3 ms·

For #2, it'd be nice if there were kits sold to create your own physical keys. You can flash code from github to it yourself, and then assembly the casing toget

For #2, it'd be nice if there were kits sold to create your own physical keys. You can flash code from github to it yourself, and then assembly the casing together. Optionally for first line of defense, the assembly could be fastened with some less common like a torx or square screw head and it could come with a pack of small holographic security stickers to place over the screw. Edit: You'd want it to be an unassembled kit so that you can provide your own hardware if you wanted instead of relying on what is provided for you if you wanted to be super cautious.

ncmncm 7y ago
That all sounds to me like security theater. It would not increase my confidence in the device, its firmware, or its design.
- nine_k 7y ago
  Why? Backdooring a shipment of security tokens could open interesting possibilities at a relatively low cost. Or the government may force you if you happen to be in Australia. Flashing your own firmware which you have checked (or at least checked its signature) may make sense.
michaelt 7y ago
There’s the U2F Zero https://github.com/conorpp/u2f-zero/wiki/Building-a-U2F-Token https://github.com/conorpp/u2f-zero/wiki/Building-a-U2F-Toke... but of course there’s always a reflections-on-trusting-trust issue: you’ve got to get your CPU, CPU design, compiler, firmware and chip programmer somewhere! Of course, an accidental software bug is probably more likely than intentionally backdoored hardware targeting you personally...