11–20 of 36 posts
Off-topic, but I came across this tweet today. https://twitter.com/flexlibris/status/660108123487789056 > TSA at Boston airport tried to take my Yubikeys away from me to a second location "for a test". I refused & they backed off but FYI people. If you have your Yubikeys with you while traveling, you might want to be careful.
Hard to take your article seriously with statements such as "...Levels 1 and 2 of the FIPS140-2 certification are just a marketing gimmick". Even harder to believe Jakob took the time to respond.
Hexview provided their reason for believing that. Care to explain why you think otherwise?
>That is not a big deal, considering that Levels 1 and 2 of the FIPS140-2 certification are just a marketing gimmick for most electronic devices.
They have a point here: technically, the iPhone is FIPS140-1/2 compliant. By itself, that doesn't mean that the device is secure. It does show two important requirements for security.
Off-topic, but I came across this tweet today. https://twitter.com/flexlibris/status/660108123487789056 > TSA at Boston airport tried to take my Yubikeys away from me to a second location "for a test". I refused & they backed off but FYI people. If you have your Yubikeys with you while traveling, you might want to be careful.
Why wouldn't you take them with you while traveling? The whole point is to use them as part of your authentication chain.
>The whole point is to use them as part of your authentication chain.
I know and that's exactly why I said you might want to be careful with them while traveling. If your keys are taken away from you and you don't have any backup solution (such as recovery keys), you will get locked out of your important accounts.
That's a lot of text to say nothing of interest. I really love how they question the trade offs made in the PCB design, as if these things didn't occur to the designers.
Disappointed that they did nothing to probe the onboard MCUs to see if they could get it to leak anything, and just dismissed that with "we expect it to get high marks there." This seems an awfully low quality report from an infosec company. I was hoping to see an audit of the controllers onboard to see if (and if so, how much effort) they can extract onboard secrets, because after all that's the whole purpose of thi…
I guess they could have waited until they had more to publish it, but I found it interesting regardless
Hard to take your article seriously with statements such as "...Levels 1 and 2 of the FIPS140-2 certification are just a marketing gimmick". Even harder to believe Jakob took the time to respond.
Outside of the obvious external costs (development, transport, overheads, import, profit, etc), PCB + Tooling costs are often wildly underestimated.
For reference, a PCB of this size requires a setup + stencil template, which would run ~ 400 - 500 USD.
Tooling for the plastic injection mold for this piece would run around 5000 USD, and each subsequent piece would probably cost around 10 - 50c USD.
Tooling + PCBA done right have significant upfront costs that often seem to be forgotten.
That's a lot of text to say nothing of interest. I really love how they question the trade offs made in the PCB design, as if these things didn't occur to the designers.
Earlier quoted context omitted.
Disappointed that they did nothing to probe the onboard MCUs to see if they could get it to leak anything, and just dismissed that with "we expect it to get high marks there." This seems an awfully low quality report from an infosec company. I was hoping to see an audit of the controllers onboard to see if (and if so, how much effort) they can extract onboard secrets, because after all that's the whole purpose of thi…
First line of the page: Yubikey is a curiosity-driven side project for us and we have plans to dig a bit further into hardware as time permits. If anybody could confidentially help with NXP datasheets, it would be much appreciated. I guess they could have waited until they had more to publish it, but I found it interesting regardless
(I've just finished a year working on an embedded project using NXP 13xx series processors, and NXP's documentation is top notch.)
It seems that hardware breakdowns inevitably place a 'raw materials' costing to ojects broken down, often (but less in this instance) - as a somewhat passive-agressive dig at the company: "They sell it for $50, but it's only got $10 worth of components in it!" Outside of the obvious external costs (development, transport, overheads, import, profit, etc), PCB + Tooling costs are often wildly underestimated. For refere…
Hence, the popularity of the Design for Manufacturing concept these days...