Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yubico: Secure Hardware vs. Open Source

yubico.com

Post reply on HN
Print view View original

81–90 of 114 posts

Re: Yubico: Secure Hardware vs. Open Source

#81

Post by kriro »

tl;dr: code is closed and I can't change it anyway so it shouldn't matter to me.

I hope the response from consumers will be: we understand your position. Unfortunately that is unacceptable and we'll look for another vendor. It is mine. I own a Neo, not getting any of their future products.

Also as a strategic guideline...maybe if you're in the business of security...don't use hardware that requires NDAs. Yes it'll make it impossible to do some stuff and more expensive to do some stuff but I'd say there's really no option to compromise.

Re: Yubico: Secure Hardware vs. Open Source

#82

Post by leni536 »

dfox wrote: post #78
rcthompson wrote: post #66

Earlier quoted context omitted.

If you trust the hardware enough to use it for 2-factor authentication, then I think you trust it enough to be honest with you about its contents.

The problem there is that in usual case, the read-only access to software will not be provided directly by the hardware, but by the same software you are trying to verify. In theory, this could be solved by verifying whole memory of the device, but that still depend on you believing that the device does not have more memory than what it should have.

> the read-only access to software will not be provided directly by the hardware, but by the same software you are trying to verify. Why not?

Re: Yubico: Secure Hardware vs. Open Source

#83

Post by drazvan »

xaduha wrote: post #70
uola wrote: post #51

Earlier quoted context omitted.

"They clearly changed stance to ensure users cannot play with the hardware" As per the statement (and earlier statements) you can't change the firmware unless you have a yubikey neo developer edition, which was only sold during 2012 and 2013. The change here is that the yubikey 4 doesn't run open source code (for the pgp part) as a result of changing platforms. The best way to show that you support open source is to…

> The best way to show that you support open source is to buy the YubiKey NEO instead of the YubiKey 4. YubiKey NEO isn't a unique product, it's basically a cardreader and a java smartcard all-on-one, but there are plenty of vendors for both, it will probably can be even cheaper in some circumstances/regions. If you support open source, then give https://github.com/philipWendland/IsoApplet a look instead. A separate…

Feitian has a similar product with known keys and running JavaCard in the form of an USB token - http://www.ftsafe.com/product/epass/eJavaToken . Also much cheaper than the Yubikey, see http://javacardos.com/store/smartcard_eJavaToken.php . No NXP proprietary stuff on it and no NDA required either.

Re: Yubico: Secure Hardware vs. Open Source

#84

Post by drazvan »

BTW, the two major manufacturers they're talking about are NXP (http://www.nxp.com/) and Infineon (http://www.infineon.com/). STMicroelectonics (http://www.st.com/) is also a player here and Feitian has also started doing it (http://www.ftsafe.com/product/epass/eJavaToken). NXP and Infineon are notoriously hard to get started with for small companies and independent developers but they have some very clever proprietary stuff in their chips.

Re: Yubico: Secure Hardware vs. Open Source

#85

Post by BuildTheRobots »

zobzu wrote: post #46
davideous wrote: post #11

In discussions like this the phrase "security by obscurity" gets used as an accusation. We all agree "security by obscurity" does not work. But that's not what is happening here. Wikipedia's definition: "the reliance on the secrecy of the design or implementation as the main method of providing security for a system or component of a system." Youbico isn't saying that the security of the device is increased by keepin…

This isnt about security. Its about its was open source before and user modifiable and it no longer is. You can force wipe on flash for example. They clearly changed stance to ensure users cannot play with the hardware and competitors cannot copy the code. Which is fine. But its always weird when the argument of security is used instead of being genuine. You can copy the freaking key by removing the plastic of the yu…

> You can copy the freaking key by removing the plastic of the yubikey4

Any more information available? googling for "yubikey 4 takeapart" got me nowhere.

Re: Yubico: Secure Hardware vs. Open Source

#86

Post by c2352466 »

amluto wrote: post #22

I thought about this for awhile, and here are my thoughts about having the source code: With the older YubiKey NEO devices, the applet source was available and I could freely upload an applet. This was great for a few reasons. I could modify or upgrade the app (of course, doing so would cause me to lose existing keys, which makes sense from a security PoV). (I actually did this on my old YubiKey.) I could also, in pr…

Attackers will just use the JTAG/Debug port and be done with it. They probably didn't even give it a single thought whether there is a vulnerability to exploit in the opensourced firmware.

