OnlyKey: Open-Source Alternative to YubiKey • Hacker News Board

Re: OnlyKey: Open-Source Alternative to YubiKey

#71

Post by blattimwind » Thu, Dec 26, 2019, 8:14 PM UTC

marcan_42 wrote: post #57

Tharre wrote: post #27

Earlier quoted context omitted.

The "security" of this device is a joke, just look at how randomness is derived: unsigned int analog1 = analogRead(ANALOGPIN1); RNG.stir((uint8_t *)analog1, sizeof(analog1), sizeof(analog1)*2); unsigned int analog2 = analogRead(ANALOGPIN2); RNG.stir((uint8_t *)analog2, sizeof(analog2), sizeof(analog2)*2); (See [0] for a comprehensive summary of why this is a terrible thing to do) And yeah, analogRead() is a function…

It seems this is literally written in the horrible Arduino "everything in one huge file" style: https://github.com/trustcrypto/OnlyKey-Firmware/blob/master/... The funny thing is they have a "Source code reviewed by Codacy" badge on the readme claiming the code is grade A... but if you actually click through, of course Codacy didn't pick up the .ino file at all, so in fact nothing of substance is being reviewed. That…

> The funny thing is they have a "Source code reviewed by Codacy" badge on the readme claiming the code is grade A... but if you actually click through, of course Codacy didn't pick up the .ino file at all, so in fact nothing of substance is being reviewed. That .ino file wouldn't pass any style review... it's a mess.

Meanwhile Nitrokey has actually been audited by Cure53.

Re: OnlyKey: Open-Source Alternative to YubiKey

#72

Post by Fnoord » Thu, Dec 26, 2019, 8:23 PM UTC

cies wrote: post #9

Open source is the only way to security in most cases.

Older YubiKey are still FOSS. Newer not. From the top of my head anything 4+ is closed source.

Re: OnlyKey: Open-Source Alternative to YubiKey

#73

Post by fauigerzigerk » Thu, Dec 26, 2019, 8:25 PM UTC

fierarul wrote: post #67

imtringued wrote: post #62

I honestly don't understand how a YubiKey is supposed to help me secure my accounts if I get locked out of my accounts when I lose it. I an trivially copy a keepass database anywhere and have dozens of backups. If I want to do the same with a YubiKey I first have to buy multiple YubiKeys and then I have to register each one on each site. This means they cannot be used as a primary authentication method because they a…

The way two factor auth works is that you register your hardware key and you also get 10 one-time-usage recovery codes which you can use instead. So, if you lose your YubiKey, you can still login 10 times using a recovery code. Presumably during those 10 times you either disable 2FA or register a new YubiKey.

All depending on the discretion of the various services. Of all the services that force me to use 2FA only a tiny minority provides recovery codes.

Re: OnlyKey: Open-Source Alternative to YubiKey

#74

Post by idlewords » Thu, Dec 26, 2019, 8:28 PM UTC

imtringued wrote: post #62

I honestly don't understand how a YubiKey is supposed to help me secure my accounts if I get locked out of my accounts when I lose it. I an trivially copy a keepass database anywhere and have dozens of backups. If I want to do the same with a YubiKey I first have to buy multiple YubiKeys and then I have to register each one on each site. This means they cannot be used as a primary authentication method because they a…

You set one up with backup methods (backup key, TOTP and single-use codes) to avoid getting locked out. You can still get into accounts fine if the key is gone because of the backup methods, you just lose the extra layer of phishing protection.

Re: OnlyKey: Open-Source Alternative to YubiKey

#75

Post by idlewords » Thu, Dec 26, 2019, 8:29 PM UTC

fauigerzigerk wrote: post #73

fierarul wrote: post #67

Earlier quoted context omitted.

The way two factor auth works is that you register your hardware key and you also get 10 one-time-usage recovery codes which you can use instead. So, if you lose your YubiKey, you can still login 10 times using a recovery code. Presumably during those 10 times you either disable 2FA or register a new YubiKey.

All depending on the discretion of the various services. Of all the services that force me to use 2FA only a tiny minority provides recovery codes.

What services allow U2F security keys but don't provide single-use recovery codes as backup?

