Live data from Hacker News

Show HN: A secure, open source U2F token you can make with $4.5 worth of parts

github.com

11–20 of 94 posts

Re: Show HN: A secure, open source U2F token you can make with $4.5 worth of parts

#11
post #10

This project is awesome, but I'd be worried about my hand brushing up against all that lead every day for years. Or am I being too paranoid? In any case, easily solved with some casting epoxy.

Feel free to make it with Lead Free solder. See RoHS standards: https://en.wikipedia.org/wiki/Restriction_of_Hazardous_Subst...

Re: Show HN: A secure, open source U2F token you can make with $4.5 worth of parts

#12
The author, Connor Patrick's personal site has a "looking for work" page[1]. It reads:

    I want to work on projects that do good. 
    I don’t want to work on projects regarding surveilance 
    or the weaking of existing cryptosystems.
Way to go Connor!

[1]: https://conorpp.com/work/

Re: Show HN: A secure, open source U2F token you can make with $4.5 worth of parts

#13
Nice! I initially wanted to build a similar device using just an ATtiny85 that speaks USB using USBtiny [1] or V-USB [2]. It would be low-cost but also not secure. Using a crypto processor like the ATECC508A is obviously a saner choice.

[1] http://dicks.home.xs4all.nl/avr/usbtiny/ [2] https://www.obdev.at/products/vusb/index.html

Re: Show HN: A secure, open source U2F token you can make with $4.5 worth of parts

#14
post #10

This project is awesome, but I'd be worried about my hand brushing up against all that lead every day for years. Or am I being too paranoid? In any case, easily solved with some casting epoxy.

There is a 3d-printable case included in the repo!

https://github.com/conorpp/u2f-zero/blob/master/hardware/cas...

Re: Show HN: A secure, open source U2F token you can make with $4.5 worth of parts

#15
post #8

My barrier to entry with a lot of DIY hardware projects was an incorrect assumption that it was difficult/expensive to get PCBs made. Looking into this, I found the blog of the guy running this project and he had some experience with various cheap PCB vendors, with stencils going as low as $18. [1] [1]: https://conorpp.com/2016/03/13/my-experience-with-dirtypcbsc...

In addition to the vendors you mention via that link, OSH Park[1] is great option for hobbyists (or very small-volume production). This is the same source listed in OP. It's a board pooling group that puts many small-run orders on the same panel to economize on setup costs. OSH Park uses high-quality US manufacturers to produce the boards (with tight tolerances, silkscreen, soldermask, gold-flashed pads, etc.) I beli…

This must be awesome for training and university settings, to have such low cost options for learning the craft. Is it used much by startups / is it bringing down the barrier to entry that much?

Re: Show HN: A secure, open source U2F token you can make with $4.5 worth of parts

#16
Is there anything written on why this is a valid choice for improving op-sec versus going with a commercial offering?

Open source made from parts seems like it would be very much under your own control. But it is also... bespoke. Which raises a different threat model, doesn't it?

Re: Show HN: A secure, open source U2F token you can make with $4.5 worth of parts

#17
post #15

Earlier quoted context omitted.

In addition to the vendors you mention via that link, OSH Park[1] is great option for hobbyists (or very small-volume production). This is the same source listed in OP. It's a board pooling group that puts many small-run orders on the same panel to economize on setup costs. OSH Park uses high-quality US manufacturers to produce the boards (with tight tolerances, silkscreen, soldermask, gold-flashed pads, etc.) I beli…

This must be awesome for training and university settings, to have such low cost options for learning the craft. Is it used much by startups / is it bringing down the barrier to entry that much?

Yes. Small startups that don't care too much about turnaround time love OSH Park and Seeed Studio.

My last company did care about turn time but also wanted affordable boards. They used PCB-Pool: http://www.pcb-pool.com/ppus/index.html

Re: Show HN: A secure, open source U2F token you can make with $4.5 worth of parts

#18
post #6
post #5

This is neat! Is there also source for the firmware that runs on the secure element?

No it is purely a hardware peripheral that just has configuration options. http://www.atmel.com/Images/Atmel-8923S-CryptoAuth-ATECC508A...

It still has firmware, of course, which cannot be audited -- which makes it exactly as secure as a $40 Yubikey. Perhaps even a little more secure - because a Yubikey is vulnerable to both Yubico and NXP employees, and U2Fzero is only vulnerable to Atmel. [Both, of course, 3 letter agencies]

Is there a similar chip with Curve25519?

Re: Show HN: A secure, open source U2F token you can make with $4.5 worth of parts

#20
post #6
post #5

This is neat! Is there also source for the firmware that runs on the secure element?

No it is purely a hardware peripheral that just has configuration options. http://www.atmel.com/Images/Atmel-8923S-CryptoAuth-ATECC508A...

What does this do that can't be done with a generic AVR chip? If you set the correct lock flags the memory and firmware can't be read or changed without a complete erase:

http://electronics.stackexchange.com/questions/53282/protect...

Post reply on HN