Firefly – An open-source $5 DIY hardware wallet | Hacker News Reader

Firefly – An open-source $5 DIY hardware wallet

firefly.city

130 pointsenricotal36 comments

Can you really call it an air-gap if you're using a BLE radio? I mean, yes, technically the information is transferred over the air rather than through a wire, but you wouldn't call a cell-phone an air-gapped device because it has half a zillion radios inside, many of which you can't even reliably turn off.

Looking at the recent Broadcom wifi vulnerability -- just having a phone sitting there with the radio on is enough to let an attacker gain root on some devices.

I've generally seen the term "air-gap" used to mean "as isolated as possible" -- i.e. take apart a laptop and remove all networking hardware, microphones, speakers, fill all the ports with epoxy, and connect it to an isolated battery / power supply.

If an attacker can poke at your device by sending it custom BLE packets without your knowledge, I'd argue that it doesn't qualify.

From the video:

The firefly is receive only, so it cannot be remotely hacked.

Bullshit.

The nRF24L01 is not really a BLE radio, though the modulation is effectively the same. It supports only a very simple protocol that is proprietary to Nordic Semi. In this case it looks like they're abusing it to sniff BLE advertising packets, but it wouldn't be able to do much else.

I still agree that we shouldn't call it air-gapped, though.

You can send BLE advertisement packets with nRF24:

http://dmitry.gr/index.php?r=05.Projects&proj=15&proj=11.+Bl...

A more "air gap"-ish concept would have been a camera on the Firefly. Take a pic of a QR code on the phone, sign on the device, use the phone to take a pic of the output QR.

Another option would be to use a microphone and do an audiocap.

I'm sure an image could be generated that would crash the QR code recognizer.

I'm just critiquing the air gap design/claim. Getting a malicious QR code in front of the camera would either require the attacker to gain physical access to the device, at which point it is game over for any device, or they would have to compromise the app presenting the first QR code. This would be a problem regardless of the air gap design for something like this, even if you had to enter the data by hand into the device.

If I understood correctly, the wireless transmission is one way. So the attacker would ask the wallet to sign a transaction, then the confirm button would be mistakingly pressed... and you have to scan the screen to be able to send that transaction.

Possible problem: The attacker sends a transaction at the same time (or just before) a legit one is sent.

Not a big deal: The user is asked to send a specific quantity to a specific address on the screen. If somehow the user didn't check or the attacker fooled him with the same quantity etc, the picture still has to be taken and check it is the same transaction. Additionally, the wireless communication can have a second authentication factor.

Sure? A possibility, but sure?

Agreed. Call it "minimal threat surface," not airgapped. Air gapped means you as the user have total control over providing it data.

OK, we took 'air-gapped' out of the title above.

Another question about the "air-gap"

I maybe am not understanding some part of the Ethereum protocol that is important to knowing how this can work...

If the wallet is stored on the device, and the device can only receive payment requests over BLE and nothing else, and the device does not store the block chain, and the device does not have Wi-Fi to go out and ask for information about the block chain state, how can the device know its own balance, or know whether it has sufficient funds to sign a transaction?

(Can it sign transactions that it can not immediately fulfill from the stored balances? Can they be used as IOUs?)

I had the same thought. The presenter takes pains to emphasize that it cannot transmit. Is that a software limitation or a hardware limitation? If it's just software that doesn't transmit during its normal operation, the wallet could still be vulnerable to a malicious payload that turns on the radio and sends data.

faraday cage?

Forgive my ignorance, but could someone explain what a "hardware wallet" is?

A hardware wallet is a device to store cryptocurrency. When you have bitcoins or ether or whatever, you're 100% responsible of its safety, lose the keys, lose the coins. Just like cash or gold, and unlike PayPal or banks (where they owe you the quantity of your balance).

The problem is that holding keys in a PC or a phone is very risky: malware, security holes, etc. A hardware wallet allows very little communication between the key holder and the wallet usage, so the attack surface is several orders of magnitude smaller. You can even use it in a virus-ridden Windows XP machine.

edit: Another problem with crypto coin keys is that they can steal them and you won't notice until they spend the coins. Just like what happened with MtGox: they assumed there was no theft because the thiefs didn't transfer the coins immediately. With a hardware wallet you can be sure nobody else is holding your keys (but it doesn't hurt to transfer them from time to time to a new wallet, which means the coins get new keys).

Thanks for the detailed explanation.

> You can even use it in a virus-ridden Windows machine.

FTFY.

