“I must, sadly, withdraw my endorsement of Yubikey 4 devices”

Re:“I must, sadly, withdraw my endorsement of Yubikey 4 devi... by geofft on Friday May 13, 2016 @01:11PM (#11691655)

This is about the code running on the YubiKey itself, not about the code to interact with it from a general-purpose computer?

And if I'm reading the linked GitHub issue correctly, this is about a specific plugin that runs in a sandbox on the YubiKey NEO, where the main codebase of the NEO is still proprietary?

I don't understand the advantage of it being open-source then, at least as far as security goes. (For user freedoms in practice, maybe.) What guarantee do you have that the code on the device matches the code on GitHub, or that the code on GitHub isn't subverted by other code on the device?

[ Parent | on HN ]

Re:“I must, sadly, withdraw my endorsement of Yubikey 4 devi... by JoshTriplett on Friday May 13, 2016 @01:14PM (#11691686)

> And if I'm reading the linked GitHub issue correctly, this is about a specific plugin that runs in a sandbox on the YubiKey NEO, where the main codebase of the NEO is still proprietary?

No, it's the code for the new YubiKey 4, which has been closed off.

> What guarantee do you have that the code on the device matches the code on GitHub

Ideally, you can build and flash the firmware yourself.

[ Parent | on HN ]

Re:“I must, sadly, withdraw my endorsement of Yubikey 4 devi... by nmikhailov on Friday May 13, 2016 @01:19PM (#11691711)

> No, it's the code for the new YubiKey 4, which has been closed off.

yk4 firmware was never released; that particular issue is about NEO's openpgp applet.

>Ideally, you can build and flash the firmware yourself.

You couldn't do that with NEO(except from early dev version) as global platfrom management keys are unknown, which makes it impossible to delete/upload applets. I actually tried to get dev. version but they redirected me to NXP who never answered.

[ Parent | on HN ]

Re:“I must, sadly, withdraw my endorsement of Yubikey 4 devi... by evanosaurus on Friday May 13, 2016 @04:40PM (#11693093)

You can't flash the firmware yourself, as the keys are discarded as soon as they're generated per device.

What you could do, however, is read the bits off of the firmware and make sure they're identical to the bits you make from source. Reproducible builds, and all that.

[ Parent | on HN ]

Re:“I must, sadly, withdraw my endorsement of Yubikey 4 devi... by geofft on Friday May 13, 2016 @01:17PM (#11691706)

Oops, that was unclear. What I meant was closer to "This is about a specific piece of functionality that, in the past, was an open-source sandboxed plugin on the YubiKey NEO, running inside the main NEO codebase, which was proprietary?"

Could you have flashed the proprietary part of the NEO codebase yourself, or just the plugin?

[ Parent | on HN ]