3 ms·

I've been disappointed in Yubico since I reported a Replay Attack, in their server, to them and Steve Gibson a couple of years ago. They gave now reply. Stev

I've been disappointed in Yubico since I reported a Replay Attack, in their server, to them and Steve Gibson a couple of years ago. They gave now reply. Steve replied after a called him out publicly. I'm considering creating a like process based on the USB Rubber Ducky. I'm thinking simple one time pad. https://hakshop.myshopify.com/products/usb-rubber-ducky-deluxe?variant=353378649 https://hakshop.myshopify.com/products/usb-rubber-ducky-delu... 1s

DKnoll 10y ago
Have you seen the USB Armory? Seems like you would be interested. https://inversepath.com/usbarmory https://inversepath.com/usbarmory
- RRRA 10y ago
  How has the ecosystem evolved lately? Any cool project you're aware of? :)
  - DKnoll 10y ago
    No... but I was hoping he would make one. ;)
- nxzero 10y ago
  Main concern with any project like USB Armory is a supply change attack. Seems like it's forum is active though.
makomk 10y ago
I've been disappointed in Yubico since I saw their advisory downplaying the bug in the original OpenPGP support which meant it didn't require a PIN to perform crypto operations (and of course, this can be done over the NFC interface too): https://developers.yubico.com/ykneo-openpgp/SecurityAdvisory%202015-04-14.html https://developers.yubico.com/ykneo-openpgp/SecurityAdvisory...
dfc 10y ago
I don't understand why you would call Steve Gibson out on this.[1] What is the connection between Yubico and Steve Gibson? [1]: For the sake of the discussion I will pretend he is a qualified to speak about security.
- freehunter 10y ago
  The closest connection I can find is that Steve endorses the Yubikey. I guess if you consider Steve Gibson to be a reliable source on security, you would expect his endorsement to carry some weight and likewise, the withdrawal of his endorsement to matter. So if you can pressure Steve into withdrawing his support, you would be in a winning situation. That's assuming you consider Steve Gibson to know anything at all about security.
  - dws 10y ago
    Cheap shot. Gibson may not be current, but he's one of the few out there trying to explain issues to a wider audience who are outside of our bubble, and he does a fairly good job at it (though I wish he'd give Leo LaPorte a good slap).
    - freehunter 10y ago
      He's also made a fool out of himself in very unashamed and public ways, and spread a lot of FUD. Windows XP raw sockets and Windows meta file come to mind. He's also said that Metasploit is a controversial piece of software that's main use is to develop malware. Steve Gibson is a talker, even if he doesn't know what he's talking about. He will say whatever he wants and issue corrections later when he's been proven wrong. It's not a cheap shot. It's well documented, he's been called out on it for years, but he's still calling himself a security expert while simeltaneuously spewing bullshit, for 15 years now. And "not current" in security means "useless", or sometimes "actively harmful". There is no way to call yourself a security expert if you're out of date. http://attrition.org/errata/charlatan/steve_gibson/ http://attrition.org/errata/charlatan/steve_gibson/
  - godzillabrennus 10y ago

DKnoll 10y ago

Have you seen the USB Armory? Seems like you would be interested. https://inversepath.com/usbarmory https://inversepath.com/usbarmory

RRRA 10y ago
How has the ecosystem evolved lately? Any cool project you're aware of? :)
- DKnoll 10y ago
  No... but I was hoping he would make one. ;)
nxzero 10y ago
Main concern with any project like USB Armory is a supply change attack. Seems like it's forum is active though.

makomk 10y ago

I've been disappointed in Yubico since I saw their advisory downplaying the bug in the original OpenPGP support which meant it didn't require a PIN to perform crypto operations (and of course, this can be done over the NFC interface too): https://developers.yubico.com/ykneo-openpgp/SecurityAdvisory%202015-04-14.html https://developers.yubico.com/ykneo-openpgp/SecurityAdvisory...

dfc 10y ago

I don't understand why you would call Steve Gibson out on this.[1] What is the connection between Yubico and Steve Gibson? [1]: For the sake of the discussion I will pretend he is a qualified to speak about security.

freehunter 10y ago
The closest connection I can find is that Steve endorses the Yubikey. I guess if you consider Steve Gibson to be a reliable source on security, you would expect his endorsement to carry some weight and likewise, the withdrawal of his endorsement to matter. So if you can pressure Steve into withdrawing his support, you would be in a winning situation. That's assuming you consider Steve Gibson to know anything at all about security.
- dws 10y ago
  Cheap shot. Gibson may not be current, but he's one of the few out there trying to explain issues to a wider audience who are outside of our bubble, and he does a fairly good job at it (though I wish he'd give Leo LaPorte a good slap).
  - freehunter 10y ago
    He's also made a fool out of himself in very unashamed and public ways, and spread a lot of FUD. Windows XP raw sockets and Windows meta file come to mind. He's also said that Metasploit is a controversial piece of software that's main use is to develop malware. Steve Gibson is a talker, even if he doesn't know what he's talking about. He will say whatever he wants and issue corrections later when he's been proven wrong. It's not a cheap shot. It's well documented, he's been called out on it for years, but he's still calling himself a security expert while simeltaneuously spewing bullshit, for 15 years now. And "not current" in security means "useless", or sometimes "actively harmful". There is no way to call yourself a security expert if you're out of date. http://attrition.org/errata/charlatan/steve_gibson/ http://attrition.org/errata/charlatan/steve_gibson/
- godzillabrennus 10y ago