6 ms·

When I buy a key, how will I know I can trust that key? Is there any way to validate it? Edit: It seems Yubico is a trusted brand so I guess you are safe when

by pasta 8y ago

When I buy a key, how will I know I can trust that key? Is there any way to validate it? Edit: It seems Yubico is a trusted brand so I guess you are safe when you buy keys from them. Here is a list of FIDO certified products: https://fidoalliance.org/certification/fido-certified-products/ https://fidoalliance.org/certification/fido-certified-produc...

Bedon292 8y ago
I guess you also should buy directly from Yubico? You can buy them on Amazon, but how do you trust that its the right hardware? Do they offer some sort of validation?
- foepys 8y ago
  Don't buy anything you need to trust from Amazon, especially when it's stuff that is easy to manipulate and/or easy to make a counterfeit of. Amazon puts everything that claims to be the same product into a single bin and if somebody sends Amazon counterfeited Yubico products, they will be delivered to anybody that buys a Yubico product, even when the seller they are buying from made sure to only send verified ones to Amazon. This obviously only applies to products that are being shipped with "Fulfilled by Amazon". Sources: https://www.engadget.com/2018/05/31/fulfilled-by-amazon-counterfeit-fake/ https://www.engadget.com/2018/05/31/fulfilled-by-amazon-coun... https://www.theguardian.com/technology/2018/apr/27/amazon-site-awash-with-counterfeit-goods-despite-crackdown https://www.theguardian.com/technology/2018/apr/27/amazon-si... https://www.cnbc.com/2016/07/08/amazons-chinese-counterfeit-problem-is-getting-worse.html https://www.cnbc.com/2016/07/08/amazons-chinese-counterfeit-...
tialaramex 8y ago
(Cheap) Security Keys are very dumb objects. They don't know anything secret except their own secret key. So I think the two naughty things bad guys might do are: 1. Sell you a key whose secret key they already know. This is hard to defend against. But if you just buy a generic key from a reputable manufacturer and aren't a major target this seems pretty safe in practice. 2. Hide something malevolent inside the security key's case, e.g. it's secretly a GPS tracker or it's a tiny USB disk plus keyboard that hacks your PC after detecting inactivity.
- gbacon 8y ago
  Is there any way to generate a new key on the device? What steps can a paranoid user take to mitigate problem (1) above?
  - tialaramex 8y ago
    In principle devices could be designed with the ability to generate a new key. But if you don't trust the hardware how does that help? You may be able to make more of the hardware yourself, depending on how capable you are with electronics. (Much) more expensive devices can implement FIDO while actually using arbitrary new keys for each registration and you could arrange to hand-pick the keys and then verify it behaves as intended and uses your chosen keys.
    - crunchatized 8y ago
      In the more expensive devices, are the arbitrary new private keys imported from the computer it's plugged into? If the new keys are generated on the hardware you don't trust, it'd still be the same problem, since the private keys could be generated deterministically from a known seed and a counter. You can at least verify when a cheaply-designed device has changed its secret key, because the public key it offers for github.com is different from before, but yeah, that 'new' secret key could still just be derived from a manufacturer-known seed/secret serial number, too, same as the first one was, but with an incremented counter.
  - PascLeRasc 8y ago
    You can order it on a library computer with a Visa debit card you bought at a grocery store you don't usually go to with cash, and ship it to another address than your own.
teamhappy 8y ago
Nitrokey is open source (hardware and software). They claim the "installed firmware can be exported and verified, preventing attackers from inserting backdoors into products during shipping". (https://www.nitrokey.com/ https://www.nitrokey.com/) They list Google as one of their customers. Also if you're a Linux kernel developer you get one for free: https://www.nitrokey.com/news/2018/nitrokey-partners-linux-foundation-equip-all-linux-kernel-developers-nitrokey-usb-keys https://www.nitrokey.com/news/2018/nitrokey-partners-linux-f...
dlgeek 8y ago
Yubico puts validatable device certificates on it's devices: https://developers.yubico.com/U2F/Attestation_and_Metadata/ https://developers.yubico.com/U2F/Attestation_and_Metadata/

by pasta 8y ago

Bedon292 8y ago

I guess you also should buy directly from Yubico? You can buy them on Amazon, but how do you trust that its the right hardware? Do they offer some sort of validation?

foepys 8y ago
Don't buy anything you need to trust from Amazon, especially when it's stuff that is easy to manipulate and/or easy to make a counterfeit of. Amazon puts everything that claims to be the same product into a single bin and if somebody sends Amazon counterfeited Yubico products, they will be delivered to anybody that buys a Yubico product, even when the seller they are buying from made sure to only send verified ones to Amazon. This obviously only applies to products that are being shipped with "Fulfilled by Amazon". Sources: https://www.engadget.com/2018/05/31/fulfilled-by-amazon-counterfeit-fake/ https://www.engadget.com/2018/05/31/fulfilled-by-amazon-coun... https://www.theguardian.com/technology/2018/apr/27/amazon-site-awash-with-counterfeit-goods-despite-crackdown https://www.theguardian.com/technology/2018/apr/27/amazon-si... https://www.cnbc.com/2016/07/08/amazons-chinese-counterfeit-problem-is-getting-worse.html https://www.cnbc.com/2016/07/08/amazons-chinese-counterfeit-...

tialaramex 8y ago

(Cheap) Security Keys are very dumb objects. They don't know anything secret except their own secret key. So I think the two naughty things bad guys might do are: 1. Sell you a key whose secret key they already know. This is hard to defend against. But if you just buy a generic key from a reputable manufacturer and aren't a major target this seems pretty safe in practice. 2. Hide something malevolent inside the security key's case, e.g. it's secretly a GPS tracker or it's a tiny USB disk plus keyboard that hacks your PC after detecting inactivity.

gbacon 8y ago
Is there any way to generate a new key on the device? What steps can a paranoid user take to mitigate problem (1) above?
- tialaramex 8y ago
  In principle devices could be designed with the ability to generate a new key. But if you don't trust the hardware how does that help? You may be able to make more of the hardware yourself, depending on how capable you are with electronics. (Much) more expensive devices can implement FIDO while actually using arbitrary new keys for each registration and you could arrange to hand-pick the keys and then verify it behaves as intended and uses your chosen keys.
  - crunchatized 8y ago
    In the more expensive devices, are the arbitrary new private keys imported from the computer it's plugged into? If the new keys are generated on the hardware you don't trust, it'd still be the same problem, since the private keys could be generated deterministically from a known seed and a counter. You can at least verify when a cheaply-designed device has changed its secret key, because the public key it offers for github.com is different from before, but yeah, that 'new' secret key could still just be derived from a manufacturer-known seed/secret serial number, too, same as the first one was, but with an incremented counter.
- PascLeRasc 8y ago
  You can order it on a library computer with a Visa debit card you bought at a grocery store you don't usually go to with cash, and ship it to another address than your own.

teamhappy 8y ago

Nitrokey is open source (hardware and software). They claim the "installed firmware can be exported and verified, preventing attackers from inserting backdoors into products during shipping". (https://www.nitrokey.com/ https://www.nitrokey.com/) They list Google as one of their customers. Also if you're a Linux kernel developer you get one for free: https://www.nitrokey.com/news/2018/nitrokey-partners-linux-foundation-equip-all-linux-kernel-developers-nitrokey-usb-keys https://www.nitrokey.com/news/2018/nitrokey-partners-linux-f...

dlgeek 8y ago

Yubico puts validatable device certificates on it's devices: https://developers.yubico.com/U2F/Attestation_and_Metadata/ https://developers.yubico.com/U2F/Attestation_and_Metadata/