Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: A secure, open source U2F token you can make with $4.5 worth of parts

github.com

Post reply on HN
Print view View original

51–60 of 94 posts

Re: Show HN: A secure, open source U2F token you can make with $4.5 worth of parts

#51

Post by Monkey0x9 »

fasteo wrote: post #46
devy wrote: post #12

The author, Connor Patrick's personal site has a "looking for work" page[1]. It reads: I want to work on projects that do good. I don’t want to work on projects regarding surveilance or the weaking of existing cryptosystems. Way to go Connor! [1]: https://conorpp.com/work/

>>> I’m currently looking for work in the U.S. government. A crypto work in the goverment not related with surveilance - directly or not- seems difficult to find. Or am I missing something ?

If you scroll down you see: "I’m a Cybercorps student, meaning I’m on a scholarship that obligates me to work for the goverment in security for at least 3 years after I finish school."

Re: Show HN: A secure, open source U2F token you can make with $4.5 worth of parts

#52

Post by legulere »

CJKinni wrote: post #8

My barrier to entry with a lot of DIY hardware projects was an incorrect assumption that it was difficult/expensive to get PCBs made. Looking into this, I found the blog of the guy running this project and he had some experience with various cheap PCB vendors, with stencils going as low as $18. [1] [1]: https://conorpp.com/2016/03/13/my-experience-with-dirtypcbsc...

At least in the fablab in my university you can make PCBs yourself (cheap, you have the result instantaneously). You can also get them done locally (expensive, relatively fast) or in China (cheap, takes long to ship).

Re: Show HN: A secure, open source U2F token you can make with $4.5 worth of parts

#53

Post by pjc50 »

tomohawk wrote: post #32

I really like the idea of using a token like this, but how do you back up the data if the key is not copyable?

You don't back up the key any more than you back up a car key. It's reliant on either the password recovery process, or having a second key prepared.

Re: Show HN: A secure, open source U2F token you can make with $4.5 worth of parts

#54

Post by beagle3 »

tomohawk wrote: post #32

I really like the idea of using a token like this, but how do you back up the data if the key is not copyable?

That's the idea. You don't.

Either you generate the key some other way and write it into the device (but it cannot be read again), and backup the original; or you generate it on the device and do NOT back it up - instead you make a back-up key, and authorize both keys rather than just one.

I don't know if this supports external key. YubiKey does.

Re: Show HN: A secure, open source U2F token you can make with $4.5 worth of parts

#55

Post by pjc50 »

zaroth wrote: post #16

Is there anything written on why this is a valid choice for improving op-sec versus going with a commercial offering? Open source made from parts seems like it would be very much under your own control. But it is also... bespoke . Which raises a different threat model, doesn't it?

Bespoke solutions generally require bespoke attacks. If you're targeted as an individual by a state-level bespoke attack, you're going to lose regardless.

U2F defends you effectively against phishing and keyloggers, which are a widespread problem.

Re: Show HN: A secure, open source U2F token you can make with $4.5 worth of parts

#56

Post by conorpp »

zxcvgm wrote: post #13

Nice! I initially wanted to build a similar device using just an ATtiny85 that speaks USB using USBtiny [1] or V-USB [2]. It would be low-cost but also not secure. Using a crypto processor like the ATECC508A is obviously a saner choice. [1] http://dicks.home.xs4all.nl/avr/usbtiny/ [2] https://www.obdev.at/products/vusb/index.html

As the ATECC508A is just an I2C peripheral you still have a broad choice for microcontrollers (as you still need a U2F program and U2F).

I choose to use a EFMUB1 from silicon labs.

Re: Show HN: A secure, open source U2F token you can make with $4.5 worth of parts

#57

Post by conorpp »

vog wrote: post #24

I'm curious about the following statement in the README: > The token is durable enough to survive on a key chain for years, even after going through the wash. On the other hand, the token is shown as "naked electronics", without a husk. Is that really sufficient for such a device? Does it really withstand (mineral) water, mechanical stress (key chain), let alone the combination of both (washing)?

It's a good question. It's definitely not been through years of testing yet but in the past few months me and some friends have had no problems.

All of the parts have a low center of mass with respect to the PCB and are unlikely to catch on anything. Water and/or sweat won't hurt it as long as it's dry when you use it. I've tested it works fine after putting it through a washer and dryer.

However, making your own casing or 3D printing something like this [1] is always best

[1]: https://github.com/conorpp/u2f-zero/blob/master/hardware/cas...

Re: Show HN: A secure, open source U2F token you can make with $4.5 worth of parts

#58

Post by vollmond »

fasteo wrote: post #46
devy wrote: post #12

The author, Connor Patrick's personal site has a "looking for work" page[1]. It reads: I want to work on projects that do good. I don’t want to work on projects regarding surveilance or the weaking of existing cryptosystems. Way to go Connor! [1]: https://conorpp.com/work/

>>> I’m currently looking for work in the U.S. government. A crypto work in the goverment not related with surveilance - directly or not- seems difficult to find. Or am I missing something ?

I'm certain there are lots of defensive security positions available. The government has lots of departments that work to strengthen at least their own security, not just surveillance/attack organizations.

Re: Show HN: A secure, open source U2F token you can make with $4.5 worth of parts

#59

Post by conorpp »

Loic wrote: post #21

I just hope the keys are not his home/office keys. Please do not secure the access to your digital life with an U2F token and break the security of your real life by putting a picture of your keys in the open...

The keys used for the picture are not used. But yes it is not a good practice to post pictures of door keys.

Re: Show HN: A secure, open source U2F token you can make with $4.5 worth of parts

#60

Post by the_mitsuhiko »

Loic wrote: post #21

I just hope the keys are not his home/office keys. Please do not secure the access to your digital life with an U2F token and break the security of your real life by putting a picture of your keys in the open...

You should not be using low security keys for home and office in the first place.
Post reply on HN