24 ms·
“I must, sadly, withdraw my endorsement of Yubikey 4 devices”
- fred_is_fred 10y agoI guess I should know this guy, but I don't. When I see the picture and a post on Google+ it hardly seems like something that I should take seriously. I know the fake mustache is there to show what a fun guy this is, but if you're posting something you want people to take seriously, post it seriously.
- sigmar 10y agoHe can put up whatever self picture he wants. It's social media
- lostgame 10y agoMakes me think I should don a tutu for my LinkedIn profile.
- pshc 10y agoHere is his very Serious LinkedIn where you may read his Serious resume, including endorsements by Serious men with suits and beards: https://ca.linkedin.com/in/mricon https://ca.linkedin.com/in/mricon
- jharger 10y agoThat's not Serious enough. He's outdoors wearing a hat and backpack.
- sp332 10y agoI guess you'll have to judge his comments on their merits instead of using "looks serious" as a proxy to determine whether he has a good point or not.
- dredmorbius 10y agoSpace alien cats have disclosed subsequently independently validated information over G+. Discounting sources strictly on where they post or how they present isn't necessarily valid, though a long history of unreliable information might be a strong impeachment of credibility. Greg K-H, as he's known, is the #2 Linux kernal developer, and release manager of stable. I disagree with him on some issues (ironically enough, the requirement for kernel dev submissions to have real name identities attached, also his attitudes toward choice generally and systemd specifically), but his information here warrants attention. Of course, you've just taken a space alien cat's word for this, but you're welcome to independently verify the information.
- nickysielicki 10y agoI've been looking into purchasing an OpenPGP card/stick for a while. Haven't yet pulled the plug. Here are some fully open Yubikey alternatives. https://www.sigilance.com/ https://www.sigilance.com/ https://www.nitrokey.com/ https://www.nitrokey.com/ http://www.seeedstudio.com/wiki/FST-01 http://www.seeedstudio.com/wiki/FST-01
- makomk 10y agoI actually ended up building my own OpenPGP stick a while ago using Gnuk: https://www.makomk.com/2016/01/23/openpgp-crypto-token-using-gnuk/ https://www.makomk.com/2016/01/23/openpgp-crypto-token-using... Should probably write it up properly sometime and maybe ask about getting support for my custom hardware merged upstream. (The official hardware's also open, but the case it's designed for was only available from the US and I'm not set up to solder QFN and 0402 parts. Not that fine-pitch TQFP is much fun either...)
- nickysielicki 10y agoThis is extremely cool, I think you should submit this as a Show HN.
- bruo 10y agoI have used nitrokeys and FST-01, the FST-01 beats the nitrokey in speed and in freedom, i currently use two of them, one with rsa 4096 and one with 25519 (for decryption you need libgcrypt 1.7). The nitrokey beats the FST-01 in the case, it's by default more weareable without need to make your own one. It seems there is a big plus when you use a board made by the person who makes gnuk which is the same person who makes the smartcard gnupg code.
- jans23 10y agoNitrokey Start uses GNUK 1.0 firmware and its hardware is very similar to FST-01. The microprocessor should be identical so that its performance should be identical too. This applies to Nitrokey Start only, the other models differ.
- beezle 10y agoThe problem with both Yubi and Nitro is that pin entry is by keyboard, not a secure pinpad.
- 05 10y agoThough you'd need both keyboard and display built in to verify what exactly it is that you're signing/allowing access to..
- api 10y agoDoor locks without displays are fine. I agree that some method of entering a PIN would be good since right now the PIN goes via the potentially-compromised computer. But you have the bulk problem... it's a tough industrial design problem.
- dogma1138 10y agoIf you don't trust the computer you are signing in from don't use a YubiKey or any other token. Tokens are fine to ensure that credentials cannot be easily compromised and to provide 2FA. PED security is really critical when the goal is to duplicate the token e.g. credit cards if your machine is compromised then any data protected by the Token can also be compromised as soon as you access it. When in doubt wipe, while it's nice to have a robust security stance in this case I don't think i would matter much.
- droffel 10y agoNot necessarily true, you can do it with just a display (and two buttons) like the Trezor does[1]. You can probably even omit the buttons using this model: 1. Send message to sign over the wire 2. Display message to sign on the device's screen 3. Send a message to continue or reject over the wire 4. Device displays scrambled pinpad 5. User enters PIN on the compromised computer, using a blinded pinpad (like the Trezor) 6. The blinded PIN is sent over the wire to the device 7. The device verifies the PIN, and if correct, signs the message displayed in step 2 8. The signed message is sent over the wire to the compromised device [1] https://doc.satoshilabs.com/trezor-user/enteringyourpin.html https://doc.satoshilabs.com/trezor-user/enteringyourpin.html
- tmikaeld 10y agoAh crap, why ruin something great just out of greed (What other reason could there be?) :-(
- danjoc 10y agoCould you elaborate on how this ruins the yubikey 4? As a security measure, the software on the YK4 cannot be updated. Therefore, the software in question could have essentially been implemented as hardware. It is hardwired and will never change. I can't find the reference, but since there's no software update functionality, I'm under the impression even Richard Stallman would be okay with it under these circumstances. Edit: Found it. https://stallman.org/stallman-computing.html https://stallman.org/stallman-computing.html "As for microwave ovens and other appliances, if updating software is not a normal part of use of the device, then it is not a computer. In that case, I think the user need not take cognizance of whether the device contains a processor and software, or is built some other way. However, if it has an "update firmware" button, that means installing different software is a normal part of use, so it is a computer." Straight from the big GNU's mouth.