Re: OnlyKey: Open-Source Alternative to YubiKey

#76

Post by xani » Thu, Dec 26, 2019, 8:29 PM UTC

Tharre wrote: post #27

dehugewe1209 wrote: post #15

Security keys are the heart of security and we desperately need open-source solutions on this. Kudos for doing it. Now, I must point out a few things: 1. Please don't call your solution "Open-source", when you do not have not even the schematics uploaded to github. 2. (this item is an open problem without a solution yet) how do I make sure the source code and the (still missing) hardware information actually correspo…

The "security" of this device is a joke, just look at how randomness is derived: unsigned int analog1 = analogRead(ANALOGPIN1); RNG.stir((uint8_t *)analog1, sizeof(analog1), sizeof(analog1)*2); unsigned int analog2 = analogRead(ANALOGPIN2); RNG.stir((uint8_t *)analog2, sizeof(analog2), sizeof(analog2)*2); (See [0] for a comprehensive summary of why this is a terrible thing to do) And yeah, analogRead() is a function…

You probably will be getting at least one bit of randomness out of it if the input is not saturated (As in not below 0 or above reference voltage ADC is using), just because pretty much all ADC are noisy enough that the last bit will be flipping. Of course that doesn't excuse every other problem with it

> Meaning that there is no hardware security whatsoever and it's trivial to extract all your keys from the device if you ever lose it. Whoops.

Most micros, ones used in various Arduinos included have fuse bits so there is at least the minimal level of protection. Question whether they used it even...

Re: OnlyKey: Open-Source Alternative to YubiKey

#77

Post by idlewords » Thu, Dec 26, 2019, 8:30 PM UTC

cal5k wrote: post #65

imtringued wrote: post #62

I honestly don't understand how a YubiKey is supposed to help me secure my accounts if I get locked out of my accounts when I lose it. I an trivially copy a keepass database anywhere and have dozens of backups. If I want to do the same with a YubiKey I first have to buy multiple YubiKeys and then I have to register each one on each site. This means they cannot be used as a primary authentication method because they a…

A lot of services, like GSuite and LastPass, allow you to register multiple hardware keys. The best bet is to register several of them with these sites, then put one or two offsite (e.g. in a safety deposit box) just in case. Then, use GSuite to sign into other services (like Slack) wherever supported to minimize how often you need to do this.

Use TOTP (like Google Authenticator) as a backup method as well. It's helpful for scenarios like having to log in on a phone.

Re: OnlyKey: Open-Source Alternative to YubiKey

#78

Post by 91iejrj20310 » Thu, Dec 26, 2019, 8:31 PM UTC

fierarul wrote: post #67

imtringued wrote: post #62

I honestly don't understand how a YubiKey is supposed to help me secure my accounts if I get locked out of my accounts when I lose it. I an trivially copy a keepass database anywhere and have dozens of backups. If I want to do the same with a YubiKey I first have to buy multiple YubiKeys and then I have to register each one on each site. This means they cannot be used as a primary authentication method because they a…

The way two factor auth works is that you register your hardware key and you also get 10 one-time-usage recovery codes which you can use instead. So, if you lose your YubiKey, you can still login 10 times using a recovery code. Presumably during those 10 times you either disable 2FA or register a new YubiKey.

I guess those recovery codes are the new security questions - yes theoretically they are there to recover your account, but in practice, you won't have them at hand unless you stored them in your password manager.

Re: OnlyKey: Open-Source Alternative to YubiKey

#79

Post by Leace » Thu, Dec 26, 2019, 8:32 PM UTC

imtringued wrote: post #62

I honestly don't understand how a YubiKey is supposed to help me secure my accounts if I get locked out of my accounts when I lose it. I an trivially copy a keepass database anywhere and have dozens of backups. If I want to do the same with a YubiKey I first have to buy multiple YubiKeys and then I have to register each one on each site. This means they cannot be used as a primary authentication method because they a…

> I honestly don't understand how a YubiKey is supposed to help me secure my accounts if I get locked out of my accounts when I lose it.

The same way physical keys protect your home even when you lose them - you have spare keys for that event.

Re: OnlyKey: Open-Source Alternative to YubiKey

#80

Post by ComodoHacker » Thu, Dec 26, 2019, 8:33 PM UTC

Setting aside problems with this particular device, the whole "trust the open-source hardware" model is inherently flawed. Every useful security hardware will be commoditized, then faked and/or trojaned. We can't take the open-source software approach and rely on many volunteer eyes catching vulnerabilities and backdoors. First, there just aren't enough skilled professionals capable of proper hardware review. And second, how can you be sure the device in your hand strictly meets its specs? there's no such things as digital signatures and reproducible builds for hardware. Vendor reputation is all we have for now.

Can we do something about this?