Whoops, @Yubico just scored 31% on the Sony PS3 Epic Fail scale. Collect three signatures from a FIPS Yubikey and you can calculate the private key.https://www.yubico.com/support/security-advisories/ysa-2019-02/ …
-
-
I don't trust Yubico since they told me that "accidental" session hijacking in their webshop was "not a problem"
2 replies 0 retweets 7 likes -
Are there any other SSH/OpenPGP/U2F compatible USB tokens that are not crap? I know of several open source projects, but stuff using random (non-secure) microcontrollers isn't really serious.
7 replies 1 retweet 13 likes -
Last time I looked, https://www.nitrokey.com/ had both: random microcontrollers with open source firmware and designs with secure elements...
1 reply 0 retweets 12 likes -
Nitrokey looks quite interesting, but why they use mostly insecure ecc algorithms see https://safecurves.cr.yp.to ??? Only the „starter“ supports Curve25519, not sure about SECG/Koblitz
1 reply 0 retweets 2 likes -
Maybe not insecure, but unsafe...
1 reply 0 retweets 2 likes -
The problem is that AFAICT there is nothing out there that is open/auditable *and* runs on a secure MCU. All of those are NDA'ed crap. So you get to pick: insecure CPU, or unauditable code.
3 replies 1 retweet 23 likes -
Replying to @marcan42
What about the STM32L432? (Sorry, just curious what bar ‘secure mcu’ is. Not trying to troll.) https://github.com/solokeys/solo/blob/master/README.md …
1 reply 0 retweets 0 likes
Looks like a generic MCU to me, nothing intended for security. You want things like anti glitching, active mesh, hardened CPU core.
-
-
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.