Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why I don't like smartcards, HSMs, YubiKeys, etc.

devever.net

Post reply on HN
Print view View original

121–130 of 139 posts

Re: Why I don't like smartcards, HSMs, YubiKeys, etc.

#121

Post by saganus »

lisper wrote: post #111
saganus wrote: post #91

Earlier quoted context omitted.

I'm interested in buying a couple of these. Howver I'm wondering if there's a way I can also use it as a TOTP to replace my Google Authenticator app for several accounts? I don't really like having it in the phone because when I lose it I need to reset everything and it's a pain. Is it possible with SC4 to achieve this functionality?

Also... why do you want TOTP rather than U2F? U2F is better in every way (unless you don't have access to a USB port).

Well, mostly because of those services that only implement TOTP, in particular those that I can use with my Google Authenticator App.

My use case is this. I have several business accounts (Heroku, Cloudinary, etc) that I like to enable 2FA on but which only support TOTP. I usually add those accounts to my Google Authenticator App and all is fine.

Except when I lose/wipe my phone, which happened recently. Then I have to go around resetting the 2FA setting, then re-enabling it with the new phone.

After a quick search, I found almost no solutions that fit this. Except something like [0]. I would love to buy let's say, 2 of those for each account I want to enable 2FA on, I keep one in the safe and the other one for regular use.

So then I remembered about SC4 and thought that if I can do TOTP on it, I can just buy 2 and put all my seeds there (or so I was thinking) and use that instead of the phone.

That was my reasoning. Maybe I'm doing something wrong here, but I would love to be able to de-couple 2FA from my phone for my business accounts... I guess it's not a common use case?

[0] https://www.protectimus.com/protectimus-slim-mini

Re: Why I don't like smartcards, HSMs, YubiKeys, etc.

#122

Post by pharaohgeek »

sofaofthedamned wrote: post #34

HSMs are shit. In a previous role we used a major vendor's HSM to protect our private keys. VERY expensive kit, more expensive than the load balancers and servers combined. We needed to use Elliptic Curve keys for a particular customer - so it got even more expensive as we had to buy: 1. A license from the LB vendor to use the HSM 2. A licence from the HSM vendor to use EC with the LB. ... even though they trumpeted…

They're not (necessarily) shit. They're just appropriate for a VERY specific purpose. A lot of companies that use them aren't using them right, or are using them in a scenario in which they are overkill. My company (medium-sized financial firm) uses them to protect the keys for our internal PKI. For these types of high-security situations, an HSM is ideal (if configured and managed properly). But I've seen places that use them to protect the SSL keys for webservers. While capable of doing that, an HSM is really overkill for that purpose. And, often results in them being mismanaged in the long run because the wrong teams end up responsible for them.

That, and it's very important to choose the right vendor. I've worked with pretty much all of them over the years, and some of them can be a nightmare to deal with. Some of the devices themselves are INCREDIBLY frustrating and should never have seen the light of day (much like some of their sales staff!)

Re: Why I don't like smartcards, HSMs, YubiKeys, etc.

#123

Post by saganus »

lisper wrote: post #117
pekk wrote: post #114

Earlier quoted context omitted.

Many more services implement TOTP and not U2F, so this would tend to be seen as a useful thing for end users even if the technology is unattractive.

Actually, I just thought of a way you could make this work with a terminal command instead of a driver. You'd have to type something like: date > /dev/cu.usbmodem* and the OTP would appear on the HSM display. Would that work for you?

Yeah, I guess that could work since I usually don't log in to my business accounts from anywhere else but my own computer, so even if it needs a bit of configuration it's not that bad.

Just an idea, is there any USB device class that could be used to get the date and time? such that if you configure the SC4 to work with TOTP, when you plug it in a USB driver is installed that allows it to query the date and time?

Re: Why I don't like smartcards, HSMs, YubiKeys, etc.

#124

Post by mentat »

xyzzy123 wrote: post #68
mentat wrote: post #59

Earlier quoted context omitted.

This exactly. You use a HSM so it doesn't matter if your server gets popped.

I think one should be really careful making statements like this. In the case where an HSM is used for e.g. database encryption, one absolutely still cares. The attacker can politely ask the HSM to decrypt all the data. On the bright side, you didn't lose the key, and your HSM should at least securely log the fact that all your data just walked out the door. For SSL offload the situation is less dire, but it is total…

As far as I understand heartbleed, the core issue was that you could search memory for the private key and then do whatever you wanted with it. With an HSM, that wouldn't be an issue. However, it's true that you could search for other data as well and that data could be sensitive, just not quite as sensitive (depending on your industry and architecture, of course).

Re: Why I don't like smartcards, HSMs, YubiKeys, etc.

