Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tomu, a tiny ARM microprocessor which fits in your USB port

tomu.im

Post reply on HN
Print view View original

31–40 of 91 posts

Re: Tomu, a tiny ARM microprocessor which fits in your USB port

#31

Post by 0culus »

askvictor wrote: post #25

Hold on - doesn't having this live permanently in the USB port reduce the security possible with a 2FA device? If the user has to get the key from their pocket and plug it in, it will at least prevent an attacker from accessing the user's account in a remote-desktop scenario. Certainly the requirement to press the button will mitigate this risk to a degree, but might there be exploits that can trigger this button-pre…

I think the YubiKey nano is intended to be left in a port. I don't leave mine in though (keep it on my keyring!)

Re: Tomu, a tiny ARM microprocessor which fits in your USB port

#32

Post by bArray »

craftyguy wrote: post #22
bArray wrote: post #19

I can recommend the DigiSpark as a cheaper, slower, alternative that works with the Arduino IDE [1]. Somebody could easily get it into a smaller form factor. I've bought some of the official versions in their KickStarter and whenever I buy through some company/research funding - but can also recommend the cheaper Chinese implementations to be just as good for projects. [1] http://digistump.com/products/1

That doesn't fit entirely within the USB port like the Tomu, and it's out of stock (with no eta).

>That doesn't fit entirely within the USB port like the Tomu,

No, but it would be possible to get something more low profile with some work. For most projects I would imagine it's low profile "enough".

For a practical joke (because I'm cool/evil), I plugged one of these devices into the back of somebodies desktop PC and it would occasionally output a random character (either G, H, J or K). I thought the same would be amusing for mouse control too.

You can get it to ultra-low power states too if you replace the power drop down (which consumes about 10mA from memory) and build a low power monitoring device.

>and it's out of stock (with no eta).

That's a shame. Erik is currently working on a 3D printer, it's likely this takes up most of his time now [1].

The clones are readily available though [2].

[1] https://www.kickstarter.com/projects/robotic-industries/buil...

[2] https://www.banggood.com/search/digispark.html?sbc=1

Re: Tomu, a tiny ARM microprocessor which fits in your USB port

#33

Post by gonzo »

askvictor wrote: post #10
dtornabene wrote: post #3

Earlier quoted context omitted.

thats ultimately the intent, to build a Yubikey-like security key, with everything open down through the firmare to the details of the soc

One key (pardon the pun) requirement of a 2FA key is that it can't be cloned - how would this be prevented? Can the microprocessor be locked to prevent reading its flash memory?

ATECC608A

Re: Tomu, a tiny ARM microprocessor which fits in your USB port

#34

Post by MrMorden »

ggm wrote: post #6
jacob019 wrote: post #5

also great for espionage

well.. I'd probably disable the flashing LEDs. But, that aside, I too thought "oh cool... a complete ARM system in my USB.. what could possibly go wrong here" But, the other side of this is: this is precisely what every closed-box USB device I plug into my USB potentially IS. This is just the overt "hi I'm an awesome tiny computer" state we're actually living in, all the time TL;DR how do we know we aren't exposed to…

Every keyboard has an MCU. They used to be 8051s, but now ARM (or PIC or AVR) is more likely.

Re: Tomu, a tiny ARM microprocessor which fits in your USB port

#35

Post by qop »

askvictor wrote: post #25

Hold on - doesn't having this live permanently in the USB port reduce the security possible with a 2FA device? If the user has to get the key from their pocket and plug it in, it will at least prevent an attacker from accessing the user's account in a remote-desktop scenario. Certainly the requirement to press the button will mitigate this risk to a degree, but might there be exploits that can trigger this button-pre…

Don't you think they'd have thought that through?

I admire your diligent concern, but I thought the same thing for a split second and dismissed it.

I can't imagine even a corporate churn machine with the most reckless abandon designing a device like this and missing the most basic obvious attack vector.

Well, anyways....

Re: Tomu, a tiny ARM microprocessor which fits in your USB port

#36

Post by lisper »

aftbit wrote: post #27
lisper wrote: post #21

Earlier quoted context omitted.

You should check out: https://sc4.us/hsm/index.html (Disclosure: this is my project.)

Hi there - neat project! I'm always interested in open hardware for cryptography, so thanks for contributing to the space. :) That said, this quote concerns me: >The SC4-HSM is designed to defend against a compromised client machine, i.e. an attacker who pwns your laptop or desktop machine. If you think about it, this is the only threat model that makes sense for dedicated secure hardware. If you can trust that your…

> that's the bare minimum threat model for an open secure hardware device

Yes, I agree. But if you think about it, that can't be done by a device that does not have dedicated I/O, and two LEDs are not enough. At a minimum you need something capable of displaying a cryptographic hash if you want to protect against an pwned host.

Re: Tomu, a tiny ARM microprocessor which fits in your USB port

#37

Post by ggm »

MrMorden wrote: post #34
ggm wrote: post #6

Earlier quoted context omitted.

well.. I'd probably disable the flashing LEDs. But, that aside, I too thought "oh cool... a complete ARM system in my USB.. what could possibly go wrong here" But, the other side of this is: this is precisely what every closed-box USB device I plug into my USB potentially IS. This is just the overt "hi I'm an awesome tiny computer" state we're actually living in, all the time TL;DR how do we know we aren't exposed to…

Every keyboard has an MCU. They used to be 8051s, but now ARM (or PIC or AVR) is more likely.

Each time I do the OSX "need to reboot" thing and it sits at the equivalent of BIOS blowing driver updates for things like this, I think "yea, i hate BIOS, but at least I get told which devices are being re-coded" -with OSX, its a bit more opaque.

"trust us"

Re: Tomu, a tiny ARM microprocessor which fits in your USB port

#40

Post by CoolGuySteve »

utopcell wrote: post #2

Neat little device, looks like a Yubikey clone. One could get a similar device by hacking a Logitech unifying receiver, which contains a ..16MHz 8051 clone in it, and a radio to spare.

I feel old knowing my Logitech USB receiver is roughly as powerful as the Gameboy Advance I bought in college.
Post reply on HN