Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yubico: Secure Hardware vs. Open Source

yubico.com

Post reply on HN
Print view View original

71–80 of 114 posts

Re: Yubico: Secure Hardware vs. Open Source

#71

Post by ctz »

amluto wrote: post #22

I thought about this for awhile, and here are my thoughts about having the source code: With the older YubiKey NEO devices, the applet source was available and I could freely upload an applet. This was great for a few reasons. I could modify or upgrade the app (of course, doing so would cause me to lose existing keys, which makes sense from a security PoV). (I actually did this on my old YubiKey.) I could also, in pr…

> With SGX, Intel had the chance to offer a widely available security token (built in to every new CPU!) that anyone could freely program and use for their own security purposes. They blew it when they created their "launch control" policy

Now rescinded.

Re: Yubico: Secure Hardware vs. Open Source

#72

Post by mpeg »

davideous wrote: post #39
discreditable wrote: post #23

Earlier quoted context omitted.

> disabling user-loading of new firmware Am I understanding correctly that these devices can never have their firmware updated? That there is no update mechanism seems insane. They could prevent bad firmware updates by wiping keys on upgrade. The risk now is that some firmware version is discovered to have flaws, and that device is vulnerable forever.

> They could prevent bad firmware updates by wiping keys on upgrade This does not close the attack vector of someone intercepting the device before you get it and surreptitiously installing firmware with a backdoor.

And then you are fucked because you can't update the firmware to the trusted, signed open source version.

Re: Yubico: Secure Hardware vs. Open Source

#73

Post by uola »

xaduha wrote: post #70
uola wrote: post #51

Earlier quoted context omitted.

"They clearly changed stance to ensure users cannot play with the hardware" As per the statement (and earlier statements) you can't change the firmware unless you have a yubikey neo developer edition, which was only sold during 2012 and 2013. The change here is that the yubikey 4 doesn't run open source code (for the pgp part) as a result of changing platforms. The best way to show that you support open source is to…

> The best way to show that you support open source is to buy the YubiKey NEO instead of the YubiKey 4. YubiKey NEO isn't a unique product, it's basically a cardreader and a java smartcard all-on-one, but there are plenty of vendors for both, it will probably can be even cheaper in some circumstances/regions. If you support open source, then give https://github.com/philipWendland/IsoApplet a look instead. A separate…

It's a unique product in the sense that it has nice form factor and holds additional functionality for more main stream uses. I have a number of these devices, including the external card reader, the usb key card reader and the integrated rubber usb key. Everyone can decide what they want of course, just don't be surprised when they discontinue the NEO.

If you read between the lines of how it went from closed, to very open, to less open, to now not open at all. It seems like they tried open source but failed. They were probably looking for people to integrate it into some e-mail client, chat application or even bitcoin wallet. Now they've gone back to focus on their core customer and using a cheaper more integrated chip.

Re: Yubico: Secure Hardware vs. Open Source

#74

Post by xaduha »

uola wrote: post #73
xaduha wrote: post #70

Earlier quoted context omitted.

> The best way to show that you support open source is to buy the YubiKey NEO instead of the YubiKey 4. YubiKey NEO isn't a unique product, it's basically a cardreader and a java smartcard all-on-one, but there are plenty of vendors for both, it will probably can be even cheaper in some circumstances/regions. If you support open source, then give https://github.com/philipWendland/IsoApplet a look instead. A separate…

It's a unique product in the sense that it has nice form factor and holds additional functionality for more main stream uses. I have a number of these devices, including the external card reader, the usb key card reader and the integrated rubber usb key. Everyone can decide what they want of course, just don't be surprised when they discontinue the NEO. If you read between the lines of how it went from closed, to ver…

Point being that if you support open-source, then Yubico isn't your champion. They failed in sense that it harms their business, not much more than that.

> just don't be surprised when they discontinue the NEO.

I'd say that Yubico isn't a big deal, therefore them discontinuing NEO isn't a big deal either.

Re: Yubico: Secure Hardware vs. Open Source

#75

Post by mtgx »

tadfisher wrote: post #36
colemickens wrote: post #32

Earlier quoted context omitted.

