1–9 of 9 posts
Github:https://github.com/TheEleventhAvatar/Anchor
And also do they not get saved in logs like dmesg?
To call this "security" is funny in my opinion, can't any application also fetch the serial number? And also do they not get saved in logs like dmesg?
To call this "security" is funny in my opinion, can't any application also fetch the serial number? And also do they not get saved in logs like dmesg?
Was recently watching a video on the RFID tags that Bambu Labs use on their spools and not only is the tag data encrypted, it's signed so even if you bypass the encryption, you still don't have a way to spoof the signature.
This is so, so much worse than that though, because the code doesn't even do what the AI-hallucinated documentation describes, because as far as I can tell the actual "serial number" is returned by the following line: Ok(Some(format!("{:?}", device.product_id()))) So the "serial number" is actually the USB product id, which generally corresponds to the "model", not even unique per-device. So you didn't even test this with multiple identical flash drives.
To call this "security" is funny in my opinion, can't any application also fetch the serial number? And also do they not get saved in logs like dmesg?
You could also use encrypted and signed keys on the devices to confirm that it's the correct drive. Was recently watching a video on the RFID tags that Bambu Labs use on their spools and not only is the tag data encrypted, it's signed so even if you bypass the encryption, you still don't have a way to spoof the signature.
One of the whole points of authenticator devices is that the actual key material isn't directly readable. You shouldn't be able to trivially reproduce the device.
Calling this "hardware-based security" is somewhere between disingenuous and dangerously naive. Hardware-based security normally implies hardware with a dedicated secure element with cryptographic identities which are impossible to spoof. Security based on USB serial numbers can be defeated by any adversarial device claiming to use the same serial device as a device you have registered. There's no secure signatures o…
Calling this "hardware-based security" is somewhere between disingenuous and dangerously naive. Hardware-based security normally implies hardware with a dedicated secure element with cryptographic identities which are impossible to spoof. Security based on USB serial numbers can be defeated by any adversarial device claiming to use the same serial device as a device you have registered. There's no secure signatures o…
How else would you recover from a device failure?
Calling this "hardware-based security" is somewhere between disingenuous and dangerously naive. Hardware-based security normally implies hardware with a dedicated secure element with cryptographic identities which are impossible to spoof. Security based on USB serial numbers can be defeated by any adversarial device claiming to use the same serial device as a device you have registered. There's no secure signatures o…
How else would you recover from a device failure?
This is normal to do for yubikeys, for example.
The main point is that the secrets stored on the device are usually used to unlock other secrets stored elsewhere, and so themselves don't need to be synchronized often.