News for hackers. Stuff that matters.

A comment on Show HN: The SC4-HSM, a fully open USB hardware secure module. Parent comment

Re:Show HN: The SC4-HSM, a fully open USB hardware secure mo... by e12e on Friday July 08, 2016 @02:29AM (#12053886)
It looks like a very nice piece of kit - I just might have to get one :-) But speaking of hardware, I was recently reminded of the new BBC:Micro[m] project thanks to an email by the PythonAnywhere[p]-team.

I wonder how much of the features could be implemented on that? I'm guessing that while the micro-usb might allow for power and data connection to the host - there'd probably not be a way to prevent compromise when connected (I'm guessing malware could reprogram the device without overwriting the stored keys). Thoughts?

[m] https://www.microbit.co.uk/device

[p] https://www.pythonanywhere.com/

[ed: As for adding (some) tamper-proofing to either device, remember the glitter-nailpolish-picture-trick: https://www.wired.com/2013/12/better-data-security-nail-poli...

I wonder if it would be possible to epoxy up the BBC:Micro's micro USB port, and use the connectors/headers for communicating, possibly emulating USB 1.1 or something, with an soldered connector. ]

[ Parent | on HN ]
Re:Show HN: The SC4-HSM, a fully open USB hardware secure mo... by lisper on Friday July 08, 2016 @02:36AM (#12053902)
> I just might have to get one

Better hurry. My stock of prototypes is very nearly sold out.

> BBC:Micro[m] project

I have no idea about that particular device. But very few things end up being secure by accident. But if it's not designed for security like the STM32F415 is, then I'd say odds are good it's not secure.

[ Parent | on HN ]
Re:Show HN: The SC4-HSM, a fully open USB hardware secure mo... by e12e on Friday July 08, 2016 @06:56AM (#12054643)
Sorry (happy :) to hear that you're running out. Might actually be in a situation soon where it will make more sense to hold a workshop and build a good handful of the things.

Agreed on the "accidentally secure" part. Then again, if you could drench a full x86 pc in epoxy, it might be possible to make "reasonably secure" blob if all you left open was a serial port. Might.

[ Parent | on HN ]