Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yubico: Secure Hardware vs. Open Source

yubico.com

Post reply on HN
Print view View original

31–40 of 114 posts

Re: Yubico: Secure Hardware vs. Open Source

#31

Post by foxhill »

well, it's a shame that poor arguments get recycled like this, but it does make for easy dismissal - cryptography is based off of the idea that the methods used totally transparent, the power to decrypt comes from possession of the appropriate keys. by closing a design, hiding it from scrutiny from the majority of hackers like ourselves, helps no one other than the individuals who wish to gain unauthorised/unwanted access.

this is a fundamental concept in FOSS and for anyone to try and rationalise their way out of it - be it out of some corrupted sense of trying to do the right thing - is absurd.

fortunately i feel that the very people that would be interested in this device will be aware of this; i hope the folks at yubico reverse this decision.

Re: Yubico: Secure Hardware vs. Open Source

#32

Post by colemickens »

davideous wrote: post #11

In discussions like this the phrase "security by obscurity" gets used as an accusation. We all agree "security by obscurity" does not work. But that's not what is happening here. Wikipedia's definition: "the reliance on the secrecy of the design or implementation as the main method of providing security for a system or component of a system." Youbico isn't saying that the security of the device is increased by keepin…

None of which precludes the implementation from being open source. In fact, it just means that even if the software were open source, it would be near-meaningless since I can't verify the code running on the device and can't reflash it myself.

"Youbico isn't saying that the security of the device is increased by keeping the source code secret."

Yeah, they're not really saying anything other than trying to provide an excuse for why they won't release it. "You can't use it anyway" isn't much of a response (I actually find it rather patronizing and dismissive).

Not to pile on, but regarding: "Engineering is always full of trade-offs."... what exactly is the supposed trade off here? (Maybe they're using licensed code that they can't redistrib?)

Re: Yubico: Secure Hardware vs. Open Source

#33

Post by eggy »

I am pleased they took the time to respond in length. It makes a bit more sense now (NDAs, hardware manufacturers, etc...) vs. the 'security by obscurity' mantra prevalent in the replies.

I have had my own business, and the one thing I would say to the critics of Yubico: If you have a way, given existing hardware and software tools and suppliers, to do a better job, step up and do it. AFAIK, Apple didn't opensource their hardware related to crypto, or their software.

I think you will find it takes more than wishful thinking; more like, put your money ( = or your time) where your mouth is. Engineers, and I don't just mean CI engineers here, know it is a long way from a math equation or set of equations to a real world working object. I would love to see, and I would contribute money to an opensource solution. I just don't think it is as cookie-cutter simple as the majority of comments seem to intimate on this forum.

Re: Yubico: Secure Hardware vs. Open Source

#34

Post by na85 »

colemickens wrote: post #32
davideous wrote: post #11

In discussions like this the phrase "security by obscurity" gets used as an accusation. We all agree "security by obscurity" does not work. But that's not what is happening here. Wikipedia's definition: "the reliance on the secrecy of the design or implementation as the main method of providing security for a system or component of a system." Youbico isn't saying that the security of the device is increased by keepin…

None of which precludes the implementation from being open source. In fact, it just means that even if the software were open source, it would be near-meaningless since I can't verify the code running on the device and can't reflash it myself. "Youbico isn't saying that the security of the device is increased by keeping the source code secret." Yeah, they're not really saying anything other than trying to provide an…

There's a market disruption opportunity here. Carpe consumer base.

Re: Yubico: Secure Hardware vs. Open Source

#35

Post by davideous »

colemickens wrote: post #32
davideous wrote: post #11

In discussions like this the phrase "security by obscurity" gets used as an accusation. We all agree "security by obscurity" does not work. But that's not what is happening here. Wikipedia's definition: "the reliance on the secrecy of the design or implementation as the main method of providing security for a system or component of a system." Youbico isn't saying that the security of the device is increased by keepin…

None of which precludes the implementation from being open source. In fact, it just means that even if the software were open source, it would be near-meaningless since I can't verify the code running on the device and can't reflash it myself. "Youbico isn't saying that the security of the device is increased by keeping the source code secret." Yeah, they're not really saying anything other than trying to provide an…

I think if they released the source, but you weren't able to reflash the device (which is a design trade-off they chose to close some attack vendors), people would be up-in-arms and saying "it's not true open source because I can't re-flash or verify the device."

