Live data from Hacker News

Firefly – An open-source $5 DIY hardware wallet

firefly.city

11–20 of 39 posts

Re: Firefly – An open-source $5 DIY hardware wallet

#11
post #3

Can you really call it an air-gap if you're using a BLE radio? I mean, yes, technically the information is transferred over the air rather than through a wire, but you wouldn't call a cell-phone an air-gapped device because it has half a zillion radios inside, many of which you can't even reliably turn off. Looking at the recent Broadcom wifi vulnerability -- just having a phone sitting there with the radio on is eno…

[deleted]

Re: Firefly – An open-source $5 DIY hardware wallet

#14
post #3

Can you really call it an air-gap if you're using a BLE radio? I mean, yes, technically the information is transferred over the air rather than through a wire, but you wouldn't call a cell-phone an air-gapped device because it has half a zillion radios inside, many of which you can't even reliably turn off. Looking at the recent Broadcom wifi vulnerability -- just having a phone sitting there with the radio on is eno…

Agreed. Call it "minimal threat surface," not airgapped. Air gapped means you as the user have total control over providing it data.

Re: Firefly – An open-source $5 DIY hardware wallet

#15
post #3

Can you really call it an air-gap if you're using a BLE radio? I mean, yes, technically the information is transferred over the air rather than through a wire, but you wouldn't call a cell-phone an air-gapped device because it has half a zillion radios inside, many of which you can't even reliably turn off. Looking at the recent Broadcom wifi vulnerability -- just having a phone sitting there with the radio on is eno…

The nRF24L01 is not really a BLE radio, though the modulation is effectively the same. It supports only a very simple protocol that is proprietary to Nordic Semi. In this case it looks like they're abusing it to sniff BLE advertising packets, but it wouldn't be able to do much else. I still agree that we shouldn't call it air-gapped, though.

You can send BLE advertisement packets with nRF24:

http://dmitry.gr/index.php?r=05.Projects&proj=15&proj=11.+Bl...

Re: Firefly – An open-source $5 DIY hardware wallet

#16
post #3

Can you really call it an air-gap if you're using a BLE radio? I mean, yes, technically the information is transferred over the air rather than through a wire, but you wouldn't call a cell-phone an air-gapped device because it has half a zillion radios inside, many of which you can't even reliably turn off. Looking at the recent Broadcom wifi vulnerability -- just having a phone sitting there with the radio on is eno…

OK, we took 'air-gapped' out of the title above.
Post reply on HN