None of which precludes the implementation from being open source. In fact, it just means that even if the software were open source, it would be near-meaningless since I can't verify the code running on the device and can't reflash it myself. "Youbico isn't saying that the security of the device is increased by keeping the source code secret." Yeah, they're not really saying anything other than trying to provide an…

If I'm reading the statement correctly, they are unable to release the source due to an NDA with their hardware provider, which is at least a reason other than "it's not software under the Free Software definition".

What would be the purpose of an NDA with the hardware provider? Surely not to hide it from GCHQ/NSA?! I imagine a company like Yubico has all of its employees on GCHQ/NSA lists and may even have cell tower simulators outside of its offices.

The NDA makes this even more suspicious. Who's the hardware provider? Huawei?

Re: Yubico: Secure Hardware vs. Open Source

#76

Post by ansible »

While it is good that they are implementing all these hardware security features, I think that we are in general over thinking the whole thing.

Their current industrial design very clearly says "hey, I am an important security key", which is exactly the wrong thing to do.

It should instead look like a cheap flash drive. And when the thief plugs it in, he sees exactly that, a low capacity USB flash drive, unencrypted, with some random documents on it.

Is the thief at this point going to perform some sophisticated hardware hacking? No, it will just get thrown away.

Re: Yubico: Secure Hardware vs. Open Source

#77

Post by uola »

xaduha wrote: post #74
uola wrote: post #73

Earlier quoted context omitted.

It's a unique product in the sense that it has nice form factor and holds additional functionality for more main stream uses. I have a number of these devices, including the external card reader, the usb key card reader and the integrated rubber usb key. Everyone can decide what they want of course, just don't be surprised when they discontinue the NEO. If you read between the lines of how it went from closed, to ver…

Point being that if you support open-source, then Yubico isn't your champion. They failed in sense that it harms their business, not much more than that. > just don't be surprised when they discontinue the NEO. I'd say that Yubico isn't a big deal, therefore them discontinuing NEO isn't a big deal either.

If you care about crypto you should probably care what happens to the most appealing device out there and if you care about open source you should probably care what happens to companies that makes open sourcing part of their business.

Re: Yubico: Secure Hardware vs. Open Source

#78

Post by dfox »

rcthompson wrote: post #66
vbernat wrote: post #63

Earlier quoted context omitted.

The read-only copy could be different from the running copy.

If you trust the hardware enough to use it for 2-factor authentication, then I think you trust it enough to be honest with you about its contents.

The problem there is that in usual case, the read-only access to software will not be provided directly by the hardware, but by the same software you are trying to verify.

In theory, this could be solved by verifying whole memory of the device, but that still depend on you believing that the device does not have more memory than what it should have.

Re: Yubico: Secure Hardware vs. Open Source

#79

Post by xaduha »

uola wrote: post #77
xaduha wrote: post #74

Earlier quoted context omitted.

Point being that if you support open-source, then Yubico isn't your champion. They failed in sense that it harms their business, not much more than that. > just don't be surprised when they discontinue the NEO. I'd say that Yubico isn't a big deal, therefore them discontinuing NEO isn't a big deal either.

If you care about crypto you should probably care what happens to the most appealing device out there and if you care about open source you should probably care what happens to companies that makes open sourcing part of their business.

This is getting nowhere, so let's stop. It's one of those "let's agree to disagree" moments. I certainly don't find yubikey particularly appealing and you already said that they "failed" when it comes to open-source, which I agreed with.

Re: Yubico: Secure Hardware vs. Open Source

#80

Post by yc-kraln »

mtgx wrote: post #75
tadfisher wrote: post #36

Earlier quoted context omitted.

If I'm reading the statement correctly, they are unable to release the source due to an NDA with their hardware provider, which is at least a reason other than "it's not software under the Free Software definition".

What would be the purpose of an NDA with the hardware provider? Surely not to hide it from GCHQ/NSA?! I imagine a company like Yubico has all of its employees on GCHQ/NSA lists and may even have cell tower simulators outside of its offices. The NDA makes this even more suspicious. Who's the hardware provider? Huawei?

NXP makes you sign an NDA to use their secure stuff.

The purpose is anti-competitive, preventing NXP's competitors from learning how the devices work. These devices often have advanced hardware and firmware countermeasures.

The secure modules are considered weapons technology if they're allowed to be updated after sale; the company is responsible for tracking each one, they're impossible to ship overseas, etc.

It's not suspicious, it's SOP. Choose between open and secure, or make your own silicon.

Post reply on HN