4 ms·

Remember that closed source security-related products are a complete joke and you should spend your money somewhere else.

Filligree 10y ago
Any suggestions?
- Sir_Cmpwn 10y ago
  Just use a TOTP app, at the moment. Note that because there are no U2F alternatives means that you shouldn't use U2F - not that you should settle for an insecure device.
  - lorenzhs 10y ago
    There are U2F alternatives, several of which are mentioned in this thread. Also, U2F is immune to phishing while TOTP isn't. Your advice is actively harmful.
    - Sir_Cmpwn 10y ago
      I believe I'm speaking to an audience that is generally pretty good at not being phished.
      - akerl_ 10y ago
        The available data suggests there are no groups of people who are good at not being phished. The audience here is unlikely to send a check to the Nigerian prince looking to smuggle his money to America, but if you're arguing that we shouldn't trust yubikeys against APT backdoors, we're talking about a much higher quality of phishing. I'll take my odds with yubikeys firmware rather than try to vet every site I enter a TOTP code into
        Sir_Cmpwn 10y ago
        You should be vetting those sites anyway, especially since you probably were also asked for a password. And it's not exactly hard - just glance up at the address bar. >The available data source?
        lorenzhs 10y ago
        A good phish relies on triggering instinctive behaviour, e.g. scaring the crap out of you and not following best practices because you're having an adrenaline rush. That's how careful people get hit. SwiftOnSecurity sometimes posts really well done phishing attempts: https://twitter.com/search/live?q=phish+from%3Aswiftonsecurity https://twitter.com/search/live?q=phish+from%3Aswiftonsecuri...
KirinDave 10y ago
Reminder that open source projects are not provably more secure, nor is it easy (or even possible in many cases) to assert the source you see made the binary in question. Yubikey has been around a long time and has made every effort to be a transparent company with a support for open source. Truth is, that is sometimes hard to do. I found this article rather interesting, back when it first came out: https://www.yubico.com/2016/05/secure-hardware-vs-open-source/ https://www.yubico.com/2016/05/secure-hardware-vs-open-sourc...
- Sir_Cmpwn 10y ago
  I've seen that article and it's a heap of crap. There's no reason they couldn't make the firmware read-only so you could verify it, then publish the source to audit and verify against. >Reminder that open source projects are not provably more secure, nor is it easy (or even possible in many cases) to assert the source you see made the binary in question. I can (and do) read the code for security-related software, and I can at least check for obvious backdoors and flaws myself. With reproducable builds it is possible to assert the source you see made the binary in question (and security related software must support reproducable builds for this reason). If you want to convince yourself the product is secure, that's up to you, but it's not.
  - KirinDave 10y ago
    You obviously didn't read the article. There is no way for you to actually do that. And the secure platforms themselves have NDAs around their specs and software tooling. So yeah, there is a reason they didn't do that. The hardware they're using specifically makes it difficult to do the verification you want to do. Which is directly related to foiling the kind of attacks they want to foil. > If you want to convince yourself the product is secure, that's up to you, but it's not I think we have the same goal, but you have a conviction that open source stops "obvious back doors." It in no way would help that at all in this case. The hardware is configured before it is shipped, then locked in a way designed to prevent rewriting or inspection. You have no rational basis for the belief that the source code on a website and the binary a malicious and deceptive actor would deploy to the hardware are the same thing. Being open source only affects the way security auditing can be done. It doesn't guarantee better quality.
ksk 10y ago
You are taking what you personally consider to be a guarantee and applying it to mean what everyone else considers to be a guarantee. Unless you physically inspect each and every device (since they could easily run multiple lots) your faith is in the fabrication of all of the ICs used in the design. Not to mention that the computer you stick these into suffers from the same problem. On the theoretical side, all of the math which this is based upon is probably taken by most people on a faith basis. There is a lot of faith to go around. It just depends where you draw the line.
carterehsmith 10y ago
Well, with that logic, open-source security-related products are a complete joke, too. - Microprocessor can look at the binary, recognize the patterns ("oh, this is OpenSSH trying to generate a key... lets give them an easily breakable one") and do whatever it wants with it. Remediation: build your own compilers, build you own processors, from your own schematics, in your own foundry (cost: $billions), built by yourself. Good luck?

