Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Kryptonite – a new home for your SSH private key

krypt.co

Post reply on HN
Print view View original

201–210 of 227 posts

Re: Show HN: Kryptonite – a new home for your SSH private key

#201

Post by pfg »

Sir_Cmpwn wrote: post #195
pfg wrote: post #192

Earlier quoted context omitted.

I don't think this is accurate for modern Android or iOS devices. AIUI basebands are connected via HSIC (a chip-to-chip variant of USB) nowadays, which doesn't give the baseband DMA.

HSIC (and USB in general) is a very complicated stack. Host-controlled DMA is probably in use, which is fragile at best. Historicically evil has definitely been possible with USB, and we all know how good phones are about getting updates.

I'm not sure if "Evil/BadUSB"-style vulnerabilities really apply to HSIC, where the code would know what kind of device to expect. It's possible there are ways to make this work - I'm not aware of any past vulnerabilities of this nature, but I'm not familiar enough with this topic to really make an educated guess. Either way, it doesn't seem like a matter of "just find a zero-day in the baseband and you get DMA", it's more along the lines of a vulnerability in, say, Safari, which then needs all kinds of sandbox escapes and privilege escalations to be useful for an attacker, and it still does nothing to get past Secure Enclave (and possibly Android's variant of that).

Re: Show HN: Kryptonite – a new home for your SSH private key

#202

Post by tptacek »

dv_dt wrote: post #197
tptacek wrote: post #90

Earlier quoted context omitted.

On modern phones --- for the last $many years --- the baseband processors are connected to the AP via things like HSIC, not DMA. Don't ever get your security news from Boing Boing.

That Boing Boing article did reference actual CVEs. Though I like him as an author, Doctrow's writing style in articles rub me the wrong way too. I'm not privy to HSIC details for phones, but most high-speed chip interconnects I've seen are a proprietary, vendor unique solutions with little global commonality, and some of them do feature direct memory access too. So, though I'm speaking with a fair amount unknown on…

HSIC is USB. It's an industry standard.

In modern flagship phone designs, the baseband is an adversarial component. It isn't trusted with access to AP memory. It's accessed like a peripheral.

Nobody doubts that there are vulnerabilities in baseband processors. There certainly are. What I object to is the accompanying story that an exploit in the baseband gives you unfettered access to memory on the phone. I don't know how far back you have to go for that to be the truth, but it isn't true today for flagship phones.

Nobody should minimize the importance of baseband flaws. They're very bad for the security of the phone in its cellular phone capacity. But there's a reason why an Apple phone has separate silicon for the Secure Enclave and for the encrypted memory bus it uses to access memory: it's because the components of the phone don't trust each other. Should you trust GSM? Fuck no. Are your SSH keys more secure on an iPhone than they would be on your laptop? Fuck yes.

If you must use Android, don't use random Android phones. Stick to Google's phones.

Re: Show HN: Kryptonite – a new home for your SSH private key

#203

Post by edutechnion »

spilk wrote: post #93
tptacek wrote: post #66

Earlier quoted context omitted.

The agent process is tricky to set up and persnickety, especially if you use the token for anything else besides SSH. At one point, before I tableflipped and switched back to software keys, I had to switch agent processes any time I used my Y4 to sign into a VPN. The theater is that you're protecting a key but not the account the key protects . Yes, you'll never lose the actual RSA key bits to an attacker. But that'l…

I switched my SSH keys on my Yubikey from using the OpenPGP applet and all the funkiness of gpg-agent over to using X.509 certificates with the PIV applet. Added bonus is that not only does it work with SSH, but you can use those certificates for TLS mutual authentication in web browsers. Works out of the box on Mac/Windows.

Can you provide a link or reference to this path? I can't find much with basic searches and have given up several times on the gpg-connect-agent path while using Windows or Ubuntu. The path on Mac seems okay but on other platforms is way too difficult.

Re: Show HN: Kryptonite – a new home for your SSH private key

#204

Post by jancsika »

tptacek wrote: post #171
jancsika wrote: post #159

Earlier quoted context omitted.

So if I buy such a phone, what is the relationship between the baseband chip/OS and all the bullet points you listed above? https://www.fsf.org/blogs/community/replicant-developers-fin... It's a real pain, but I can buy a laptop/desktop that doesn't have Intel ME (or its AMD equivalent) running on it. But there's no such thing as a working phone without a baseband OS. And AFAICT there isn't a single available baseban…

Use a Google or Apple phone and stop worrying about their basebands, which are effectively USB peripherals.

> While working on Replicant, a fully free/libre version of Android, we discovered that the proprietary program running on the applications processor in charge of handling the communication protocol with the modem actually implements a backdoor that lets the modem perform remote file I/O operations on the file system.

Are there cases where a similar situation has been described with a USB 1.1 audio device using an open source driver? Or any other class of USB device used by tens of millions of people?

Re: Show HN: Kryptonite – a new home for your SSH private key

#205

Post by tptacek »

jancsika wrote: post #204
tptacek wrote: post #171

Earlier quoted context omitted.

Use a Google or Apple phone and stop worrying about their basebands, which are effectively USB peripherals.

> While working on Replicant, a fully free/libre version of Android, we discovered that the proprietary program running on the applications processor in charge of handling the communication protocol with the modem actually implements a backdoor that lets the modem perform remote file I/O operations on the file system. Are there cases where a similar situation has been described with a USB 1.1 audio device using an op…

You have to be very specific about what Android phones you're talking about, and I'm the wrong person to debate Android security with. I have friends who work on Android platform security and I am very hesitant to cast aspersions on the Android security effort as a whole. But my advice for people who really care about security is: get an iPhone.

