5 ms·

I want a small hardware, non-connected tablet that acts exclusively as a password manager. It connects to the computer I'm using as a USB keyboard device and on

by zwp 11y ago

I want a small hardware, non-connected tablet that acts exclusively as a password manager. It connects to the computer I'm using as a USB keyboard device and only "types" a password when I physically tell it to ("yubikey on steroids"). Backups and system updates via flash card with encrypted filesystem. No wifi, no bluetooth, no phone, no ethernet, no other purpose. Edit: heh, that's funny, you edited your comment as I was replying? Now we just need someone to build it for us :)

scintill76 11y ago
Haha, I also thought your comment was a response to what I edited-in about my hardware idea, but yes, we must have been writing it at the same time. When Bitcoin hardware wallets were first getting developed, I wondered why people didn't just start with open, barebones commodity hardware like you've described. Well, I suppose one reason may be that it may not exist, but it seems like it should be pretty cheap to pay some low-end Android manufacturer to remove a few features from their design. Or maybe you even buy "normal" hardware and strip out radios. At some level, the wallet manufacturers are all trusting someone, as I don't think any have designed their own low-level components. Anyway, maybe I will revisit that idea to see if a suitable locked-down, easy-to-hack, super-cheap device is available, as I agree that cutting all unnecessary comms is a good idea.
- TazeTSchnitzel 11y ago
  For radio-free hardware, what about a Palm Pilot? Only has IrDA.
  - i336_ 11y ago
    A couple of them had Bluetooth. The only 68k-based one with builtin Wi-Fi was the AlphaSmart Dana, a writer's keyboard. You're very very unlikely going to want to type a truly secure (= long) password over and over and over, which you'd need to do in a situation where the browser's password manager is turned off, and/or a website disables password caching anyway. The Palm m5xx series could solve this problem: it had full USB, and I once read of an Palm app (like any other) that bridged the m5xx's SD slot to behave like a block device over USB, ie it turned the Palm into a USB SD card reader. That means there's a raw USB SDK out there, and adding HID keyboard support wouldn't be too hard (no kernel driver development etc). Getting passwords into the device would be nontrivial; Palm keyboards are proprietary to the series they were made for, with a few arbitrary connector updates thrown in for good measure (think iPhone docking connector saga). If the password is irritating enough to repeatedly type on a full keyboard, it would take you a good 5 minutes (and a punching bag, for afterwards) to get it into the PDA, Graffiti and custom keyboards taken into account. I think it would work out though: if the only way to get data out of the device is to tap something on its screen, that should be enough of a brick wall to dissuade would-be attackers. I guess I'm responding to this so enthusiastically because it's about Palm :P - I unfortunately never owned one of these awesome little things, but I'd love something of similar capabilities built using today's tech. With modern advances in power consumption, like MemoryLCD, micropower CPUs, short-range bluetooth, etc, the result would probably last literally weeks. It'd be enormous fun to hack on, too, and carve out a little niche for itself. :) I wonder if I should Ask HN if this would be a good idea.
    - a3n 11y ago
      > I wonder if I should Ask HN if this would be a good idea. 3. Ask HN ask HN: Should I ask HN if a Palm Pilot keyboard would be a good password manager? 1 point by i336_ 1 minute ago | flag | past | web | discuss
      - i336_ 11y ago
        Point taken; that was the wrong way to say it :P Also, to clarify - and I should've qualified what I meant, but tiredness is such an unhelpful thing at times - this is a genuinely interesting-sounding idea (as I noted to the other reply at this comment depth), but the paragraph at the bottom was kind of an independent thing. I've always wanted to tinker around with a handheld, reasonably nice-looking device with similar specs to a Palm. Sort of like the TI watch (http://processors.wiki.ti.com/index.php/EZ430-Chronos http://processors.wiki.ti.com/index.php/EZ430-Chronos), but a PDA equivalent.
    - Vendan 11y ago
      Just make something like a usb Rubber Ducky with a couple buttons and a screen. Plug it in, scroll to password, hit "type it", and it types it in. Could probably make one for about $40. Arduino Leonardo, LCD Shield, and the leonardo keyboard libraries. Could even have it as a full password generator too.
      - i336_ 11y ago
        That actually sounds like a really, really good idea. Although... I just started thinking about the possibility of using a microcontroller that had a tiny bit of internal, non-reprogrammable ROM, so I could implement a secure stage-0 loader... lol
        Vendan 11y ago
        meh, that seems like a protection against physical access, if all else is done correctly, and you are screwed at that point. In other news, I just placed an order for the parts for my prototype, so I'll be putting that together this weekend. Fun thing: If done correctly, it should work with most android phones, as they do understand usb hid keyboards. As a result, final design may end up with a very small lithium battery to allow it to run when connected to a phone that doesn't offer much power. I'll put a blog somewhere and post an update to https://twitter.com/andy_leap https://twitter.com/andy_leap as I work on it.
reefab 11y ago
This exists: https://hackaday.io/project/86-mooltipass https://hackaday.io/project/86-mooltipass
- scintill76 11y ago
  Cool, thanks! It's funny that I and other potential target audience members here, were apparently unaware of this; the internet is a big place. It's a bit too expensive for me, I think -- at least the pre-assembled version. I may steal the smartcard idea, though (or some other form of hardware security.) It might be possible to coerce a phone's SIM slot into serving as an interface to a card.
Kliment 11y ago
Hey, I'd be willing to build such a thing. Open source hardware and software and all. Email me at kliment@0xfb.com
- Vendan 11y ago
  heh, I'm interested too, what kinda hardware would you use?