Filligree 10y ago

Any suggestions?

Sir_Cmpwn 10y ago
Just use a TOTP app, at the moment. Note that because there are no U2F alternatives means that you shouldn't use U2F - not that you should settle for an insecure device.
- lorenzhs 10y ago
  There are U2F alternatives, several of which are mentioned in this thread. Also, U2F is immune to phishing while TOTP isn't. Your advice is actively harmful.
  - Sir_Cmpwn 10y ago
    I believe I'm speaking to an audience that is generally pretty good at not being phished.
    - akerl_ 10y ago
      The available data suggests there are no groups of people who are good at not being phished. The audience here is unlikely to send a check to the Nigerian prince looking to smuggle his money to America, but if you're arguing that we shouldn't trust yubikeys against APT backdoors, we're talking about a much higher quality of phishing. I'll take my odds with yubikeys firmware rather than try to vet every site I enter a TOTP code into
      - Sir_Cmpwn 10y ago
        You should be vetting those sites anyway, especially since you probably were also asked for a password. And it's not exactly hard - just glance up at the address bar. >The available data source?
        lorenzhs 10y ago
        A good phish relies on triggering instinctive behaviour, e.g. scaring the crap out of you and not following best practices because you're having an adrenaline rush. That's how careful people get hit. SwiftOnSecurity sometimes posts really well done phishing attempts: https://twitter.com/search/live?q=phish+from%3Aswiftonsecurity https://twitter.com/search/live?q=phish+from%3Aswiftonsecuri...

KirinDave 10y ago

Reminder that open source projects are not provably more secure, nor is it easy (or even possible in many cases) to assert the source you see made the binary in question. Yubikey has been around a long time and has made every effort to be a transparent company with a support for open source. Truth is, that is sometimes hard to do. I found this article rather interesting, back when it first came out: https://www.yubico.com/2016/05/secure-hardware-vs-open-source/ https://www.yubico.com/2016/05/secure-hardware-vs-open-sourc...

Sir_Cmpwn 10y ago
I've seen that article and it's a heap of crap. There's no reason they couldn't make the firmware read-only so you could verify it, then publish the source to audit and verify against. >Reminder that open source projects are not provably more secure, nor is it easy (or even possible in many cases) to assert the source you see made the binary in question. I can (and do) read the code for security-related software, and I can at least check for obvious backdoors and flaws myself. With reproducable builds it is possible to assert the source you see made the binary in question (and security related software must support reproducable builds for this reason). If you want to convince yourself the product is secure, that's up to you, but it's not.
- KirinDave 10y ago
  You obviously didn't read the article. There is no way for you to actually do that. And the secure platforms themselves have NDAs around their specs and software tooling. So yeah, there is a reason they didn't do that. The hardware they're using specifically makes it difficult to do the verification you want to do. Which is directly related to foiling the kind of attacks they want to foil. > If you want to convince yourself the product is secure, that's up to you, but it's not I think we have the same goal, but you have a conviction that open source stops "obvious back doors." It in no way would help that at all in this case. The hardware is configured before it is shipped, then locked in a way designed to prevent rewriting or inspection. You have no rational basis for the belief that the source code on a website and the binary a malicious and deceptive actor would deploy to the hardware are the same thing. Being open source only affects the way security auditing can be done. It doesn't guarantee better quality.

ksk 10y ago

You are taking what you personally consider to be a guarantee and applying it to mean what everyone else considers to be a guarantee. Unless you physically inspect each and every device (since they could easily run multiple lots) your faith is in the fabrication of all of the ICs used in the design. Not to mention that the computer you stick these into suffers from the same problem. On the theoretical side, all of the math which this is based upon is probably taken by most people on a faith basis. There is a lot of faith to go around. It just depends where you draw the line.

carterehsmith 10y ago

Well, with that logic, open-source security-related products are a complete joke, too. - Microprocessor can look at the binary, recognize the patterns ("oh, this is OpenSSH trying to generate a key... lets give them an easily breakable one") and do whatever it wants with it. Remediation: build your own compilers, build you own processors, from your own schematics, in your own foundry (cost: $billions), built by yourself. Good luck?