Re:OnlyKey: Open-Source Alternative to YubiKey
by cr7pt0 on Thursday December 26, 2019 @11:42AM
(#21884974)
It is open source, not to be confused with open hardware which it is not. The hardware is transparent, literally, it has a clear protective coating on the hardware which allows visually verifying everything. For security things check out https://docs.crp.to/security.html - TL;DR Before you enter the PIN its not doing any crypto which means lots of side-channel attacks don't apply, you would have to know the PIN to even attempt many types of side-channel attacks.
[ Parent
| on HN ]
Re:OnlyKey: Open-Source Alternative to YubiKey
by delfinom on Thursday December 26, 2019 @10:01PM
(#21888797)
> The hardware is transparent, literally, it has a clear protective coating on the hardware which allows visually verifying everything
Right and that's bullshit. How do I know you aren't embedding a advanced joule thiefing silicon die disguised as a pull-up resistor to manipulate usb communication or even interface with the micro in a backdoor?
Re:OnlyKey: Open-Source Alternative to YubiKey
by stinos on Friday December 27, 2019 @04:04AM
(#21890088)
How do I know
Fair question. But it makes me wonder: what would be the accepted way to provide schematics/PCBs and prove the provided ones are also what gets used to create the actually sold hardware? Same question for the source code actually.
Re:OnlyKey: Open-Source Alternative to YubiKey
by thinkloop on Friday December 27, 2019 @04:09AM
(#21890100)
I don't think humanity has been able to solve that problem. There's isn't an md5 checksum for hardware yet.
Re:OnlyKey: Open-Source Alternative to YubiKey
by random3 on Thursday December 26, 2019 @11:48AM
(#21885013)
When you say open-source it's rather general. I.e. not open-source software or hardware, so it does imply it's open-source both (e.g. https://en.wikipedia.org/wiki/Open-source_hardware not "open hardware")