- mpeg 10y agoI'm pretty certain RMS would advocate for both the hardware and the software being open.
- davorb 10y agoHere's his stance on the issue. > there is no need to reject hardware with nonfree designs on principle. http://www.wired.com/2015/03/need-free-digital-hardware-designs/ http://www.wired.com/2015/03/need-free-digital-hardware-desi...
- tadfisher 10y agoBecause he founded the Free Software Foundation, not the Free Products Foundation. At some point, you have to define the term "software" in order to focus your mission, and given the Four Freedoms that underpin the notion of Free Software, the current definition is apt. That's not to say that there isn't value in open hardware, and certainly it's not a bad idea to advocate for open designs. It's just not part of the FSF's mission.
- jc4p 10y agoWhile on the subject, does anyone know how to actually put a 4096 bit key on a Yubikey 4? I've been trying for months and their support is non-existent.
- nmikhailov 10y agoI had no problem with it, gpg --edit-key + keytocard worked flawlessly.
- jc4p 10y agoWeird, when I try keytocard it errors about the size of the key, but when I tried it with a 2048 bit key it worked fine
- nmikhailov 10y agoMaybe old gpg/scdaemon version? Mine is 2.1.11. I don't know what else could be wrong.
- confounded 10y agoYou need to use gpg2 explicitly (gpg 1.x and 2.x are under independent active development), e.g. `gpg2 --edit-key`.
- jc4p 10y agoAHA! Thanks, I'll try this later tonight!
- chinathrow 10y agoThey arw pulling a MakerBot.
- geofft 10y agoThis is about the code running on the YubiKey itself, not about the code to interact with it from a general-purpose computer? And if I'm reading the linked GitHub issue correctly, this is about a specific plugin that runs in a sandbox on the YubiKey NEO, where the main codebase of the NEO is still proprietary? I don't understand the advantage of it being open-source then, at least as far as security goes. (For user freedoms in practice, maybe.) What guarantee do you have that the code on the device matches the code on GitHub, or that the code on GitHub isn't subverted by other code on the device?
- JoshTriplett 10y ago> And if I'm reading the linked GitHub issue correctly, this is about a specific plugin that runs in a sandbox on the YubiKey NEO, where the main codebase of the NEO is still proprietary? No, it's the code for the new YubiKey 4, which has been closed off. > What guarantee do you have that the code on the device matches the code on GitHub Ideally, you can build and flash the firmware yourself.
- geofft 10y agoOops, that was unclear. What I meant was closer to "This is about a specific piece of functionality that, in the past, was an open-source sandboxed plugin on the YubiKey NEO, running inside the main NEO codebase, which was proprietary?" Could you have flashed the proprietary part of the NEO codebase yourself, or just the plugin?
- nmikhailov 10y ago> No, it's the code for the new YubiKey 4, which has been closed off. yk4 firmware was never released; that particular issue is about NEO's openpgp applet. >Ideally, you can build and flash the firmware yourself. You couldn't do that with NEO(except from early dev version) as global platfrom management keys are unknown, which makes it impossible to delete/upload applets. I actually tried to get dev. version but they redirected me to NXP who never answered.
- evanosaurus 10y agoYou can't flash the firmware yourself, as the keys are discarded as soon as they're generated per device. What you could do, however, is read the bits off of the firmware and make sure they're identical to the bits you make from source. Reproducible builds, and all that.
- awinter-py 10y agowhatever the conclusion here I'm very glad there are eyes on these devices. Is there a central clearinghouse for security audits of hardware / software? This is something the FOSS community can do much better than msft or even open source promoters like fb/goog, but not if the results are distributed on the experts' blogs and tumblrs.
- mgrennan 10y agoI've been disappointed in Yubico since I reported a Replay Attack, in their server, to them and Steve Gibson a couple of years ago. They gave now reply. Steve replied after a called him out publicly. I'm considering creating a like process based on the USB Rubber Ducky. I'm thinking simple one time pad. https://hakshop.myshopify.com/products/usb-rubber-ducky-deluxe?variant=353378649 https://hakshop.myshopify.com/products/usb-rubber-ducky-delu... 1s
- DKnoll 10y agoHave you seen the USB Armory? Seems like you would be interested. https://inversepath.com/usbarmory https://inversepath.com/usbarmory
- makomk 10y agoI've been disappointed in Yubico since I saw their advisory downplaying the bug in the original OpenPGP support which meant it didn't require a PIN to perform crypto operations (and of course, this can be done over the NFC interface too): https://developers.yubico.com/ykneo-openpgp/SecurityAdvisory%202015-04-14.html https://developers.yubico.com/ykneo-openpgp/SecurityAdvisory...