#125

Post by sofaofthedamned »

tristor wrote: post #61
sofaofthedamned wrote: post #34

HSMs are shit. In a previous role we used a major vendor's HSM to protect our private keys. VERY expensive kit, more expensive than the load balancers and servers combined. We needed to use Elliptic Curve keys for a particular customer - so it got even more expensive as we had to buy: 1. A license from the LB vendor to use the HSM 2. A licence from the HSM vendor to use EC with the LB. ... even though they trumpeted…

Don't forget broken HA features. HSMs are a great idea in theory that are ruined by incompetent companies making them. They soon become a gun your org holds to its own head with the outcome of a data loss incident or a hack because of their janky OpenSSL integrations.

That was exactly my problem. Also, the consultant they sent to help us with it didn't know anything about Linux when they knew that was our platform.

I'd love to get hold of one of my old units from that vendor and try to attack it. I assume it hasn't been done as they're so expensive. It's basically the ultimate in security through obscurity, as it's too expensive to get one you're prepared to break.

Re: Why I don't like smartcards, HSMs, YubiKeys, etc.

#126

Post by lisper »

saganus wrote: post #123
lisper wrote: post #117

Earlier quoted context omitted.

Actually, I just thought of a way you could make this work with a terminal command instead of a driver. You'd have to type something like: date > /dev/cu.usbmodem* and the OTP would appear on the HSM display. Would that work for you?

Yeah, I guess that could work since I usually don't log in to my business accounts from anywhere else but my own computer, so even if it needs a bit of configuration it's not that bad. Just an idea, is there any USB device class that could be used to get the date and time? such that if you configure the SC4 to work with TOTP, when you plug it in a USB driver is installed that allows it to query the date and time?

> is there any USB device class that could be used to get the date and time?

Not that I know of. But it's a good idea if it turns out that such a class does exist. If you find one please let me know!

Re: Why I don't like smartcards, HSMs, YubiKeys, etc.

#127

Post by lisper »

saganus wrote: post #121
lisper wrote: post #111

Earlier quoted context omitted.

Also... why do you want TOTP rather than U2F? U2F is better in every way (unless you don't have access to a USB port).

Well, mostly because of those services that only implement TOTP, in particular those that I can use with my Google Authenticator App. My use case is this. I have several business accounts (Heroku, Cloudinary, etc) that I like to enable 2FA on but which only support TOTP. I usually add those accounts to my Google Authenticator App and all is fine. Except when I lose/wipe my phone, which happened recently. Then I have…

I see. Yes, you are right that one SC4-HSM can store multiple keys. The only missing piece is the time. The simplest solution is to feed the time into the HSM from some external source, like a custom driver or a command line. Would that work for you?

Adding a RTC to the hardware is probably not viable. It would increase the cost too much. (If I were selling millions of units that would be different, but that hasn't happened yet.)

Another possible solution is to lobby the sites you care about to implement U2F. It's not particularly difficult. I wrote some minimalist reference code that you/they can find here:

https://github.com/rongarret/u2f-test/

And of course you can always point them in my direction if they want to hire a consultant :-)

Re: Why I don't like smartcards, HSMs, YubiKeys, etc.

#128

Post by lisper »

kosma wrote: post #93
lisper wrote: post #85

Earlier quoted context omitted.

What would you need?

A ChipWhisperer and some boring winter weekends, probably. I don't break these for cash or fame; it's just for fun.

> A ChipWhisperer

OK, you've got it. Where should I have it sent?

Re: Why I don't like smartcards, HSMs, YubiKeys, etc.

#129

Post by tluyben2 »

sofaofthedamned wrote: post #125
tristor wrote: post #61

Earlier quoted context omitted.

Don't forget broken HA features. HSMs are a great idea in theory that are ruined by incompetent companies making them. They soon become a gun your org holds to its own head with the outcome of a data loss incident or a hack because of their janky OpenSSL integrations.

That was exactly my problem. Also, the consultant they sent to help us with it didn't know anything about Linux when they knew that was our platform. I'd love to get hold of one of my old units from that vendor and try to attack it. I assume it hasn't been done as they're so expensive. It's basically the ultimate in security through obscurity, as it's too expensive to get one you're prepared to break.

We have a bunch of HSMs and we had to sign a quazillion pages which at least deny us and anyone we hire or ask from trying to temper with the machines. Also most of them you cannot buy; they remain owned by the vendor.

Re: Why I don't like smartcards, HSMs, YubiKeys, etc.

#130

Post by tluyben2 »

pharaohgeek wrote: post #122
sofaofthedamned wrote: post #34

HSMs are shit. In a previous role we used a major vendor's HSM to protect our private keys. VERY expensive kit, more expensive than the load balancers and servers combined. We needed to use Elliptic Curve keys for a particular customer - so it got even more expensive as we had to buy: 1. A license from the LB vendor to use the HSM 2. A licence from the HSM vendor to use EC with the LB. ... even though they trumpeted…

They're not (necessarily) shit. They're just appropriate for a VERY specific purpose. A lot of companies that use them aren't using them right, or are using them in a scenario in which they are overkill. My company (medium-sized financial firm) uses them to protect the keys for our internal PKI. For these types of high-security situations, an HSM is ideal (if configured and managed properly). But I've seen places tha…

So how about doing a blogpost/pastebin with vendors, products and your experience?
Post reply on HN