Re: Tor exit nodes

[Wouter Verhelst <wouter@debian.org>]

On Mon, Oct 09, 2017 at 04:11:21PM +0300, Lars Wirzenius wrote:
> I agree that it is pointless to just shower unineterested people with
> smartcards. However, it's also clear that it'd be good for more DDs to
> use them.
> 
> * It's not all _that_ hard to learn how to use them. There's material
>   to learn that online that works. Thus, I agree with Santiago's
>   suggestion Debian asks for interest first. Also, some of us already
>   have the hardware, and don't want more (I have, I don't).
> 
> * I think having security and crypto training at every Debconf would
>   be a good idea: how to use gpg, how to configure gpg well, how to
>   secure one's laptop, etc.
> 
> * The Yubikey 4 seems to be the best hardware option.

I'm not convinced that this is true. I have a kernelconcepts.de
smartcard, and to me that is a better option (because it fits in the
smartcard slot in my laptop). I do agree, however, that we should
encourage DDs to use smartcards where feasible.

I think we should do one of these options:
- We could have a group acquisition -- e.g., a group of X developers
  would buy X devices with Debian money just before a DebConf, have the
  batch shipped to one of them, and they are handed out at DebConf
- We could try to talk one or more of the vendors of smartcard or token
  devices into giving them to us for free. I'm sure some might be
  interested in doing that as a marketing strategy.
- If they're smartcards, maybe we can combine the "developer
  certificate" and the "gnupg smartcard" stuff into one and the same
  thing, by having them personalized ;-)

[...]
> * One Yubikey model 4 is $40 (plus postage) on Amazon.com.

The kernelconcepts.de smartcards are between €16 and €20, depending on
model, with volume discounts.

If you think a credit-card sized smartcard is too bulky, you can also
order a model with ID000 ("SIM card") breakout (for a small surcharge),
and then stuff it inside a device not much larger than a USB stick.

In addition, personally, I prefer real smartcards over the yubikey
anyway, but YMMV (and probably I'm biased).

Additionally, there is https://github.com/FluffyKaon/OpenPGP-Card (a
GPLv3 implementation of the OpenPGP specification) which you should be
able to load into any JavaCard compliant smartcard. That beats the
yubikey in terms of freeness any time, and probably would be cheaper
than the kernelconcepts.de smartcards if you shop around a bit for a
reasonably-priced JavaCard.

-- 
Could you people please use IRC like normal people?!?

  -- Amaya Rodrigo Sastre, trying to quiet down the buzz in the DebConf 2008
     Hacklab