by zwp 11y ago

scintill76 11y ago

Haha, I also thought your comment was a response to what I edited-in about my hardware idea, but yes, we must have been writing it at the same time. When Bitcoin hardware wallets were first getting developed, I wondered why people didn't just start with open, barebones commodity hardware like you've described. Well, I suppose one reason may be that it may not exist, but it seems like it should be pretty cheap to pay some low-end Android manufacturer to remove a few features from their design. Or maybe you even buy "normal" hardware and strip out radios. At some level, the wallet manufacturers are all trusting someone, as I don't think any have designed their own low-level components. Anyway, maybe I will revisit that idea to see if a suitable locked-down, easy-to-hack, super-cheap device is available, as I agree that cutting all unnecessary comms is a good idea.

TazeTSchnitzel 11y ago
For radio-free hardware, what about a Palm Pilot? Only has IrDA.
- i336_ 11y ago
  A couple of them had Bluetooth. The only 68k-based one with builtin Wi-Fi was the AlphaSmart Dana, a writer's keyboard. You're very very unlikely going to want to type a truly secure (= long) password over and over and over, which you'd need to do in a situation where the browser's password manager is turned off, and/or a website disables password caching anyway. The Palm m5xx series could solve this problem: it had full USB, and I once read of an Palm app (like any other) that bridged the m5xx's SD slot to behave like a block device over USB, ie it turned the Palm into a USB SD card reader. That means there's a raw USB SDK out there, and adding HID keyboard support wouldn't be too hard (no kernel driver development etc). Getting passwords into the device would be nontrivial; Palm keyboards are proprietary to the series they were made for, with a few arbitrary connector updates thrown in for good measure (think iPhone docking connector saga). If the password is irritating enough to repeatedly type on a full keyboard, it would take you a good 5 minutes (and a punching bag, for afterwards) to get it into the PDA, Graffiti and custom keyboards taken into account. I think it would work out though: if the only way to get data out of the device is to tap something on its screen, that should be enough of a brick wall to dissuade would-be attackers. I guess I'm responding to this so enthusiastically because it's about Palm :P - I unfortunately never owned one of these awesome little things, but I'd love something of similar capabilities built using today's tech. With modern advances in power consumption, like MemoryLCD, micropower CPUs, short-range bluetooth, etc, the result would probably last literally weeks. It'd be enormous fun to hack on, too, and carve out a little niche for itself. :) I wonder if I should Ask HN if this would be a good idea.
  - a3n 11y ago
    > I wonder if I should Ask HN if this would be a good idea. 3. Ask HN ask HN: Should I ask HN if a Palm Pilot keyboard would be a good password manager? 1 point by i336_ 1 minute ago | flag | past | web | discuss
    - i336_ 11y ago
      Point taken; that was the wrong way to say it :P Also, to clarify - and I should've qualified what I meant, but tiredness is such an unhelpful thing at times - this is a genuinely interesting-sounding idea (as I noted to the other reply at this comment depth), but the paragraph at the bottom was kind of an independent thing. I've always wanted to tinker around with a handheld, reasonably nice-looking device with similar specs to a Palm. Sort of like the TI watch (http://processors.wiki.ti.com/index.php/EZ430-Chronos http://processors.wiki.ti.com/index.php/EZ430-Chronos), but a PDA equivalent.
  - Vendan 11y ago
    Just make something like a usb Rubber Ducky with a couple buttons and a screen. Plug it in, scroll to password, hit "type it", and it types it in. Could probably make one for about $40. Arduino Leonardo, LCD Shield, and the leonardo keyboard libraries. Could even have it as a full password generator too.
    - i336_ 11y ago
      That actually sounds like a really, really good idea. Although... I just started thinking about the possibility of using a microcontroller that had a tiny bit of internal, non-reprogrammable ROM, so I could implement a secure stage-0 loader... lol
      - Vendan 11y ago
        meh, that seems like a protection against physical access, if all else is done correctly, and you are screwed at that point. In other news, I just placed an order for the parts for my prototype, so I'll be putting that together this weekend. Fun thing: If done correctly, it should work with most android phones, as they do understand usb hid keyboards. As a result, final design may end up with a very small lithium battery to allow it to run when connected to a phone that doesn't offer much power. I'll put a blog somewhere and post an update to https://twitter.com/andy_leap https://twitter.com/andy_leap as I work on it.

reefab 11y ago

This exists: https://hackaday.io/project/86-mooltipass https://hackaday.io/project/86-mooltipass

scintill76 11y ago
Cool, thanks! It's funny that I and other potential target audience members here, were apparently unaware of this; the internet is a big place. It's a bit too expensive for me, I think -- at least the pre-assembled version. I may steal the smartcard idea, though (or some other form of hardware security.) It might be possible to coerce a phone's SIM slot into serving as an interface to a card.

Kliment 11y ago

Hey, I'd be willing to build such a thing. Open source hardware and software and all. Email me at kliment@0xfb.com

Vendan 11y ago
heh, I'm interested too, what kinda hardware would you use?