Re: Tor exit nodes

[Theodore Ts'o <tytso@mit.edu>]

Something else you should consider is *why* you care about
closed-source hardware on things like Yubikey Nano's.  If the answer
is simply ideological, ala Richard Stallman --- that's a fine answer.
But then you should also be using a 9-10 year old laptop, such as the
T400, that can run Libreboot (but then the EC and battery firmware is
still not replaced, so you will *still* be running closed source
firmware).

If the answer is a security concern, OK --- but *what* security threat
are you worried about, exactly?  A yubikey does not have any external
I/O ports.  So it's not like it's going to be sending your private key
to NSA over WiFi.  The main reason why I use a Yubikey is so that if
someone hacks into my laptop they can't just steal my key right off my
hard drive.  *If* there is a backdoor which allows a bad guy (which in
your threat model, may include a state actor) to steal the key off the
Yubikey, there are two things that they could then do.  (a) they might
be able to decrypt messages sent to me that are encrypted in my
private key, or (b) they might be able to impersonate me and upload
backdoor'ed software into Debian or kernel.org.

(b) is my primary sorry --- and I would argue, should be Debian's
primary worry as well.  And in that case, if someone has gotten
physical control of my Yubikey, it's likely I will know that, and will
be able to upload a revocation certificate fairly quickly.  Even if I
don't find out for a few hours, once I *do* know when I last had
physical control of my Yubikey, I can contact the ftpmasters, and the
kernel.org admins, and they start going over the audit logs and taking
remedial action if my key was used to sign software after my key was
stolen.

So at least in my opinions, the concerns over "OMG! Yubikey is using
closed source software", is massively overblown.  If all things were
equal, sure, I would use the hardware that used open source.  But if
it is (a) slower, (b) larger, (c) much more inconvenient to use, (d)
vulnerable to environmental threats (e.g., it gets wet, and say good
bye to your keying material, all things are **not** equal.  The worst
kind of security is the security that doesn't get used because it's
too d*mned inconvenient.

						- Ted

P.S.  Nothing in this e-mail is private.  Feel free to quote me
publically, including in an LWN article.  :-)