News for hackers. Stuff that matters.

A comment on OnlyKey: Open-Source Alternative to YubiKey. Parent comment

Re:OnlyKey: Open-Source Alternative to YubiKey by groby_b on Thursday December 26, 2019 @02:04PM (#21885900)
> Being a Bitcoin hardware wallet, security is very well tested

Given the history of the cryptocurrency field, A is very far from implying B. And there's at the very least the Ledger analysis[1], which reveals several vulnerabilities. (The core issue for me is the order->backdoor->return issue - it doesn't seem there's a way to verify integrity of device or supply chain)

[1] https://www.ledger.com/our-shared-security-responsibly-discl...

[ Parent | on HN ]
Re:OnlyKey: Open-Source Alternative to YubiKey by qertoip on Thursday December 26, 2019 @04:00PM (#21886728)
Given the history of reputable Bitcoin hardware wallets, A actually does imply B. Hardware wallets are the only viable way to store cryptocurrency securely, with great track record since inception in 2014.

Regarding the supply chain, there is very little that can be done, and yubikey-like solutions certainly do not excel here. Trezor T at least comes with no firmware (to be installed by the user) and holographic sticker. Basic, but better than Yubikey et al.

[ Parent | on HN ]