Hacker News Reader

Comment by nickpsecurity | Hacker News Reader

I think they should only be allowed with HSM's, from cheap smartcards to full-on tamper-resistant, if it's anything of significant value unless someone opts out of them. The amount of compromises of PC's, servers, and web apps means I trust an electronic signature way less than a physical one. Need extra security especially on the RNG's, timestamps, keys, and signatures.

Note: It will probably help that the best providers of inexpensive, secure IC's are European and already all over those markets.

View on HN

If the host PC is compromised, does a cheap smartcard help? Just capture the PIN (like you would a password when they logon to their bank) and replay at will? Maybe if the user is very careful to only keep their smartcard in for the minimum time required it helps.

So long as other bank protections are in place, it shouldn't be a step backwards. If it's used to move all liability to the consumer though, then it's a problem.

If the PIN is to access it, then it at least limits the number of times the credential can be used. The credential doesn't leave the smartcard. Plus, there's security schemes like Flicker that remove basically the whole system on top of hardware from TCB. So, you can put PIN check on it.

https://www.microsoft.com/en-us/research/wp-content/uploads/...

If you use a smartcard, you should use a class2/class3 card reader with pin-pad and never enter the pin on you computer. So the machine can replace the hash that is to be signed, but cannot intercept and replay the PIN.

It's not always possible but should be whenever possible. The concept is called a trusted path: an unspoofable, un-interceptable interface between the user and the security-critical part of the system. Was required for all high-assurance security under the Orange Book. Still used in some HSM and payment sectors.

Example for other readers on p4 under Luna PCI and Igenico reader that looks like it's a kid's pocket calculator haha:

https://www.keyon.ch/de/Produkte-Loesungen/SafeNet-HSM/HSM_T...

http://www.smartcardsource.com/contents/en-ca/Ingenico_myleo...

But is reliance on proprietary security mechanisms really a sensible solution? The individual has to rely on the security, with no way to verify that there aren't any backdoors in the smartcard, for example.

You're already relying on proprietary mechanisms. They're just highly insecure. Adding in a more trustworthy component to reduce risk makes sense. It's what CPU and system vendors try to do with things like TPM and NX bits. Much better schemes out there, though.

Reply on news.ycombinator.com