Why is Google selling potentially compromised Chinese security keys?

While I freely admit that I use a lot of Google services, have an Android phone, and so on... I can't fathom why anyone would think it's a good idea to buy security hardware from an advertising company.

It would be difficult, but the one thing I've learned to trust in security is that there's no such thing as a system that can't be broken.

For U2F, the first thing that comes to mind is timing channels, or perhaps building in a radio and letting anyone nearby use the key as if it were theirs.

It is an USB device. Cannot it attack a PC by pretending to be a keyboard and typing some commands?

We live in an interesting time and place where China could declare war on the democratic countries in the next 5 years...let me explain. China is in a very bad situation where it has accumulated too much debt in its national and local governments, and corporations. Inflation is going through the roof - rent has increased 30% from 2017 in Beijing and other cities, and food costs are going up because of the tariffs. And incomes are declining - top income for tsinghua graduates, the top university in China, has fallen 20% from 2016. There have been various protests from veterans about decreased/stopped pays.

All this will eventually lead to a point where the CCP has to appease its citizens for the crashing economy. Either it will choose to subdue its own people - either with more police state, lockdowns, or jailing, and do so for the next 10-20 years while the bad debts slowly gets resolved (ala Japan), or it will choose to redirect its focus abroad (ala Germany 1930) and starts to aggressively expanding and taking over countries as puppet states (which it is already doing now with various African states and Southeast countries) or use its growing military to attack nearby countries (Taiwan, Vietnam)

That makes the (cyber)defenses against China even more important today. Thus we have US/Australia banning Huawei and ZTE, and Japan is thinking about banning them as well from the network. The free, democratic countries of the world are starting to realize how dangerous giving China backdoors into the networks is.

We need to monitor all our security breaches that exposes us to Chinese cyber espionages, so we can prevent theft of important technologies.

Don't ask us.. ask.. Hacker News? LMHNTFY?

https://pwnaccelerator.github.io/2018/webusb-yubico-disclosu...

https://www.imperialviolet.org/2017/10/08/securitykeytest.ht...

The second one is (more) interesting, IMHO. The entries on how most of the keys have some defect or other are worth reading, since mostly nobody is looking at this stuff.

The relevant paragraph on Feitian:

Feitian ePass

ASN.1 DER is designed to be a “distinguished” encoding, i.e. there should be a unique serialisation for a given value and all other representations are invalid. As such, numbers are supposed to be encoded minimally, with no leading zeros (unless necessary to make a number positive). Feitian doesn't get that right with this security key: numbers that start with 9 leading zero bits have an invalid zero byte at the beginning. Presumably, numbers starting with 17 zero bits have two invalid zero bytes at the beginning and so on, but I wasn't able to press the button enough times to get such an example. Thus something like one in 256 signatures produced by this security key are invalid.

Also, the final eight bytes of the key handle seem to be superfluous: you can change them to whatever value you like and the security key doesn't care. That is not immediately a problem, but it does beg the question: if they're not being used, what are they?

Lastly, the padding data in USB packets isn't zeroed. However, it's obviously just the previous contents of the transmit buffer, so there's nothing sensitive getting leaked.