- dfc 10y agoI don't understand why you would call Steve Gibson out on this.[1] What is the connection between Yubico and Steve Gibson? [1]: For the sake of the discussion I will pretend he is a qualified to speak about security.
- fapjacks 10y agoLocked to contributors. Surprise!
- OJFord 10y agoFrom the Github issue [0]: > Further hostility against the company or our users will > not be tolerated in this forum, and will be met with > bans. Odd reaction. Especially when they've _changed_ from open to closed source, and what benefit is there, really, to a closed-source 'OpenPGP' implementation? They're looking for a profit, sure, but they're blessed to be a hardware company. It's not like I can just clone they're repo and not need to buy their product. [0] - https://github.com/Yubico/ykneo-openpgp/issues/2#issuecomment-219021710 https://github.com/Yubico/ykneo-openpgp/issues/2#issuecommen...
- slavik81 10y agoI don't think that's an odd reaction at all given what they were responding to: > Everyone that does not have shit for brains knows that security through obscurity doesn't work .... it should not take to long for someone to exploit the dumb asses that buy and use their allegedly "secure" closed source product.
- OJFord 10y agoAh, I didn't see that comment. What I thought was "odd" was reacting to community feedback that OS involvement was so prized by closing the issue (and therefore discussion) without explaining why this decision was made. Perhaps more seriously concerning is that it took people rooting through the code and issues to discover that this was the case. Many would say that security companies have something of a duty to be open-source; I think they at least ought to announce that they've deprecated the open-source versions of their code!
- MBCook 10y agoWhat's so terrible about asking for civility? You don't have to be happy about the change, you can register your displeasure and that you will no longer do business with them civically and in a forceful tone. Why is 'it's on the internet and they did something I do like so I can be an add' so accepted no matter what the circumstances are? Seems like a very reasonable and measured reaction. It's not like they're banning all discussion of the topic, just trying to keep civility.
- jbaviat 10y agoGlad to learn Nitrokey has ECC support, even if only 256 bits.
- parent5446 10y agoThe one thing that I find missing in Nitrokey is that none of their regular keys support U2F alongside other 2FA methods, like Yubikey does. You need the separate U2F device for that, and I don't want to carry around multiple tokens if at all possible.
- methou 10y agoI was seeking an alternative and cheaper OpenPGP solution to Yubikeys, then I found that the OpenPGP card is essentially a Java applet lives on a chip runs JVM, and JVM runs on top of JavaCard OS. Since all the programs follows GlobalPlatform standards, communication with Java Cards can be straightforward. In the end, it's not difficult to burn opensource openPGP applet to your own card. But there are 2 problems: 1. Bulk sales. If you want to all the things by yourself, and you found an ideal chip (recent NXP SmartMX2 cards has all the fancy stuff you want), almost every reseller only allow bulk purchases, say 100 pcs minimum. 2. Propriety software. For NXP cards, you need a propriety software to initialize/unlock a card before you can use GlobalPlatform tools to flash your own Applets. A reseller told me that his can be done by sending raw HEX code with a Transport Key to workaround, but I'm not sure about it.
- e12e 10y agoI don't really see what's new here, that made the author "withdraw his endorsement". It's an issue from 2014, about a device that has always been fully proprietary? Ok, so they make other devices that was in some small way open, and ran Free software. Great. But the yubikey devices have never AFAIK really been open in any meaningful sense. So, really this isn't so much yubikey changing what they do, but rather the author not understanding what these devices were in the first place? As far as I can tell, if you got one of these in the mail, there'd be no meaningful way you could verify that it hadn't been tampered with anyway. So you'd just have to make a leap of faith, and assume it was "secure"? If you were prepared to do that, then fine use the yubikeys. If not, perhaps you should take a deeper look at your usb mouse and keyboard too. Did you verify that your keyboard isn't running some code that might compromise your security?
- ownagefool 10y agoPresumably if you plug a keyboard or mouse in and it starts reading /secret, somebody will notice and generally you can deny the device the ability to do that technical means. I'll be honest, I'm not sure how open these things are at the moment, but I imagine if a device registers as a mouse, it should have limited functionality. That said, your point is largely on the money that, were're taking great faith that your computing device is secure. But at the same time, I'd put more stock into a device that handles my super secret key and attempts to make reading it and tampering impossible / unfeasible from the devices I plug it into. Thusly, it's perfectly resonable to care more about your yubikey than your mouse, from a security perspective.
- e12e 10y agoI'm not sure how useful a keyboard that doesn't register key presses is. Even if we generally don't want it to record those key presses. The point is that usb keyboards have enough electronics in them that it's difficult to show they don't record.
- ownagefool 10y agoI think you missed my point which was why your downvoted. So, yes, I want my keyboard to reigster key pressed. That's what it's there for. I don't want it to read abitary files from my system and then call home and it's resonable to assume and desire that the computer does not allow that to happen.
- Dowwie 10y agoHang on just a minute, hackernewsies. Put down your pitchforks and torches. Do you really expect a leading company of security hardware to give the keys of its kingdom away (pun intended)?
- dopkew 10y agoI'm glad someone's using 'libre'; glad that i can easily refer to liberated open-source software without ambiguity.