Re: Yubico: Secure Hardware vs. Open Source

#36

Post by tadfisher »

colemickens wrote: post #32
davideous wrote: post #11

In discussions like this the phrase "security by obscurity" gets used as an accusation. We all agree "security by obscurity" does not work. But that's not what is happening here. Wikipedia's definition: "the reliance on the secrecy of the design or implementation as the main method of providing security for a system or component of a system." Youbico isn't saying that the security of the device is increased by keepin…

None of which precludes the implementation from being open source. In fact, it just means that even if the software were open source, it would be near-meaningless since I can't verify the code running on the device and can't reflash it myself. "Youbico isn't saying that the security of the device is increased by keeping the source code secret." Yeah, they're not really saying anything other than trying to provide an…

If I'm reading the statement correctly, they are unable to release the source due to an NDA with their hardware provider, which is at least a reason other than "it's not software under the Free Software definition".

Re: Yubico: Secure Hardware vs. Open Source

#37

Post by davideous »

sigmar wrote: post #30
pritambaral wrote: post #25

Earlier quoted context omitted.

I think what Yubico meant is that they aren't closing code for the sake of closing code, but since it can't be loaded onto the devices anyway, there's no need for the code to remain open.

Oh. Now I'm reading davideous' comment much differently. But the title of the blog post (ie "vs") makes it seem like they aren't making it open source so that the hardware is secure.

Yes, pritambaral described what I'm trying to point-out.

In think the "vs" in the title is saying this: they had to choose between open source (that is functional meaning you can really use the code and re-flash the device) and the secure hardware. It was a trade off of one "vs" the other, and this is their reasoning behind that trade-off.

Re: Yubico: Secure Hardware vs. Open Source

#38

Post by grawlinson »

nickpsecurity wrote: post #27
the_ancient wrote: post #19

Earlier quoted context omitted.

>>Cisco and mobile manufacturers vs Huwei to see how big of a market share that can lead to. Implying the Huawei is the "cheap knock off" and Cisco/Apple/Samsung/etc are the noble high quality product fighting the good fight.... My Hauwei Nexus 6P has been the best phone I have ever owned, far exceeding the quality and usability of every Motorola, Samsung, and other phones I have owned. As to Cisco, after their fasco…

That's an accusation and implication. The Chinese strategy, which isn't entirely secret, is to use their hackers to get trade secrets out of firms in all kinds of sectors to hand to their own firms. Each time, their firms leverage those as a head start on their own products which combine their own innovations, labor advantage, and money from vast market in China. It's a proven model. Far as Cisco and Samsung, it's be…

The NSA does the same thing for American business.

http://www.economist.com/node/1842124 http://money.cnn.com/2015/04/30/news/airbus-germany-nsa-spyi...

Re: Yubico: Secure Hardware vs. Open Source

#39

Post by davideous »

discreditable wrote: post #23
davideous wrote: post #11

In discussions like this the phrase "security by obscurity" gets used as an accusation. We all agree "security by obscurity" does not work. But that's not what is happening here. Wikipedia's definition: "the reliance on the secrecy of the design or implementation as the main method of providing security for a system or component of a system." Youbico isn't saying that the security of the device is increased by keepin…

> disabling user-loading of new firmware Am I understanding correctly that these devices can never have their firmware updated? That there is no update mechanism seems insane. They could prevent bad firmware updates by wiping keys on upgrade. The risk now is that some firmware version is discovered to have flaws, and that device is vulnerable forever.

> They could prevent bad firmware updates by wiping keys on upgrade

This does not close the attack vector of someone intercepting the device before you get it and surreptitiously installing firmware with a backdoor.

Re: Yubico: Secure Hardware vs. Open Source

#40

Post by pstrateman »

tadfisher wrote: post #36
colemickens wrote: post #32

Earlier quoted context omitted.

None of which precludes the implementation from being open source. In fact, it just means that even if the software were open source, it would be near-meaningless since I can't verify the code running on the device and can't reflash it myself. "Youbico isn't saying that the security of the device is increased by keeping the source code secret." Yeah, they're not really saying anything other than trying to provide an…

If I'm reading the statement correctly, they are unable to release the source due to an NDA with their hardware provider, which is at least a reason other than "it's not software under the Free Software definition".

You are indeed reading their statement correctly.
Post reply on HN