Hacker News Reader

Hacker News

Comment by xaduha | Hacker News Reader

Full thread

xaduha

I wish that SmartCards were used more for this purpose https://github.com/OpenSC/OpenSC/wiki

There's an applet you can load into your own JavaCard presumably https://github.com/LedgerHQ/ledger-u2f-javacard

View on HN

They died when everybody ditched Java applets for web.

I wish they were more useful and programmable without a Java applet (eg. Custom C/C++ driver)

Smartcards aren't dead, they are all around us in sim cards and credit cards.

> They died when everybody ditched Java applets for web.

How's that relevant? Are you saying no one uses Java anymore?

Many smart cards use an extremely minimal version of java, so I imagine that java applets were able to interact with them more easily.

I'm not saying that writing for Javacards is easy, but that's not the problem here. There is plenty of software written already

https://github.com/EnigmaBridge/javacard-curated-list

It's just didn't catch on, there's no thriving community around it. You have the software, you have the hardware (search for JCOP21 or JCOP3 on Aliexpress), but no users.

Well, Java for frontend / client side not anymore, since Java applets are insecure and can be exploited easily.

Java applets for browsers and Javacards have nothing in common except the name and the language.

The JubiKeys support a smart-card functionality.

There is a similar thing in SIM-cards, but that is under-utilized as well.

> There is a similar thing in SIM-cards

Got any good resources on this subject? I'd be interested to know more :)

I'm not entirely sure what he means by that, but SIM-cards are smartcards.

https://en.wikipedia.org/wiki/Subscriber_identity_module#/me...

And you can buy smartcards in this formfactor e.g. https://www.cardomatic.de/epages/64510967.sf/en_GB/?ObjectPa...

Look into EAP-SIM and EAP-AKA for some concrete examples.

I believe mobile payment also uses the SIM card, but I'm not sure.

For a more general overview see https://en.wikipedia.org/wiki/Universal_integrated_circuit_c....

There is apparently a toolkit to design applications to run on the SIM https://en.wikipedia.org/wiki/USIM_Application_Toolkit

I don't know of any other implementations. An SSH auth module using SIM would be pretty cool.

You mean YubiKey? I know, but it's hard for me to view YubiKey as anything other than a proprietary solution. It's great they built a business out of it, but at the same time I want open-source options to exist.

Enter Solokeys [0]. They support U2F out of the box, and they say OpenPGP (can be used for SSH) is in the works.

I've yet to receive mine, so I don't know if they work or not..

[0] https://solokeys.com

Reply on news.ycombinator.com