The YubiKey NEO was always "unsecure" now with the YubiKey 4 it's only possibly "unsecure".

Re: Yubico: Secure Hardware vs. Open Source

#87

Post by xaduha »

drazvan wrote: post #83
xaduha wrote: post #70

Earlier quoted context omitted.

> The best way to show that you support open source is to buy the YubiKey NEO instead of the YubiKey 4. YubiKey NEO isn't a unique product, it's basically a cardreader and a java smartcard all-on-one, but there are plenty of vendors for both, it will probably can be even cheaper in some circumstances/regions. If you support open source, then give https://github.com/philipWendland/IsoApplet a look instead. A separate…

Feitian has a similar product with known keys and running JavaCard in the form of an USB token - http://www.ftsafe.com/product/epass/eJavaToken . Also much cheaper than the Yubikey, see http://javacardos.com/store/smartcard_eJavaToken.php . No NXP proprietary stuff on it and no NDA required either.

I did visit their site some weeks ago, but I'm not a fan of bundling a card reader with a card like that. It's better to buy a separate card reader, java cards themselves can go for as low as $2 each, maybe even cheaper.

NXP is just one of many vendors, they sell blank java cards too.

EDIT: $25 shipping fee is very inflexible.

Re: Yubico: Secure Hardware vs. Open Source

#88

Post by makomk »

mtgx wrote: post #75
tadfisher wrote: post #36

Earlier quoted context omitted.

If I'm reading the statement correctly, they are unable to release the source due to an NDA with their hardware provider, which is at least a reason other than "it's not software under the Free Software definition".

What would be the purpose of an NDA with the hardware provider? Surely not to hide it from GCHQ/NSA?! I imagine a company like Yubico has all of its employees on GCHQ/NSA lists and may even have cell tower simulators outside of its offices. The NDA makes this even more suspicious. Who's the hardware provider? Huawei?

Pretty much all of the providers of secure hardware are like this because they're all reliant on security by obscurity. They rely on keeping secret things like their instruction set, register locations, what countermeasures against intrusion they have, etc in order to make it harder for a hacker to compromise them.

Re: Yubico: Secure Hardware vs. Open Source

#89

Post by makomk »

vbernat wrote: post #63
rcthompson wrote: post #59

Couldn't a hardware vendor theoretically provide read-only access to the firmware and then have an open-source reproducible build process so that anyone can build their own copy of the firmware and verify that the firmware on the device is bit-for-bit identical? Wouldn't that satisfy people who want to be sure of what code is running on their device while still preventing an attacker from loading custom firmware?

The read-only copy could be different from the running copy.

The usual trick is to ensure that the firmware + user data fills all available storage space on the hardware so there's no room for other code, then add time limits and complexity to the verification code so they can't do any tricks with stuff like compression.

Re: Yubico: Secure Hardware vs. Open Source

#90

Post by mpnordland »

xaduha wrote: post #70
uola wrote: post #51

Earlier quoted context omitted.

"They clearly changed stance to ensure users cannot play with the hardware" As per the statement (and earlier statements) you can't change the firmware unless you have a yubikey neo developer edition, which was only sold during 2012 and 2013. The change here is that the yubikey 4 doesn't run open source code (for the pgp part) as a result of changing platforms. The best way to show that you support open source is to…

> The best way to show that you support open source is to buy the YubiKey NEO instead of the YubiKey 4. YubiKey NEO isn't a unique product, it's basically a cardreader and a java smartcard all-on-one, but there are plenty of vendors for both, it will probably can be even cheaper in some circumstances/regions. If you support open source, then give https://github.com/philipWendland/IsoApplet a look instead. A separate…

I use pgp on my mobile devices too, I would prefer something I could use for both my phone and my computer. The NEO would have filled that role. In my research I haven't found anything like that so far. I would love to be enlightened though if anyone knows about something that can do the same!
Post reply on HN