Using Yubikeys Everywhere

Re:Using Yubikeys Everywhere by kabdib on Monday February 20, 2017 @10:38PM (#13693076)

The story for security on Android is really, really sad. Google should be pressing really hard on the secure enclave button. Even game consoles have better security [here I wanted to add: "... than the most secure Android device", but that would be untrue, since I don't know all the Android devices out there. Let's just say the situation is sad, verging on terrible because it's Google, full of smart people who almost certainly know better].

Google probably can't get away with just trusting TrustZone, given the number of manufacturers of SOCs and the opportunity for the folks doing chip-level cut-and-paste of features to get things wrong.

I imagine there are patents in the way. Solve that with the realization that a united front against adversaries (crackers, state-level actors) is better than a fragmented one.

Solve the technical issues by getting the right 20 engineers in a room for a week or two, to set a proper direction. Android could have great security in a large set of phones inside of 18-24 months, with the right management.

Sigh.

[ Parent | on HN ]

Re:Using Yubikeys Everywhere by tadfisher on Monday February 20, 2017 @11:21PM (#13693256)

While I agree with you, they do in fact have hardware-backed key storage these days; it's just only available (and reliably useful) in recent Android versions (namely those devices with fingerprint sensors).

Since we're on the subject, OP was talking about a perceived vulnerability with rooted Android devices. I highly suspect that even a decent secure enclave solution would warrant some skepticism if the system around it is wide open. For example, timing attacks or even plotting voltage draw on an oscilloscope could leak some key information.

If you're rooting your device anyway, you should probably invest in a hardware security key.

[ Parent | on HN ]

Re:Using Yubikeys Everywhere by kuschku on Tuesday February 21, 2017 @05:25AM (#13694611)

Depends on where you live.

If you assume that the US government is not trustworthy, and a possible enemy of you (possible if you're a journalist in these days), then an unrooted phone might be less trustworthy than a rooted one with custom software (such as a custom build of CooperheadOS)

[ Parent | on HN ]

Re:Using Yubikeys Everywhere by tornadoboy55 on Tuesday February 21, 2017 @11:51AM (#13696977)

Or just use an iPhone. The amount of marketshare Apple would lose if there was even a hint of a US-intelligence backdoor in their systems keeps them with a very, very vested interest to actively fight that.

[ Parent | on HN ]

Re:Using Yubikeys Everywhere by Godel_unicode on Tuesday February 21, 2017 @12:06AM (#13693433)

> Solve the technical issues by getting the right 20 engineers in a room for a week or two

Oh man, I haven't laughed that hard in a while.

[ Parent | on HN ]

Re:Using Yubikeys Everywhere by hvidgaard on Tuesday February 21, 2017 @02:30AM (#13693967)

What do you mean we cannot fix the human factor?

[ Parent | on HN ]