Tomu, a tiny ARM microprocessor which fits in your USB port

Re:Tomu, a tiny ARM microprocessor which fits in your USB port by askvictor on Wednesday August 08, 2018 @09:03PM (#17720974)

Hold on - doesn't having this live permanently in the USB port reduce the security possible with a 2FA device? If the user has to get the key from their pocket and plug it in, it will at least prevent an attacker from accessing the user's account in a remote-desktop scenario. Certainly the requirement to press the button will mitigate this risk to a degree, but might there be exploits that can trigger this button-press event using a carefully crafted USB signal?

I understand the security vs usability thing, just beware of the risks of something like this (perhaps bluetooth-type keys like this are more usable as you don't need to bother plugging them in, assuming bluetooth decides to play nicely)

[ Parent | on HN ]

Re:Tomu, a tiny ARM microprocessor which fits in your USB port by plttn on Wednesday August 08, 2018 @09:27PM (#17721060)

My assumption is that if Google (which deploys the Yubikey Nano across their employees) is willing to make the leap that there'd be no way to trigger the button press via USB, then assuming Tomu has done their due diligence, it's impossible to do so on here.

[ Parent | on HN ]

Re:Tomu, a tiny ARM microprocessor which fits in your USB port by nickpsecurity on Wednesday August 08, 2018 @09:20PM (#17721039)

First image that popped into my mind seeing the title was this:

https://leaksource.files.wordpress.com/2013/12/nsa-ant-cotto...

[ Parent | on HN ]

Re:Tomu, a tiny ARM microprocessor which fits in your USB port by ecesena on Thursday August 09, 2018 @12:49AM (#17721698)

I'd say it depends on the security model. I have a yubikey nano permanently in my mac, I use it for example for vpn. Of course, I don't use it to unlock my mac, and I have a pretty long passphrase for that (and an apple watch to make it easier).

For 2fa in my own gmail/facebook, I use external keys, similarly as you're saying. But I could be comfortable using this yubikey, it's just that one is personal, the other is work in this case.

[ Parent | on HN ]

Re:Tomu, a tiny ARM microprocessor which fits in your USB port by 0culus on Wednesday August 08, 2018 @10:30PM (#17721293)

I think the YubiKey nano is intended to be left in a port. I don't leave mine in though (keep it on my keyring!)

[ Parent | on HN ]

Re:Tomu, a tiny ARM microprocessor which fits in your USB port by falsedan on Thursday August 09, 2018 @05:24AM (#17722721)

The button press is shorting two contacts on the device, there’s no way to fake it. If you’re thinking that there might be a bug you can trigger to execute the “print code” routine, the good news is that ARM microcode is simple and small enough that you can audit and verify it (and the USB stack).

[ Parent | on HN ]

Re:Tomu, a tiny ARM microprocessor which fits in your USB port by qop on Wednesday August 08, 2018 @11:56PM (#17721554)

Don't you think they'd have thought that through?

I admire your diligent concern, but I thought the same thing for a split second and dismissed it.

I can't imagine even a corporate churn machine with the most reckless abandon designing a device like this and missing the most basic obvious attack vector.

Well, anyways....

[ Parent | on HN ]

Re:Tomu, a tiny ARM microprocessor which fits in your USB port by gh02t on Thursday August 09, 2018 @12:54AM (#17721708)

It might be possible if you find a hardware or software bug in the USB interface on the chip, but the Yubikey uses a chip designed specifically for security applications. Those sorts of chips are designed and tested explicitly for security applications are tested for all sorts of attacks and and exploits, both physical and in software. I doubt it's even physically possible to craft a USB packet that is able to interfere with the ADC on the chip enough to look like a touch event, but even if it was it'd be exceedingly difficult due to the nature of how USB signaling works. You don't have much direct control at the electrical level of what actually goes down the wire.

[ Parent | on HN ]