Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yubico: Secure Hardware vs. Open Source

yubico.com

Post reply on HN
Print view View original

101–110 of 114 posts

Re: Yubico: Secure Hardware vs. Open Source

#101

Post by rkangel »

makomk wrote: post #88
mtgx wrote: post #75

Earlier quoted context omitted.

What would be the purpose of an NDA with the hardware provider? Surely not to hide it from GCHQ/NSA?! I imagine a company like Yubico has all of its employees on GCHQ/NSA lists and may even have cell tower simulators outside of its offices. The NDA makes this even more suspicious. Who's the hardware provider? Huawei?

Pretty much all of the providers of secure hardware are like this because they're all reliant on security by obscurity. They rely on keeping secret things like their instruction set, register locations, what countermeasures against intrusion they have, etc in order to make it harder for a hacker to compromise them.

> in order to make it harder for a hacker to compromise them

Keeping implementation details secret DOES make it harder for a hacker to compromise them. When used as a defence on top of a decent security infrastructure. "Security through obscurity" is when a company only uses the secrecy as a defence. This is not true:

> they're all reliant on security by obscurity

They're generally reliant on some secure and proven methods of security, with a layer of design obscurity over the top (and in practice as others have pointed out, they don't keep the design secret for security reasons, they do it for commercial ones).

Re: Yubico: Secure Hardware vs. Open Source

#102

Post by rkangel »

datenwolf wrote: post #69
davideous wrote: post #11

In discussions like this the phrase "security by obscurity" gets used as an accusation. We all agree "security by obscurity" does not work. But that's not what is happening here. Wikipedia's definition: "the reliance on the secrecy of the design or implementation as the main method of providing security for a system or component of a system." Youbico isn't saying that the security of the device is increased by keepin…

> In discussions like this the phrase "security by obscurity" gets used as an accusation. We all agree "security by obscurity" does not work. But that's not what is happening here. Well, sort of. In the linked article Jakob Ehrensvard (Yubico CTO) wrote: >> (…) One could say it actually works the other way. In fact, the attacker’s job becomes much easier as the code to attack is fully known and the attacker owns the…

Security through obscurity is when obscurity is your only security measure. When used on top of an otherwise secure system, obscurity actually makes finding vulnerabilities harder.

The principle with open source is that you can trade that obscurity away in favour of the "many eyes" on your code and the fact that it is then proven secure. That tradeoff is definitely worth it, but that doesn't mean that the obscurity doesn't help security.

Re: Yubico: Secure Hardware vs. Open Source

#103

Post by xaduha »

mpnordland wrote: post #90
xaduha wrote: post #70

Earlier quoted context omitted.

> The best way to show that you support open source is to buy the YubiKey NEO instead of the YubiKey 4. YubiKey NEO isn't a unique product, it's basically a cardreader and a java smartcard all-on-one, but there are plenty of vendors for both, it will probably can be even cheaper in some circumstances/regions. If you support open source, then give https://github.com/philipWendland/IsoApplet a look instead. A separate…

I use pgp on my mobile devices too, I would prefer something I could use for both my phone and my computer. The NEO would have filled that role. In my research I haven't found anything like that so far. I would love to be enlightened though if anyone knows about something that can do the same!

If your phone has NFC interface, then in theory it should be possible to access contactless java smart cards.

https://github.com/doc-rj/smartcard-reader

https://play.google.com/store/apps/details?id=com.inoapp.car...

Other than that there are java cards in microSD format such as these

https://news.ycombinator.com/item?id=9625862

http://www.cardomatic.de/epages/64510967.sf/en_GB/?ObjectPat...

Then there's also a shaky area of pkcs11 proxies.

Re: Yubico: Secure Hardware vs. Open Source

#105

Post by captainmuon »

This story made me think a bit about devices like the Yubikey. I'd really like one to store my keys to sign mail, or for two-factor-authentication. But the main selling point, the tamper-resistant secure-enclave-like chip, is something I don't need. I'd rather have a tiny microcontroler in USB format that I can program myself and understand nearly 100%, with no secret code going on.

My reasoning: I don't need physical tamper-resistance for my threat scenario - if it is stolen by a random thief, a coworker, a "friend", etc..

But if I was attacked by a nation-state-like actor, I cannot trust any security measure of the device. How do I know the NSA does not have a copy of every "random" card-manager key? How do I know that generated keys are not subtly biased so that they can be guessed easily? Or that there is not a secret function to extract them? Even if Yubico is 100% honest and their device is clean, I must assume that if e.g. the NSA were after me, they have the technology to extract the keys from the device, no matter what protection it has.

Re: Yubico: Secure Hardware vs. Open Source

#106

Post by mindslight »

xaduha wrote: post #70
uola wrote: post #51

Earlier quoted context omitted.

