4 ms·

> This is a pretty compelling U2F solution No it's not. It's manufacturered in China, a state devoted to spying on its own citizens to a degree higher than the

> This is a pretty compelling U2F solution No it's not. It's manufacturered in China, a state devoted to spying on its own citizens to a degree higher than the NSA (social credit scores, etc) and preventing the free flow of information. I wouldn't trust this thing to store my zip code securely, much less a private key.

zitterbewegung 8y ago
Thanks for informing me I appreciate it (I’m a happy user of a Yubikey).
geofft 8y ago
Since the key doesn't have wifi or anything, how can the private key flow back to China? (This is a serious question - is there enough wiggle room in the U2F protocol to allow the device to reveal the private key to a Chinese website, if they can trick you into visiting it, or something?)
- craftyguy 8y ago
  It's a USB device, it already has the ability to do terrible things[0] when you plug it in. 0. https://www.wired.com/2014/07/usb-security/ https://www.wired.com/2014/07/usb-security/
  - geofft 8y ago
    OK, "the device is secretly a USB Rubber Ducky-style device that will send keyboard shortcuts to open a new tab, send data, and close it" is definitely a potential attack, sure. It would almost certainly be super noticeable (unless everyone else's browsers are much faster at opening and closing tabs than I am) so it seems like the sort of thing you'd only deploy against a couple of high-value targets at some single opportune moment, but that's arguably within Advanced Protection's threat model I guess.
- xenadu02 8y ago
  That's easy: The Chinese government could infiltrate the factory and keep a record of the on-chip private key, then kill anyone who doesn't agree to go along with it. Or bug the programming devices. Chinese courts are far from independent - they do as they are ordered by the Communist party, and rulings highly depend on guanxi or connections (family, party, or both). The whole security key thing relies on a chain of trust. Unless you are designing your own chips (and verifying samples of them to ensure nothing has been added), you can't ever really know if some bad actor or state actor has compromised the chain somewhere along the way. So far in the US, such things are not legally required and where ordered by lower courts the appeals courts have overruled them. As it stands today the government can't require anyone outside of a telephone company to implement any technological measure to assist them in spying (telcos are required to assist with wiretaps). Companies might go along with a request of course. I'm not saying there is a perfect solution here, but in general I trust chips and devices manufactured in the US and Sweden to a much higher degree than devices made in China.
- 394549 8y ago
  > Since the key doesn't have wifi or anything, how can the private key flow back to China? The bluetooth one has a bluetooth radio (obviously). I suppose it's conceivable that the firmware could have a backdoor that allowed exfiltration of the private keys via that radio. Such a backdoor could probably be used in a targeted way against particular people in public places like a airports or cafes. Given that Google is marketing these things towards high-value targets such as journalists, campaign advisors, and Google engineers; building such a backdoor would be very tempting. It wouldn't even have to be present in stock keys, if the shipments could be intercepted in the mail on their way to particular targets.
- danjoc 8y ago
  >how can the private key flow back to China? You're assuming the key needs to flow back.
danjoc 8y ago
It's also manufactured by Google, which is equally adept in spying and probably more unworthy of trust. But more importantly, it's just a bad deal. A yubikey neo can do GPG, PIV, OATH, OTP, HMAC challenge response, and a few other things in addition to NFC U2F for the same price. The Titan dongles package just does U2F, and U2F isn't even that great.

zitterbewegung 8y ago

Thanks for informing me I appreciate it (I’m a happy user of a Yubikey).

geofft 8y ago

Since the key doesn't have wifi or anything, how can the private key flow back to China? (This is a serious question - is there enough wiggle room in the U2F protocol to allow the device to reveal the private key to a Chinese website, if they can trick you into visiting it, or something?)

craftyguy 8y ago
It's a USB device, it already has the ability to do terrible things[0] when you plug it in. 0. https://www.wired.com/2014/07/usb-security/ https://www.wired.com/2014/07/usb-security/
- geofft 8y ago
  OK, "the device is secretly a USB Rubber Ducky-style device that will send keyboard shortcuts to open a new tab, send data, and close it" is definitely a potential attack, sure. It would almost certainly be super noticeable (unless everyone else's browsers are much faster at opening and closing tabs than I am) so it seems like the sort of thing you'd only deploy against a couple of high-value targets at some single opportune moment, but that's arguably within Advanced Protection's threat model I guess.
xenadu02 8y ago
That's easy: The Chinese government could infiltrate the factory and keep a record of the on-chip private key, then kill anyone who doesn't agree to go along with it. Or bug the programming devices. Chinese courts are far from independent - they do as they are ordered by the Communist party, and rulings highly depend on guanxi or connections (family, party, or both). The whole security key thing relies on a chain of trust. Unless you are designing your own chips (and verifying samples of them to ensure nothing has been added), you can't ever really know if some bad actor or state actor has compromised the chain somewhere along the way. So far in the US, such things are not legally required and where ordered by lower courts the appeals courts have overruled them. As it stands today the government can't require anyone outside of a telephone company to implement any technological measure to assist them in spying (telcos are required to assist with wiretaps). Companies might go along with a request of course. I'm not saying there is a perfect solution here, but in general I trust chips and devices manufactured in the US and Sweden to a much higher degree than devices made in China.
394549 8y ago
> Since the key doesn't have wifi or anything, how can the private key flow back to China? The bluetooth one has a bluetooth radio (obviously). I suppose it's conceivable that the firmware could have a backdoor that allowed exfiltration of the private keys via that radio. Such a backdoor could probably be used in a targeted way against particular people in public places like a airports or cafes. Given that Google is marketing these things towards high-value targets such as journalists, campaign advisors, and Google engineers; building such a backdoor would be very tempting. It wouldn't even have to be present in stock keys, if the shipments could be intercepted in the mail on their way to particular targets.
danjoc 8y ago
>how can the private key flow back to China? You're assuming the key needs to flow back.

danjoc 8y ago

It's also manufactured by Google, which is equally adept in spying and probably more unworthy of trust. But more importantly, it's just a bad deal. A yubikey neo can do GPG, PIV, OATH, OTP, HMAC challenge response, and a few other things in addition to NFC U2F for the same price. The Titan dongles package just does U2F, and U2F isn't even that great.