61–70 of 91 posts
Neat little device, looks like a Yubikey clone. One could get a similar device by hacking a Logitech unifying receiver, which contains a ..16MHz 8051 clone in it, and a radio to spare.
Hold on - doesn't having this live permanently in the USB port reduce the security possible with a 2FA device? If the user has to get the key from their pocket and plug it in, it will at least prevent an attacker from accessing the user's account in a remote-desktop scenario. Certainly the requirement to press the button will mitigate this risk to a degree, but might there be exploits that can trigger this button-pre…
Earlier quoted context omitted.
I feel old knowing my Logitech USB receiver is roughly as powerful as the Gameboy Advance I bought in college.
At roughly the same clock speed I think the 32-bit ARM7 in the Gameboy would actually run laps around an 8-bit 8051.
Earlier quoted context omitted.
At roughly the same clock speed I think the 32-bit ARM7 in the Gameboy would actually run laps around an 8-bit 8051.
the original Gameboy had a Z80/8080 hybrid.
Earlier quoted context omitted.
You should check out: https://sc4.us/hsm/index.html (Disclosure: this is my project.)
this is really cool! thanks for sharing it here, I'll definitely dig in deeper on it. I've been following Tomu development for over a year now (two?) I've got one on desk right now, the ideas that mithro cares about, the open hardware, are very important to me and I'm glad to see as much development in the space as possible.
I'm sure you are aware of Nitrokey. If not, here you go: https://www.nitrokey.com/
Neat little device, looks like a Yubikey clone. One could get a similar device by hacking a Logitech unifying receiver, which contains a ..16MHz 8051 clone in it, and a radio to spare.
Could you share information of how one could do this? I looked it up on Github but could not find anything related to what you mentioned.
Earlier quoted context omitted.
Genuine question: if you can't clone your 2FA, how do you make spares like a house key ? If there is way to get a spare, what's the way to deal with key loss or shared access ?
Essentially you have a to configure the account/device you are authenticating with to accept multiple keys permanently (so you can have spares) or temporarily (replacing a key by registering a new one then revoking the old). In the case of key loss on a properly secure service registering a new key could be problematical if you don't have any other key that is still appropriately registered - you might be permanently…
Is there a standard to automate that ?
Earlier quoted context omitted.
One key (pardon the pun) requirement of a 2FA key is that it can't be cloned - how would this be prevented? Can the microprocessor be locked to prevent reading its flash memory?
Genuine question: if you can't clone your 2FA, how do you make spares like a house key ? If there is way to get a spare, what's the way to deal with key loss or shared access ?
Like having several doors on your house, (though not a 'back door'..!) each with a different lock/key. _Not_ like having several locks on your one door, or multiple copies of the key for one lock.
I can recommend the DigiSpark as a cheaper, slower, alternative that works with the Arduino IDE [1]. Somebody could easily get it into a smaller form factor. I've bought some of the official versions in their KickStarter and whenever I buy through some company/research funding - but can also recommend the cheaper Chinese implementations to be just as good for projects. [1] http://digistump.com/products/1
That doesn't fit entirely within the USB port like the Tomu, and it's out of stock (with no eta).
You can get clones from china on ebay for about $5.