"They clearly changed stance to ensure users cannot play with the hardware" As per the statement (and earlier statements) you can't change the firmware unless you have a yubikey neo developer edition, which was only sold during 2012 and 2013. The change here is that the yubikey 4 doesn't run open source code (for the pgp part) as a result of changing platforms. The best way to show that you support open source is to…

> The best way to show that you support open source is to buy the YubiKey NEO instead of the YubiKey 4. YubiKey NEO isn't a unique product, it's basically a cardreader and a java smartcard all-on-one, but there are plenty of vendors for both, it will probably can be even cheaper in some circumstances/regions. If you support open source, then give https://github.com/philipWendland/IsoApplet a look instead. A separate…

A feature the Yubi has over a smartcard is the button. You can get smartcard readers with pinpads etc, but not that fit into an Expresscard slot.

I was pretty close to getting a Yubi, until I realized that the default version couldn't modify the PGP applet, and didn't find exactly where to order the special "developer edition" either.

At this point it probably makes more sense to find/make a dongle based on an STM32 or the like. The problems with non-hardened hardware discussed in the article are real, but I'd bet the features/innovation enabled by a Free design will outweigh those tradeoffs (eg an audit log, indication of what you're signing/unlocking, actual encrypted key material when the device is "cold").

Re: Yubico: Secure Hardware vs. Open Source

#107

Post by BuildTheRobots »

mahart wrote: post #92
BuildTheRobots wrote: post #85

Earlier quoted context omitted.

> You can copy the freaking key by removing the plastic of the yubikey4 Any more information available? googling for "yubikey 4 takeapart" got me nowhere.

The plastic dissolves in acetone, this is a neo not a 4: http://www.hexview.com/~scl/neo/

Found that link - though even after getting the Neo's circuit board exposed I didn't think it was as simple as "connecting the pins and reading the key out". Op also specifically says yubikey 4 :)

Re: Yubico: Secure Hardware vs. Open Source

#108

Post by nickpsecurity »

uola wrote: post #64
nickpsecurity wrote: post #58

Earlier quoted context omitted.

"The hardware design per se isn't that valuable" People that spend considerable effort turning a good idea into hardware that sells tell me otherwise. ;) "because it makes it easier to reverse engineer and clone the chips themselves." You first said it's easy to reverse engineer and not valuable. Then, said they want closed designs to reduce reverse engineering and cloning. Which is it? "For YubiKey themselves it's m…

"People that spend considerable effort turning a good idea into hardware that sells tell me otherwise. ;)" The execution and the overall ecosystem of course matters. But the hardware design, how the chips are connected, isn't really a secret as such and is easy to reverse engineer and recreate. It's just not very complex. http://www.hexview.com/~scl/neo/ "Which is it?" The hardware design is easy to clone, the chips…

"But the hardware design, how the chips are connected, isn't really a secret as such and is easy to reverse engineer and recreate. It's just not very complex."

Hardware design is a combo of how the chips are connected, the firmware, and getting it to users. Your link supports my assertion that they should put in whatever obstacles they can.

"Companies therefor try to protect their IP as much as possible by making reverse engineering harder and by "owning the ecosystem"."

Point 1 in my original comment.

Re: Yubico: Secure Hardware vs. Open Source

#109

Post by stijnhoop »

ctz wrote: post #71
amluto wrote: post #22

I thought about this for awhile, and here are my thoughts about having the source code: With the older YubiKey NEO devices, the applet source was available and I could freely upload an applet. This was great for a few reasons. I could modify or upgrade the app (of course, doing so would cause me to lose existing keys, which makes sense from a security PoV). (I actually did this on my old YubiKey.) I could also, in pr…

> With SGX, Intel had the chance to offer a widely available security token (built in to every new CPU!) that anyone could freely program and use for their own security purposes. They blew it when they created their "launch control" policy Now rescinded.

Could you detail that with a link to this news?

Re: Yubico: Secure Hardware vs. Open Source

#110

Post by the_ancient »

nickpsecurity wrote: post #27
the_ancient wrote: post #19

Earlier quoted context omitted.

>>Cisco and mobile manufacturers vs Huwei to see how big of a market share that can lead to. Implying the Huawei is the "cheap knock off" and Cisco/Apple/Samsung/etc are the noble high quality product fighting the good fight.... My Hauwei Nexus 6P has been the best phone I have ever owned, far exceeding the quality and usability of every Motorola, Samsung, and other phones I have owned. As to Cisco, after their fasco…

That's an accusation and implication. The Chinese strategy, which isn't entirely secret, is to use their hackers to get trade secrets out of firms in all kinds of sectors to hand to their own firms. Each time, their firms leverage those as a head start on their own products which combine their own innovations, labor advantage, and money from vast market in China. It's a proven model. Far as Cisco and Samsung, it's be…

>Chinese intelligence giving your competition your I.P. who then operate in your market with cheaper labor.

Well first and foremost I do not accept the concept of IP in the first place, Information is not property and should not be protected.

Nor or they "my competition" they might be cisco, but I do not support nationalism, or protectionism.

Let me Guess, your a Trump Supporter?

Post reply on HN