you can make with $4.5 worth of parts

#75

Post by devy »

speps wrote: post #37
devy wrote: post #12

The author, Connor Patrick's personal site has a "looking for work" page[1]. It reads: I want to work on projects that do good. I don’t want to work on projects regarding surveilance or the weaking of existing cryptosystems. Way to go Connor! [1]: https://conorpp.com/work/

It's "weakening".

Fixed! https://twitter.com/_conorpp/status/745645894368886784

Re: Show HN: A secure, open source U2F token you can make with $4.5 worth of parts

#77

Post by jdietrich »

Loic wrote: post #21

I just hope the keys are not his home/office keys. Please do not secure the access to your digital life with an U2F token and break the security of your real life by putting a picture of your keys in the open...

It makes almost no difference in any practical scenario, because conventional pin-tumbler locks are comprehensively broken. They can be opened instantly by an unskilled person using a $5 bump key.

https://www.youtube.com/watch?v=C5fLgxqWvJQ

Impressioning from a photo only poses a meaningful threat to genuinely high-security lock systems like the Abloy Protec or the ASSA Twin.

Re: Show HN: A secure, open source U2F token you can make with $4.5 worth of parts

#78

Post by jdietrich »

CJKinni wrote: post #8

My barrier to entry with a lot of DIY hardware projects was an incorrect assumption that it was difficult/expensive to get PCBs made. Looking into this, I found the blog of the guy running this project and he had some experience with various cheap PCB vendors, with stencils going as low as $18. [1] [1]: https://conorpp.com/2016/03/13/my-experience-with-dirtypcbsc...

Two-layer boards are now absurdly cheap, even in small quantities. The boards available from DirtyPCBs or Elecrow are perfectly satisfactory for most hobby projects. Four-layer boards with ENIG and fine pitch are now well within the realms of affordability, particularly small boards from OSHPark.

The most economical stencils are avaliable from OSH Stencils. They offer mylar stencils for $0.64/square inch, with a minimum charge of $5. Mylar stencils are perfectly satisfactory for prototyping or even short production runs.

https://www.oshstencils.com/

Re: Show HN: A secure, open source U2F token you can make with $4.5 worth of parts

#79

Post by sowbug »

Two comments on the circuit:

1. If you're willing to add two more diodes, you can make the USB connector two-sided so that it can plug in either way. See http://electronics.stackexchange.com/questions/209941/two-si... for explanation.

2. The ALPS SKQGAKE010 (http://www.mouser.com/search/ProductDetail.aspx?R=0virtualke...) is inexpensive and popular. It looks like it's lower-profile than the button used in the current design, which means it'd be more likely to survive for a long time in a pants pocket, jangling along with a bunch of keys.

Post reply on HN