Yubico: Secure Hardware vs. Open Source • Hacker News Board

Re: Yubico: Secure Hardware vs. Open Source

#111

Post by nickpsecurity » Wed, May 18, 2016, 1:35 AM UTC

the_ancient wrote: post #110

nickpsecurity wrote: post #27

Earlier quoted context omitted.

That's an accusation and implication. The Chinese strategy, which isn't entirely secret, is to use their hackers to get trade secrets out of firms in all kinds of sectors to hand to their own firms. Each time, their firms leverage those as a head start on their own products which combine their own innovations, labor advantage, and money from vast market in China. It's a proven model. Far as Cisco and Samsung, it's be…

>Chinese intelligence giving your competition your I.P. who then operate in your market with cheaper labor. Well first and foremost I do not accept the concept of IP in the first place, Information is not property and should not be protected. Nor or they "my competition" they might be cisco, but I do not support nationalism, or protectionism. Let me Guess, your a Trump Supporter?

How do you get from admitting Chinese use spies to rob American companies of R&D to thinking anyone avoiding that is a Trump supporter? You have a powerful imagination or loose standards of logic to make a leap like that.

More like a company acting in rational self-interest should keep any IP they depend on away from the Chinese. Or expect to be cloned but leverage them and dominate their market as much as possible before displaced by homegrown offering.

Re: Yubico: Secure Hardware vs. Open Source

#112

Post by xaduha » Wed, May 18, 2016, 11:42 AM UTC

mindslight wrote: post #106

xaduha wrote: post #70

Earlier quoted context omitted.

> The best way to show that you support open source is to buy the YubiKey NEO instead of the YubiKey 4. YubiKey NEO isn't a unique product, it's basically a cardreader and a java smartcard all-on-one, but there are plenty of vendors for both, it will probably can be even cheaper in some circumstances/regions. If you support open source, then give https://github.com/philipWendland/IsoApplet a look instead. A separate…

A feature the Yubi has over a smartcard is the button. You can get smartcard readers with pinpads etc, but not that fit into an Expresscard slot. I was pretty close to getting a Yubi, until I realized that the default version couldn't modify the PGP applet, and didn't find exactly where to order the special "developer edition" either. At this point it probably makes more sense to find/make a dongle based on an STM32…

You can still have pin protected stuff, both Security Officer and ordinary user can have them, it's a part of PKCS #11 standard probably. Also, we were talking about Neo.

To me it makes more sense not to do crypto yourself, but trust in an established technology, which is a smartcard. They are used everywhere from sim cards to chip-and-pin credit cards.

Re: Yubico: Secure Hardware vs. Open Source

#113

Post by mindslight » Wed, May 18, 2016, 4:29 PM UTC

xaduha wrote: post #112

mindslight wrote: post #106

Earlier quoted context omitted.

A feature the Yubi has over a smartcard is the button. You can get smartcard readers with pinpads etc, but not that fit into an Expresscard slot. I was pretty close to getting a Yubi, until I realized that the default version couldn't modify the PGP applet, and didn't find exactly where to order the special "developer edition" either. At this point it probably makes more sense to find/make a dongle based on an STM32…

You can still have pin protected stuff, both Security Officer and ordinary user can have them, it's a part of PKCS #11 standard probably. Also, we were talking about Neo. To me it makes more sense not to do crypto yourself, but trust in an established technology, which is a smartcard. They are used everywhere from sim cards to chip-and-pin credit cards.

Sure, but smartcards have traditionally fulfilled a narrow purpose - creating a notion of non-cloneable identity for some centralized top-down entity. The technology of a hardened mini computer could be applied to many other things, but the closed philosophy of the industry really hinders that. I'd love to get some samples of ST23 and create a board with an appropriate hardware UI for end-user signing, but alas this industry has not seen the light of Kerckhoff's principle.

My problem with PINs is twofold. First, the reader required to use them in a transparent manner does not fit with the form factor of a laptop. Second, they're obviously less secure than a passphrase - relying completely on hardened hardware. If I'm willing to enter a passphrase for every session, why should I be carrying around the key in the clear?

Re: Yubico: Secure Hardware vs. Open Source

#114

Post by amluto » Wed, May 18, 2016, 5:13 PM UTC

stijnhoop wrote: post #109

ctz wrote: post #71

Earlier quoted context omitted.

> With SGX, Intel had the chance to offer a widely available security token (built in to every new CPU!) that anyone could freely program and use for their own security purposes. They blew it when they created their "launch control" policy Now rescinded.

Could you detail that with a link to this news?

The Intel SDM, Volume 3, version 058 has a new set of MSRs called IA32_SGXLEPUBKEYHASH along with a new feature control bit for them. The intended policy is not specified anywhere that I can see, nor can I find any PR announcement or whitepaper. I also don't know what CPU generation will support that feature.