Firefly – An open-source $5 DIY hardware wallet
firefly.city
Firefly – An open-source $5 DIY hardware wallet
1–10 of 39 posts
Re: Firefly – An open-source $5 DIY hardware wallet
#2The firefly certainly can transmit it has a display. I imagine an attacker could get the firefly to display enough information to extract the ether from the wallet.
Re: Firefly – An open-source $5 DIY hardware wallet
#3Can you really call it an air-gap if you're using a BLE radio? I mean, yes, technically the information is transferred over the air rather than through a wire, but you wouldn't call a cell-phone an air-gapped device because it has half a zillion radios inside, many of which you can't even reliably turn off.
Looking at the recent Broadcom wifi vulnerability -- just having a phone sitting there with the radio on is enough to let an attacker gain root on some devices.
I've generally seen the term "air-gap" used to mean "as isolated as possible" -- i.e. take apart a laptop and remove all networking hardware, microphones, speakers, fill all the ports with epoxy, and connect it to an isolated battery / power supply.
If an attacker can poke at your device by sending it custom BLE packets without your knowledge, I'd argue that it doesn't qualify.
From the video:
The firefly is receive only, so it cannot be remotely hacked.
Bullshit.
Re: Firefly – An open-source $5 DIY hardware wallet
#4The firefly certainly can transmit it has a display. I imagine an attacker could get the firefly to display enough information to extract the ether from the wallet.
It's a proof of concept, and at least passively interesting. Of course, I didn't see a "decline" button, and without a power button it could be an issue.. btle could be sufficient with a screen sleep.
Also no idea how to add currency to the wallet... that could be another issue.
Re: Firefly – An open-source $5 DIY hardware wallet
#5Can you really call it an air-gap if you're using a BLE radio? I mean, yes, technically the information is transferred over the air rather than through a wire, but you wouldn't call a cell-phone an air-gapped device because it has half a zillion radios inside, many of which you can't even reliably turn off. Looking at the recent Broadcom wifi vulnerability -- just having a phone sitting there with the radio on is eno…
The nRF24L01 is not really a BLE radio, though the modulation is effectively the same. It supports only a very simple protocol that is proprietary to Nordic Semi. In this case it looks like they're abusing it to sniff BLE advertising packets, but it wouldn't be able to do much else.
I still agree that we shouldn't call it air-gapped, though.
Re: Firefly – An open-source $5 DIY hardware wallet
#6Can you list the BOM with links to buy.
Re: Firefly – An open-source $5 DIY hardware wallet
#7Could someone explain how this costs $5? Does that mean if you already have most of the parts laying around? I'm actually curious.
Re: Firefly – An open-source $5 DIY hardware wallet
#8Thank you so much for showing me what I am supposed to do with my ETH credits! (Edit: Apparently I came off as astroturfing or something, I don't know why, I wanted to draw attention to the amazing ethers.io thing that is two links deep inside of this post...) This was honestly the first time I saw a great demo of what Ether can do and how it should be used, all within a browser, and also thanks to Coinbase supporting Ethereum, without even reaching for my wallet.
Edit: And the Devcon2 video behind the ethers link! This is the link that keeps on giving!
That was the easiest anyone on the internet ever took my $20. And I feel like you just showed me So Much in so few steps.
I have no idea what I just bought, or if I need to do something so that I can receive a kit? Hope your crowdfunding is successful? It says teaser, so I'm assuming that what I bought was just the ENS name, and the incredible exchange that was absolutely frictionless. I see that I have my own vanity address in there now, and I'm thinking that this is all somehow built on Ethereum ecosystem. In about 60 seconds you just completely restored my confidence that the whole Ethereum thing is absolutely incredible, and gonna take over the world.
(Not to mention I like the looks of your product/DIY thing!)
Man I feel like I'm really far behind the curve on this Ethereum thing, I learned all about Bitcoin but I never took any time to learn about Ethereum, and I feel like that was such a huge mistake. I know that it's contracts, and smart contracts, and by default accounts can't even tell you about transactions at all, until you write more something or other in a contract; and contracts are somehow JavaScript, and that's about as far as my knowledge extends about it.
I really just figured out that I needed to get some when it was worth about $90. But only just now, seeing how slick this Javascript wallet thing is that you just showed me, that you made me figure out how to keep, only now do I feel like I Really Get how much power there is in Ethereum that you don't just get "Batteries Included" like this on Bitcoin.
Re: Firefly – An open-source $5 DIY hardware wallet
#9Could someone explain how this costs $5? Does that mean if you already have most of the parts laying around? I'm actually curious.
radio + application processor $3.18 https://m.aliexpress.com/item/1387904044.html
OLED $2.59 https://m.aliexpress.com/s/item/32233342471.html
The rest is passive junk that's probably about 25¢.
That's more than $5, but this is what 120 seconds of searching on AliExpress turned up.
Software is where a lot of the value comes from. I assume it's using a clever hack like http://dmitry.gr/index.php?r=05.Projects&proj=11.%20Bluetoot...
Re: Firefly – An open-source $5 DIY hardware wallet
#10Can you really call it an air-gap if you're using a BLE radio? I mean, yes, technically the information is transferred over the air rather than through a wire, but you wouldn't call a cell-phone an air-gapped device because it has half a zillion radios inside, many of which you can't even reliably turn off. Looking at the recent Broadcom wifi vulnerability -- just having a phone sitting there with the radio on is eno…
A more "air gap"-ish concept would have been a camera on the Firefly. Take a pic of a QR code on the phone, sign on the device, use the phone to take a pic of the output QR.