3 ms·

I understand the Arduino model is different than other projects but we proudly use Arduino as it's open source and has lots of great features. As we use the Ard

by cr7pt0 7y ago

I understand the Arduino model is different than other projects but we proudly use Arduino as it's open source and has lots of great features. As we use the Arduino model you can find that our source consists of the .ino you mentioned here https://github.com/trustcrypto/OnlyKey-Firmware https://github.com/trustcrypto/OnlyKey-Firmware as well as libraries here https://github.com/trustcrypto/libraries https://github.com/trustcrypto/libraries. Our code is reviewed by Codacy and yes, it does receive a grade of A. For the .ino grading you will need to look at the OnlyKey-Firmware Github repo and for the libraries check out the libraries library. I think some of the confusion in your comment here may be related to how Arduino works, all source can be found on Github.

delfinom 7y ago
And I am going to have to give Codacy a grade of F but if this is what they consider grade A.
- actionowl 7y ago
  As a Codacy user for $DAYJOB I can guarantee you that Codacy deserves worst than grade F.
marcan_42 7y ago
It seems you're confused as to what Codacy is reviewing. Look at their dashboard for the OnlyKey-Firmware repo. They are not reviewing your .ino file at all, because they do not consider that file extension as code. Only the toplevel C files are covered.
- cr7pt0 7y ago
  The .ino file is included in Codacy review and receives a grade of A. You can find that here - https://app.codacy.com/manual/onlykey/OnlyKey-Firmware/dashboard https://app.codacy.com/manual/onlykey/OnlyKey-Firmware/dashb... All libraries are included and also receive a grade of A.
  - marcan_42 7y ago
    You just changed that. It was not included when I looked, and this fact is obvious by the "OnlyKey-Firmware has decreased 1% in quality in the last 7 days." banner. You have made no commits to the repo since Oct 23, so the only way the quality would decrease in the past week is if you changed the settings to include the .ino file.
cr7pt0 7y ago
I wanted to make sure I clearly address these comments, one of the issues in reading a post like this in an online thread is the most upvoted post can also be the most incorrect, and misleading. #1 > The "security" of this device is a joke, just look at how randomness is derived: Unfortunately, this commenter posted this without reviewing any of the security documentation available for OnlyKey. Had they reviewed they would see that we specifically address how analog input alone is not sufficient entropy for a cryptographically secure number generator and one of the unique features used with OnlyKey is using capacitive touch input for our RNG. This random input is generated every time you touch a button on OnlyKey, it's different for every person, and its truly random. https://docs.crp.to/security.html#cryptographically-secure-random-number-generator https://docs.crp.to/security.html#cryptographically-secure-r... #2 > Meaning that there is no hardware security whatsoever and it's trivial to extract all your keys from the device if you ever lose it. Whoops. Again, had the commenter taken the time to read a bit they would see that this is completely false. As others have already mentioned, OnlyKey is not an Arduino, OnlyKey uses some of the great Arduino software libraries that are available open source and the Arduino IDE. This is completely unrelated to hardware. As for the OnlyKey hardware security we use Freescale Kinetis flash security to securely lock data on the key. As for side channel attack countermeasures we list several that are in use. For full details read this - https://docs.crp.to/security.html#hardware-security https://docs.crp.to/security.html#hardware-security When it comes to security questions, trust an expert, not the top post on a thread. For more information about CryptoTrust, the makers of OnlyKey you can find our team with internationally recognized security credentials here - https://crp.to/t/ https://crp.to/t/ For more info on OnlyKey: Get started - https://onlykey.io/start https://onlykey.io/start General documentation - https://docs.crp.to/ https://docs.crp.to/ FAQs - https://docs.crp.to/faq.html https://docs.crp.to/faq.html Compare to Yubikey - https://crp.to/p/ https://crp.to/p/ Setup and User's Guide - https://docs.crp.to/usersguide.html https://docs.crp.to/usersguide.html Features - https://docs.crp.to/features.html https://docs.crp.to/features.html Support - https://forum.onlykey.io/ https://forum.onlykey.io/ List of supported services - https://onlykey.io/pages/works-with-onlykey https://onlykey.io/pages/works-with-onlykey
- cj371 7y ago
  If you're so confident in your experts, maybe respond to my comment where I point out a major bug? https://news.ycombinator.com/item?id=21889302 https://news.ycombinator.com/item?id=21889302

by cr7pt0 7y ago

delfinom 7y ago

And I am going to have to give Codacy a grade of F but if this is what they consider grade A.

