Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefly – An open-source $5 DIY hardware wallet

firefly.city

Post reply on HN
Print view View original

21–30 of 39 posts

Re: Firefly – An open-source $5 DIY hardware wallet

#21

Post by grizzles »

azurelogic wrote: post #10
ohazi wrote: post #3

Can you really call it an air-gap if you're using a BLE radio? I mean, yes, technically the information is transferred over the air rather than through a wire, but you wouldn't call a cell-phone an air-gapped device because it has half a zillion radios inside, many of which you can't even reliably turn off. Looking at the recent Broadcom wifi vulnerability -- just having a phone sitting there with the radio on is eno…

A more "air gap"-ish concept would have been a camera on the Firefly. Take a pic of a QR code on the phone, sign on the device, use the phone to take a pic of the output QR.

Another option would be to use a microphone and do an audiocap.

Re: Firefly – An open-source $5 DIY hardware wallet

#22

Post by icebraining »

azurelogic wrote: post #10
ohazi wrote: post #3

Can you really call it an air-gap if you're using a BLE radio? I mean, yes, technically the information is transferred over the air rather than through a wire, but you wouldn't call a cell-phone an air-gapped device because it has half a zillion radios inside, many of which you can't even reliably turn off. Looking at the recent Broadcom wifi vulnerability -- just having a phone sitting there with the radio on is eno…

A more "air gap"-ish concept would have been a camera on the Firefly. Take a pic of a QR code on the phone, sign on the device, use the phone to take a pic of the output QR.

I'm sure an image could be generated that would crash the QR code recognizer.

Re: Firefly – An open-source $5 DIY hardware wallet

#24

Post by DiThi »

pgl wrote: post #23

Forgive my ignorance, but could someone explain what a "hardware wallet" is?

A hardware wallet is a device to store cryptocurrency. When you have bitcoins or ether or whatever, you're 100% responsible of its safety, lose the keys, lose the coins. Just like cash or gold, and unlike PayPal or banks (where they owe you the quantity of your balance).

The problem is that holding keys in a PC or a phone is very risky: malware, security holes, etc. A hardware wallet allows very little communication between the key holder and the wallet usage, so the attack surface is several orders of magnitude smaller. You can even use it in a virus-ridden Windows XP machine.

edit: Another problem with crypto coin keys is that they can steal them and you won't notice until they spend the coins. Just like what happened with MtGox: they assumed there was no theft because the thiefs didn't transfer the coins immediately. With a hardware wallet you can be sure nobody else is holding your keys (but it doesn't hurt to transfer them from time to time to a new wallet, which means the coins get new keys).

Re: Firefly – An open-source $5 DIY hardware wallet

#25

Post by pgl »

DiThi wrote: post #24
pgl wrote: post #23

Forgive my ignorance, but could someone explain what a "hardware wallet" is?

A hardware wallet is a device to store cryptocurrency. When you have bitcoins or ether or whatever, you're 100% responsible of its safety, lose the keys, lose the coins. Just like cash or gold, and unlike PayPal or banks (where they owe you the quantity of your balance). The problem is that holding keys in a PC or a phone is very risky: malware, security holes, etc. A hardware wallet allows very little communication…

Thanks for the detailed explanation.

Re: Firefly – An open-source $5 DIY hardware wallet

#26

Post by ge96 »

ohazi wrote: post #3

Can you really call it an air-gap if you're using a BLE radio? I mean, yes, technically the information is transferred over the air rather than through a wire, but you wouldn't call a cell-phone an air-gapped device because it has half a zillion radios inside, many of which you can't even reliably turn off. Looking at the recent Broadcom wifi vulnerability -- just having a phone sitting there with the radio on is eno…

faraday cage?

Re: Firefly – An open-source $5 DIY hardware wallet

#28

Post by jacobush »

icebraining wrote: post #22
azurelogic wrote: post #10

Earlier quoted context omitted.

A more "air gap"-ish concept would have been a camera on the Firefly. Take a pic of a QR code on the phone, sign on the device, use the phone to take a pic of the output QR.

I'm sure an image could be generated that would crash the QR code recognizer.

Sure? A possibility, but sure?

Re: Firefly – An open-source $5 DIY hardware wallet

#30

Post by azurelogic »

icebraining wrote: post #22
azurelogic wrote: post #10

Earlier quoted context omitted.

A more "air gap"-ish concept would have been a camera on the Firefly. Take a pic of a QR code on the phone, sign on the device, use the phone to take a pic of the output QR.

I'm sure an image could be generated that would crash the QR code recognizer.

I'm just critiquing the air gap design/claim. Getting a malicious QR code in front of the camera would either require the attacker to gain physical access to the device, at which point it is game over for any device, or they would have to compromise the app presenting the first QR code. This would be a problem regardless of the air gap design for something like this, even if you had to enter the data by hand into the device.
Post reply on HN