141–150 of 215 posts
Something way more solid apparently does exist: USB Armory. https://inversepath.com/usbarmory.html The hardware is open, the software is mentioned without much detail; I suppose it's not shipping yet.
Earlier quoted context omitted.
>OnlyKey has been in use for about 4 years. It has thousands of active users and is in use in over 40 countries world wide. This is not a new product, and it has a great user community which is not afraid to test, hack, and prove the security of devices. Like literally the first issue was already linked above. Using the psuedo RNG with some analog pin seed isn't really acceptable. It should have a true rng IC that ca…
Like literally the first post issue is completely incorrect, thats one of the issues in reading a post like this in an online thread, literally that user copied part of but not all of the function that is used for RNG. The part they copied uses analog input as one of the sources of entropy, they failed to also include the 6 capacitive touch inputs that are also inputs to the RNG. Those touch inputs literally change e…
Let me say it again: you're taking an ADC reading (in the range of 0-1023) and accessing it as if it's a memory address.
To make things worse, addresses 0 through 1023 on the Kinetis you're using are the vector table. Take a look at that part of your firmware: it's extremely predictable, and only contains a small number of possible values.
In concept I like it, but one of the biggest yubikey advantages is how unobtrusive it is. I realize the tradeoff they're going for: Absolute security in the event that it's stolen... but I think that's actually bad for me since I'd rather have a tiny button to press as a second factor, than absolute security with a big dongle. It'd be great if they just released a direct yubikey style clone.
Solo was the first open source alternative to YubiKey. I'm using one of their products and have been happy with it so far: https://solokeys.com/
Earlier quoted context omitted.
A lot of services, like GSuite and LastPass, allow you to register multiple hardware keys. The best bet is to register several of them with these sites, then put one or two offsite (e.g. in a safety deposit box) just in case. Then, use GSuite to sign into other services (like Slack) wherever supported to minimize how often you need to do this.
Use TOTP (like Google Authenticator) as a backup method as well. It's helpful for scenarios like having to log in on a phone.
I honestly don't understand how a YubiKey is supposed to help me secure my accounts if I get locked out of my accounts when I lose it. I an trivially copy a keepass database anywhere and have dozens of backups. If I want to do the same with a YubiKey I first have to buy multiple YubiKeys and then I have to register each one on each site. This means they cannot be used as a primary authentication method because they a…
Good insight. Same goes for 2FA in general. If you lose the "second factor", you're done for, unless there's some backup. My bank pushes a phone-app-based authentication method that doesn't have any recovery or backup options outside of visiting a branch office. That's pretty secure in case of scams or theft, but I reinstalled my phone without thinking this autumn and got locked out of my bank account for months this…
Trezor T is vastly superior solution for U2F / WebAuthn and also fully open source. The main advantage is super mature backup (Shamir's secret sharing) and PIN-locking with exponential escape. Being a Bitcoin hardware wallet, security is very well tested.
Why does the code look like a copy-pasted mess? Kudos for making it open, though...
Earlier quoted context omitted.
Like literally the first post issue is completely incorrect, thats one of the issues in reading a post like this in an online thread, literally that user copied part of but not all of the function that is used for RNG. The part they copied uses analog input as one of the sources of entropy, they failed to also include the 6 capacitive touch inputs that are also inputs to the RNG. Those touch inputs literally change e…
Even if that analog pin provides a reasonable amount of entropy (which I'm skeptical of), you have a major bug: you're casting the ADC reading to a pointer, and then dereferencing it inside RNG.stir. Let me say it again: you're taking an ADC reading (in the range of 0-1023) and accessing it as if it's a memory address. To make things worse, addresses 0 through 1023 on the Kinetis you're using are the vector table. Ta…
At least we now have a better sense of what an A grade from Codacy actually counts for.
If the device doesn't have a secure element, how can anyone take it seriously as a strong root of trust? The page lists several recent attacks on secure element, but that's not really enough to convince me that no secure element is needed.