actionowl 7y ago
As a Codacy user for $DAYJOB I can guarantee you that Codacy deserves worst than grade F.

marcan_42 7y ago

It seems you're confused as to what Codacy is reviewing. Look at their dashboard for the OnlyKey-Firmware repo. They are not reviewing your .ino file at all, because they do not consider that file extension as code. Only the toplevel C files are covered.

cr7pt0 7y ago
The .ino file is included in Codacy review and receives a grade of A. You can find that here - https://app.codacy.com/manual/onlykey/OnlyKey-Firmware/dashboard https://app.codacy.com/manual/onlykey/OnlyKey-Firmware/dashb... All libraries are included and also receive a grade of A.
- marcan_42 7y ago
  You just changed that. It was not included when I looked, and this fact is obvious by the "OnlyKey-Firmware has decreased 1% in quality in the last 7 days." banner. You have made no commits to the repo since Oct 23, so the only way the quality would decrease in the past week is if you changed the settings to include the .ino file.

cr7pt0 7y ago

I wanted to make sure I clearly address these comments, one of the issues in reading a post like this in an online thread is the most upvoted post can also be the most incorrect, and misleading. #1 > The "security" of this device is a joke, just look at how randomness is derived: Unfortunately, this commenter posted this without reviewing any of the security documentation available for OnlyKey. Had they reviewed they would see that we specifically address how analog input alone is not sufficient entropy for a cryptographically secure number generator and one of the unique features used with OnlyKey is using capacitive touch input for our RNG. This random input is generated every time you touch a button on OnlyKey, it's different for every person, and its truly random. https://docs.crp.to/security.html#cryptographically-secure-random-number-generator https://docs.crp.to/security.html#cryptographically-secure-r... #2 > Meaning that there is no hardware security whatsoever and it's trivial to extract all your keys from the device if you ever lose it. Whoops. Again, had the commenter taken the time to read a bit they would see that this is completely false. As others have already mentioned, OnlyKey is not an Arduino, OnlyKey uses some of the great Arduino software libraries that are available open source and the Arduino IDE. This is completely unrelated to hardware. As for the OnlyKey hardware security we use Freescale Kinetis flash security to securely lock data on the key. As for side channel attack countermeasures we list several that are in use. For full details read this - https://docs.crp.to/security.html#hardware-security https://docs.crp.to/security.html#hardware-security When it comes to security questions, trust an expert, not the top post on a thread. For more information about CryptoTrust, the makers of OnlyKey you can find our team with internationally recognized security credentials here - https://crp.to/t/ https://crp.to/t/ For more info on OnlyKey: Get started - https://onlykey.io/start https://onlykey.io/start General documentation - https://docs.crp.to/ https://docs.crp.to/ FAQs - https://docs.crp.to/faq.html https://docs.crp.to/faq.html Compare to Yubikey - https://crp.to/p/ https://crp.to/p/ Setup and User's Guide - https://docs.crp.to/usersguide.html https://docs.crp.to/usersguide.html Features - https://docs.crp.to/features.html https://docs.crp.to/features.html Support - https://forum.onlykey.io/ https://forum.onlykey.io/ List of supported services - https://onlykey.io/pages/works-with-onlykey https://onlykey.io/pages/works-with-onlykey

cj371 7y ago
If you're so confident in your experts, maybe respond to my comment where I point out a major bug? https://news.ycombinator.com/item?id=21889302 https://news.ycombinator.com/item?id=21889302