Re: Show HN: Kryptonite – a new home for your SSH private key

#206

Post by Sir_Cmpwn »

tptacek wrote: post #200
Sir_Cmpwn wrote: post #195

Earlier quoted context omitted.

HSIC (and USB in general) is a very complicated stack. Host-controlled DMA is probably in use, which is fragile at best. Historicically evil has definitely been possible with USB, and we all know how good phones are about getting updates.

Wait, so you were talking about the baseband chips? Both Google and Apple design against the baseband chips as adversarial components. Before we play the "but HSIC is complicated and there's DMA in it", we're talking about security teams that have designed and implemented encrypted memory busses; I think they can handle bog-standard interconnects. I can't speak to random Xiaomi phones, but the baseband security risk…

I trust Google, but I don't trust vendors. I expect vendors to make compromises left and right to deal with shitty hardware (oh, the radio doesn't work with this security feature enabled? Meh, we don't need it).

However, I'll admit that you seem more knowledgable than me on the subject, so I won't spout FUD if you say so.

Re: Show HN: Kryptonite – a new home for your SSH private key

#207

Post by tptacek »

Sir_Cmpwn wrote: post #206
tptacek wrote: post #200

Earlier quoted context omitted.

Wait, so you were talking about the baseband chips? Both Google and Apple design against the baseband chips as adversarial components. Before we play the "but HSIC is complicated and there's DMA in it", we're talking about security teams that have designed and implemented encrypted memory busses; I think they can handle bog-standard interconnects. I can't speak to random Xiaomi phones, but the baseband security risk…

I trust Google, but I don't trust vendors. I expect vendors to make compromises left and right to deal with shitty hardware (oh, the radio doesn't work with this security feature enabled? Meh, we don't need it). However, I'll admit that you seem more knowledgable than me on the subject, so I won't spout FUD if you say so.

This is a valid concern for off-brand Android phones. Google's Android security team is on top of this stuff with their hardware vendors. Nobody in the industry does hardware security better right now than Apple. In neither case is the Boing Boing narrative of "bug on the baseband means you own the whole phone" true. I'm sure there's an Android phone on the market where it is true, but there are a lot of crappy Android phones.

For those of you playing along at home, it's this "there are a lot of crappy Android phones" thing that dominates our concerns about Android, and is the reason we recommend to laypeople (lawyers, reporters, NGOs) to get iPhones and avoid Android phones.

Re: Show HN: Kryptonite – a new home for your SSH private key

#208

Post by tptacek »

0xCMP wrote: post #185
ithkuil wrote: post #155

Earlier quoted context omitted.

My read is that tptachek claims that not all android phones are insecure. You should avoid those android phones whose vendors don't do serious security updates. Among the vendors that are well known to care about updating their phones there is Google. So, he seems to say that an android phone branded directly by Google (e.g. Nexuses, pixels) is a valid alternative to iPhones as far as this topic is concerned.

He did not say that, but it's natural to assume that. All android phones run android (naturally) so if for whatever reason you believe iOS to be more secure and you also know most android phones do not receive updates correctly then it's probably easier to avoid all android phones than try to accurately predict the development roadmaps for companies other than Google's flagship phones. Personally, I think Android its…

I am in fact implying that there are some Android phones that experts might be able to configure to a point of security comparable to iOS.

Re: Show HN: Kryptonite – a new home for your SSH private key

#209

Post by j_s »

xaduha wrote: post #190
j_s wrote: post #173

Earlier quoted context omitted.

Is it possible to use a chip/EMV credit card as an X.509 certificate? Let the credit card company know your private key (paranoid assumption; not necessarily true) & skip straight to step 3!

Look, I'm not an expert, I just dabble a bit. In theory there's no need for anyone to know your private key, it is generated on the card and kept there, unextractable. As I understand it there's nothing stopping credit card companies from allowing you generate your own keys on it (on a technical side that is), it just wasn't done AFAIK.

I have a smart card so I have the reader, but when I put in my credit card it doesn't even appear as though it can read it. I would love to use my "always-with-me" credit card for home PC sign-on and whatever else but there's nothing out there on the integration. Any pointers would be appreciated!

Re: Show HN: Kryptonite – a new home for your SSH private key

#210

Post by peterwwillis »

tptacek wrote: post #172
peterwwillis wrote: post #144

Earlier quoted context omitted.

Was that satire? Security Problems: Android-specific -- Android 5 was supposed to make encryption mandatory, but it killed performance, so they rolled that back. Android 6 was supposed to do it again, but if your phone isn't fast enough, or you are upgrading, again it isn't mandatory. My Android 6 phone didn't use encryption until I enabled a pin and biometrics. -- Many of the old versions of Android that will never…

I didn't bother reading the Android list. If you're concerned about Android security, as I am, don't use Android phones. Your iPhone list has virtually nothing to do with the difference in security between phones and computers. It's just a bunch of things you don't like about phones. What on earth does A5/1 have to do with any of these issues? Cracking A5/1 keys doesn't break your IP sessions.

There are more ways to exploit a phone than a computer, and you can't control how it works. A computer you can pretty much completely control. Moreover, it is easier to surreptitiously own a phone. It's this false sense of security that's dangerous.

If you break the encryption you can intercept 2fa at the least. Any time encryption is broken security assumptions have to be re-evaluated. Your HTTPS session might be secure but that doesn't mean there aren't new holes somewhere else in the stack.

Post reply on HN