Could someone explain how this costs $5? Does that mean if you already have most of the parts laying around? I'm actually curious.

radio + application processor $3.18 https://m.aliexpress.com/item/1387904044.html

OLED $2.59 https://m.aliexpress.com/s/item/32233342471.html

The rest is passive junk that's probably about 25¢.

That's more than $5, but this is what 120 seconds of searching on AliExpress turned up.

Software is where a lot of the value comes from. I assume it's using a clever hack like http://dmitry.gr/index.php?r=05.Projects&proj=11.%20Bluetoot...

well: arduino [1]: 1.38$ nrf [2]: 0.55$ oled [3]: 2.33$ ------------------ total: 4.26$

like you said the passive components are pretty cheap, and you stay under 5$.

[1] https://www.aliexpress.com/item/EYEWINK-1pcs-lot-ATMEGA328P-... [2] https://www.aliexpress.com/item/LCD-Board-T420XW01-V2-06A39-... [3] https://www.aliexpress.com/item/Free-Shipping-Blue-0-96-inch...

Not interested in the wallet, but that's a nice website.

If you didn't click around the payment gateway behind the Crowdfund link, you should check out ethers.io too.

you had me until you said, "fiat ruled until ethereum came along..."

Yeah, I think the project is really cool, and I wouldn't mind building one for fun, but that little Teaser page really turned me off.

Can you list the BOM with links to buy.

Also where's the source?

$5 is impressive - my current leather wallet cost more than that and it doesn't have any of your fancy pants air-gaps or blueteeth

I wonder why use a screen/QR code to send back the signed transaction. What could an attacker do with a signed transaction you wouldn't want him to do ? It would be more user friendly to send back the transaction to the phone using the customs BLE packets

The firefly certainly can transmit it has a display. I imagine an attacker could get the firefly to display enough information to extract the ether from the wallet.

It's a proof of concept, and at least passively interesting. Of course, I didn't see a "decline" button, and without a power button it could be an issue.. btle could be sufficient with a screen sleep.

Also no idea how to add currency to the wallet... that could be another issue.

I saw another diagram of the device where it has two buttons -- one to accept (pay) and the other appears to be a power cutoff switch. I'm thinking that power cutoff will be the payment rejection button.

> Also no idea how to add currency to the wallet

If you get past the crowdfunding page, you are assigned a *.firefly.eth "ENS" name. This corresponds to a wallet address. So, the same way you add currency to any other wallet. (How does it know that it has an available balance, though...)

> Also no idea how to add currency to the wallet... that could be another issue.

Isn't that just sending coins to an address given as QR? In the demo it shows two kinds of QR:

- Address (to deposit) - Signed transaction (to send)

And the unsigned transaction is sent via BLE (I'm guessing only one way, so while not completely air gapped, it sounds fairly secure).

blocked by cisco umbrella

Is this ethererum-only?

Thank you so much for showing me what I am supposed to do with my ETH credits! (Edit: Apparently I came off as astroturfing or something, I don't know why, I wanted to draw attention to the amazing ethers.io thing that is two links deep inside of this post...) This was honestly the first time I saw a great demo of what Ether can do and how it should be used, all within a browser, and also thanks to Coinbase supporting Ethereum, without even reaching for my wallet.

Edit: And the Devcon2 video behind the ethers link! This is the link that keeps on giving!

That was the easiest anyone on the internet ever took my $20. And I feel like you just showed me So Much in so few steps.

I have no idea what I just bought, or if I need to do something so that I can receive a kit? Hope your crowdfunding is successful? It says teaser, so I'm assuming that what I bought was just the ENS name, and the incredible exchange that was absolutely frictionless. I see that I have my own vanity address in there now, and I'm thinking that this is all somehow built on Ethereum ecosystem. In about 60 seconds you just completely restored my confidence that the whole Ethereum thing is absolutely incredible, and gonna take over the world.

(Not to mention I like the looks of your product/DIY thing!)

Man I feel like I'm really far behind the curve on this Ethereum thing, I learned all about Bitcoin but I never took any time to learn about Ethereum, and I feel like that was such a huge mistake. I know that it's contracts, and smart contracts, and by default accounts can't even tell you about transactions at all, until you write more something or other in a contract; and contracts are somehow JavaScript, and that's about as far as my knowledge extends about it.

I really just figured out that I needed to get some when it was worth about $90. But only just now, seeing how slick this Javascript wallet thing is that you just showed me, that you made me figure out how to keep, only now do I feel like I Really Get how much power there is in Ethereum that you don't just get "Batteries Included" like this on Bitcoin.

Reply on news.ycombinator.com