Re:OnlyKey: Open-Source Alternative to YubiKey
by michaelt on Thursday December 26, 2019 @03:34PM
(#21886520)
There’s the U2F Zero https://github.com/conorpp/u2f-zero/wiki/Building-a-U2F-Toke... but of course there’s always a reflections-on-trusting-trust issue: you’ve got to get your CPU, CPU design, compiler, firmware and chip programmer somewhere!
Of course, an accidental software bug is probably more likely than intentionally backdoored hardware targeting you personally...
Re:OnlyKey: Open-Source Alternative to YubiKey
by ncmncm on Thursday December 26, 2019 @03:35PM
(#21886529)
That all sounds to me like security theater. It would not increase my confidence in the device, its firmware, or its design.
Re:OnlyKey: Open-Source Alternative to YubiKey
by nine_k on Thursday December 26, 2019 @10:32PM
(#21888951)
Why?
Backdooring a shipment of security tokens could open interesting possibilities at a relatively low cost. Or the government may force you if you happen to be in Australia.
Flashing your own firmware which you have checked (or at least checked its signature) may make sense.
Optionally for first line of defense, the assembly could be fastened with some less common like a torx or square screw head and it could come with a pack of small holographic security stickers to place over the screw.
Edit: You'd want it to be an unassembled kit so that you can provide your own hardware if you wanted instead of relying on what is provided for you if you wanted to be super cautious.