Open source is the only way to security in most cases.
Sadly much of the implementation is still missing to be audited, things like schematics and hardware design need to be more robust before we can really call this open source hardware.
OnlyKey: Open-Source Alternative to YubiKey
61–70 of 215 posts
Re: OnlyKey: Open-Source Alternative to YubiKey
#62I honestly don't understand how a YubiKey is supposed to help me secure my accounts if I get locked out of my accounts when I lose it. I an trivially copy a keepass database anywhere and have dozens of backups. If I want to do the same with a YubiKey I first have to buy multiple YubiKeys and then I have to register each one on each site. This means they cannot be used as a primary authentication method because they always require a fallback option in case you want to reset your credentials because you lost your YubiKey. If I can't use the YubiKey to secure my E-Mail account then what's the point? I'll still need to use password based login and store that E-Mail password in a conventional password manager that I then backup a dozen times.
YubiKeys only seem to make sense in a corporate environment where you can always request a new YubiKey and reregister it based on your ID.
Re: OnlyKey: Open-Source Alternative to YubiKey
#63Earlier quoted context omitted.
The "security" of this device is a joke, just look at how randomness is derived: unsigned int analog1 = analogRead(ANALOGPIN1); RNG.stir((uint8_t *)analog1, sizeof(analog1), sizeof(analog1)*2); unsigned int analog2 = analogRead(ANALOGPIN2); RNG.stir((uint8_t *)analog2, sizeof(analog2), sizeof(analog2)*2); (See [0] for a comprehensive summary of why this is a terrible thing to do) And yeah, analogRead() is a function…
You might want to check out this - https://docs.crp.to/security.html#cryptographically-secure-r... If you read further into the source you will see that analog read is only one of the sources of entropy, it uses capacitive touch from a user's skin and this TRNG passed dieharder tests - https://webhome.phy.duke.edu/~rgb/General/dieharder.php
for i in range(1,1000):
print sha256("lol what's entropy" + i)
This passes dieharder. Completely meaningless.
Re: OnlyKey: Open-Source Alternative to YubiKey
#64Earlier quoted context omitted.
It's not 'trivial' to extract the keys - all modern uCs have flash readout protection bits. It's probably easier to do than to read the secure element from your iPhone or extract keys from your SIM card or your credit cards, but it's not something you can do without specialized skills and equipment (although there are companies that provide commercial flash readout services).
Flash readout protection on most microcontrollers is a joke. They are almost always vulnerable to attacks ranging from power/clock glitching to asking nicely with the right combination of flash management commands (I'm looking at you, some PICs from the PIC18 series with blockwise erasable Flash including protection bits). I've seen some things disable their read protection by accident because the power supply wasn't…
I've signed a ot of these NDAs. Dirty little secret, most of them are DUAL_ED_DRBG which is backdoored. None of them have any meaningful protection, and usually they have sidehcannels the size of mountains. There's none of the secure element chips I would consider to be stronger than cryptography in software. They're the same as passing certifications, good to corporate management but a joke to anybody who knows what they're talking about.
Re: OnlyKey: Open-Source Alternative to YubiKey
#65I honestly don't understand how a YubiKey is supposed to help me secure my accounts if I get locked out of my accounts when I lose it. I an trivially copy a keepass database anywhere and have dozens of backups. If I want to do the same with a YubiKey I first have to buy multiple YubiKeys and then I have to register each one on each site. This means they cannot be used as a primary authentication method because they a…
A lot of services, like GSuite and LastPass, allow you to register multiple hardware keys. The best bet is to register several of them with these sites, then put one or two offsite (e.g. in a safety deposit box) just in case.
Then, use GSuite to sign into other services (like Slack) wherever supported to minimize how often you need to do this.
Re: OnlyKey: Open-Source Alternative to YubiKey
#66Open source is the only way to security in most cases.
Most of the security benefits come from giving the vendor an incentive to update their software quickly. I've often seen proprietary companies delay security critical patches until the next release or sue well meaning people who are reporting vulnerabilities (to the companies) as hackers to hide evidence of vulnerabilities.
There is a reason why so many vulnerabilities are found and reported in Linux compared to e.g. Windows. There is no censorship that tries to make the world look prettier than it is.
Re: OnlyKey: Open-Source Alternative to YubiKey
#67I honestly don't understand how a YubiKey is supposed to help me secure my accounts if I get locked out of my accounts when I lose it. I an trivially copy a keepass database anywhere and have dozens of backups. If I want to do the same with a YubiKey I first have to buy multiple YubiKeys and then I have to register each one on each site. This means they cannot be used as a primary authentication method because they a…
The way two factor auth works is that you register your hardware key and you also get 10 one-time-usage recovery codes which you can use instead.
So, if you lose your YubiKey, you can still login 10 times using a recovery code. Presumably during those 10 times you either disable 2FA or register a new YubiKey.
Re: OnlyKey: Open-Source Alternative to YubiKey
#68I honestly don't understand how a YubiKey is supposed to help me secure my accounts if I get locked out of my accounts when I lose it. I an trivially copy a keepass database anywhere and have dozens of backups. If I want to do the same with a YubiKey I first have to buy multiple YubiKeys and then I have to register each one on each site. This means they cannot be used as a primary authentication method because they a…
Good insight. Same goes for 2FA in general. If you lose the "second factor", you're done for, unless there's some backup. My bank pushes a phone-app-based authentication method that doesn't have any recovery or backup options outside of visiting a branch office. That's pretty secure in case of scams or theft, but I reinstalled my phone without thinking this autumn and got locked out of my bank account for months this winter.
Re: OnlyKey: Open-Source Alternative to YubiKey
#69Why does the code look like a copy-pasted mess? Kudos for making it open, though...
Re: OnlyKey: Open-Source Alternative to YubiKey
#70I was interested until I saw the price tag: $46. Seriously, WTH?
Seems reasonable. The cheap YubiKey is $20 (over $30 with tax and shipping) while the series 5 YubiKey is $50-$70.
And I assume Yubico is capable of making much bigger (aka cheaper per unit) orders.