Live data from Hacker News

CVE-2021-3011: Key recovery on Google Titan Key

ninjalab.io

11–20 of 80 posts

Re: CVE-2021-3011: Key recovery on Google Titan Key

#11
post #2

Why does this blog have a loading bar that gets stuck around 99% for me? Every request has loaded and is cached by my browser, yet it hangs at 99% artificially for like 30s.

If you do client side “rendering” (which means that you get page content from the server in json format, and generate the html from javascript), you have to show a placeholder until the webpage content gets generated. Otherwise the user sees an incomplete page with elements jumping around for a fraction of a second on load.

But the placeholder might get stuck if anything goes wrong.

Personally, I hate it. Better to use static html for blog content.

Re: CVE-2021-3011: Key recovery on Google Titan Key

#13

Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3011

Source of what? If it's the PDF, sure, but the post is the reporters' summary.

(For future reference

Posted link as of comment: https://ninjalab.io/a-side-journey-to-titan/

First-party PDF: https://ninjalab.io/wp-content/uploads/2021/01/a_side_journe...)

Re: CVE-2021-3011: Key recovery on Google Titan Key

#14
post #12

Even with this problem, using the keys for U2F is safer than SMS two factor auth. Possibly also safer than authentication app on phone, which could be compromised in various ways.

Much safer than a TOTP authentication app, which is susceptible to phishing attacks, unlike U2F.

Re: CVE-2021-3011: Key recovery on Google Titan Key

#16
Note, Google in typical fashion has named 6+ products "Titan." (Titan M, Titan C, Titan Security Key (available in USB A, C, Bluetooth versions), Titan Security Module, OpenTitan, and maybe a few more if you count the old Bluetooth versions that were recalled that look identical to the new Bluetooth version).

The various Titan Security Keys are also made by Feitian who sometimes use the same auth chip and sometimes don't but externally look identical.

The products sole purpose is to establish a secure chain of trust and starts out the gate broken with ambiguous or misleading claims for verifying exactly which Titan it is.

Google will pay you $1 million to hack the Titan but not the Titan hacked here - the other Titan[1]. Furthermore they are happy to tell you that their products, like Google Cloud Platform, are "Secured by Titan" but not which Titan [2].

This is frustrating because the Titan M is an absolutely brilliant device, with some real advancements to normalize embedded security, including an SPI interposer to monitor communications (a real leap forward) - and should not at all be conflated with a generic, whitelabeled, non-hsm product that makes no claims whatsoever and has been broken at least twice before [3] [4]. The Titan C is an even bigger improvement over the Titan M but not in anyway they care to disclose which may or may not indicate weaknesses in Titan M [5]. Likewise, OpenTitan[6] is crashing through barriers others didn't even know were there in establishing verifiable silicon roots of trust but is ambiguously different than Titan M because of various foundry and PDK issues which may be as innocuous as having to run the chips through at different process sizes but who knows because while OpenTitan is verifiable; Titan M/C aren't.

[1] https://duo.com/decipher/hack-the-titan-m-get-usd1-million

[2] https://cloud.google.com/blog/products/gcp/titan-in-depth-se...

[3] http://www.hexview.com/~scl/titan/ - note the migration from the NXP A7005a to A7005c

[4] https://www.engadget.com/2019-05-15-google-recalls-some-tita...

[5] https://showcase.withgoogle.com/titan-c/

[6] https://opentitan.org/

Re: CVE-2021-3011: Key recovery on Google Titan Key

#18

I recently rolled out smartcard SSH authentication via PIV on Yubikey NEOs. Since the attack requires a few thousand observations, I’m still quite safe, right? An attacker would still need to know the PIV PIN.

The attacker needs physical access to your Yubikey NEO and to then run a few thousand observations. Using a U2F dongle is still MUCH better than many other types of 2 factor authentication.

My family are enrolled in Google Advanced Protection and some of our U2F dongles are the affected Titan keys. I'm not at all concerned and am not rushing out to switch to different dongles.

Re: CVE-2021-3011: Key recovery on Google Titan Key

#19
post #12

Even with this problem, using the keys for U2F is safer than SMS two factor auth. Possibly also safer than authentication app on phone, which could be compromised in various ways.

Much safer than a TOTP authentication app, which is susceptible to phishing attacks, unlike U2F.

I had to switch back from Yubikey to TOTP because AWS' CLI tools doesn't work with U2F. This really annoys me.
Post reply on HN