4 ms·

I'm kinda skeptical of security devices like this that don't have their own screens that let you know what you're authenticating. Obviously there's some applic

by treyd 3y ago

I'm kinda skeptical of security devices like this that don't have their own screens that let you know what you're authenticating. Obviously there's some applications where it's fine but if the PC it's plugged into is compromised it could be MITMing the auth.

gorkish 3y ago
Yes agree the end user needs feedback at the authenticator. This device has an RGB LED and a touch sensor, so there are still some possibilities.
- rdl 3y ago
  I'd put a key inside my app which then talks out of band to multiple devices (including maybe a trusted one?) -- e.g. "run app on the device, request input using the directly-connected PC, message tunneled out to my phone for confirmation") A screen and 2-3 buttons would be nice, though; also a tamper-evident/tamper-responding package. But my main desired use case for this is a lightweight app-specific HSM so I'd just need to validate integrity of device before connecting it to host. USB Armory II is the main alternative.
fmajid 3y ago
Have a look at Bunnie Huang’s Precursor project, but it’s much more expensive.
kfreds 3y ago
It's a trade-off. We've thought about adding a screen to a future product, but it begs the question of how much information you want displayed in order to make your authentication decision. And even if a screen gives you more information, are you authenticating an action where the cryptography terminates in the device? If you are authenticating an SSH session for instance, the screen helps you ensure you are authenticating a login to the right server. Once you have authenticated though, nothing prevents the attacker in your local machine from using the established SSH connection.
- lxgr 3y ago
  Very good point. "What you see is what you sign" is a powerful property, but it does often need some support on the side of the signature verifier to make it possible. Reading through an entire email (maybe MIME multipart encoded) on a small OLED screen isn't fun; on the other hand, something like "confirm transfer of €x to IBAN y from your account z" would be great – but needs support of your bank. That support is incredibly hard to get. Android has supported "protected confirmation" [1] for many years now (on Pixel devices), but I have yet to see support for it by any real-world service I'm using, and I'm not holding my breath, since I can't even use FIDO with any of my banks... [1] https://developer.android.com/privacy-and-security/security-android-protected-confirmation https://developer.android.com/privacy-and-security/security-...

by treyd 3y ago

gorkish 3y ago

Yes agree the end user needs feedback at the authenticator. This device has an RGB LED and a touch sensor, so there are still some possibilities.

rdl 3y ago
I'd put a key inside my app which then talks out of band to multiple devices (including maybe a trusted one?) -- e.g. "run app on the device, request input using the directly-connected PC, message tunneled out to my phone for confirmation") A screen and 2-3 buttons would be nice, though; also a tamper-evident/tamper-responding package. But my main desired use case for this is a lightweight app-specific HSM so I'd just need to validate integrity of device before connecting it to host. USB Armory II is the main alternative.

fmajid 3y ago

Have a look at Bunnie Huang’s Precursor project, but it’s much more expensive.

kfreds 3y ago

It's a trade-off. We've thought about adding a screen to a future product, but it begs the question of how much information you want displayed in order to make your authentication decision. And even if a screen gives you more information, are you authenticating an action where the cryptography terminates in the device? If you are authenticating an SSH session for instance, the screen helps you ensure you are authenticating a login to the right server. Once you have authenticated though, nothing prevents the attacker in your local machine from using the established SSH connection.

lxgr 3y ago
Very good point. "What you see is what you sign" is a powerful property, but it does often need some support on the side of the signature verifier to make it possible. Reading through an entire email (maybe MIME multipart encoded) on a small OLED screen isn't fun; on the other hand, something like "confirm transfer of €x to IBAN y from your account z" would be great – but needs support of your bank. That support is incredibly hard to get. Android has supported "protected confirmation" [1] for many years now (on Pixel devices), but I have yet to see support for it by any real-world service I'm using, and I'm not holding my breath, since I can't even use FIDO with any of my banks... [1] https://developer.android.com/privacy-and-security/security-android-protected-confirmation https://developer.android.com/privacy-and-security/security-...