Re: Tor exit nodes

[Wouter Verhelst <wouter@debian.org>]

On Fri, Oct 13, 2017 at 08:44:27AM -0400, Antoine Beaupré wrote:
> I've been really hesitant in participating in that discussion because,
> as a principle, I think this discussion should be public and we
> shouldn't have those discussions in private. But it seems everyone
> *else* doesn't care and I can't resist on this one: i'm writing a series
> about this for LWN and I have strong opinions...

FWIW, you have my explicit permission to publically quote anything I
said on this list in the past month.

> > [...]
> >> * One Yubikey model 4 is $40 (plus postage) on Amazon.com.
> >
> > The kernelconcepts.de smartcards are between €16 and €20, depending on
> > model, with volume discounts.
> >
> > If you think a credit-card sized smartcard is too bulky, you can also
> > order a model with ID000 ("SIM card") breakout (for a small surcharge),
> > and then stuff it inside a device not much larger than a USB stick.
> >
> > In addition, personally, I prefer real smartcards over the yubikey
> > anyway, but YMMV (and probably I'm biased).
> >
> > Additionally, there is https://github.com/FluffyKaon/OpenPGP-Card (a
> > GPLv3 implementation of the OpenPGP specification) which you should be
> > able to load into any JavaCard compliant smartcard. That beats the
> > yubikey in terms of freeness any time, and probably would be cheaper
> > than the kernelconcepts.de smartcards if you shop around a bit for a
> > reasonably-priced JavaCard.
> 
> So that's the *third* JavaCard-compliant card I've seen so far in my
> research, the first two being Yubico's (for the NEO) and the ANSSI's:
> 
> https://github.com/anssi-fr/smartpgp

I also remember one that lived on sourceforge, but I can't remember the
URL; and when I ddg'd for some reasonable search words, the FluffyKaon
one is what came up.

> how many of those *are* there exactly?

I have no clue ;-)

> how do they compare? how can we choose?

You can (try to) audit them, I suppose. Beyond that... I dunno.

> and if we can flash SIM cards with such firmware, can't someone just do
> the same and flash hostile firmware on the card to exfiltrate material?
> isn't that the whole argument against open applets Yubico used?

Normally, once a JavaCard has been given an applet, you cannot overwrite
that applet anymore except with the applet's explicit permission.

In some cases, you can write a second applet, but there should be no way
for the second applet to access the data of the first.

So, provided that the javacard does what the spec says it should do, it
should be safe.

Finally, since the "JavaCard" thing is only a spec anyway as well, there
is no reason why you wouldn't be able to take
https://sourceforge.net/projects/openjcvm/ and use it to make an open
hardware JavaCard...

-- 
Could you people please use IRC like normal people?!?

  -- Amaya Rodrigo Sastre, trying to quiet down the buzz in the DebConf 2008
     Hacklab