TOTP Authenticator for PalmOS | Hacker News Reader

TOTP Authenticator for PalmOS

nkorth.com

186 pointsLeoPanthera65 comments

This project reminds me of a cyberpunk SF story, in which (something like) some super elite hackers, needed for a special job, chose gear old enough to be impervious to the adversary they were facing. (Not cyberdecks contemporary of the setting, but something more like modded Nintendos, which the black ice wouldn't know what to do with.)

I also had that story in mind several years ago, when the Intel Management Engine ridiculousness ticked me off, and I went to a lot of trouble to make and store half a dozen Libreboot X200 "decks".

(Though I don't do 31337 things, so I mostly only ended up using one such deck to keep an eye on my 401(k) account.)

I one purchased a Coffee Lake SFF PC from eBay from a fleet reseller, and I discovered a "ME DISABLED" sticker on the chassis when I received it.

Sure enough, every single software tool, or the BIOS/UEFI itself suggests ME is disabled, or does not exist at all. 'Features' requiring ME like Intel SGX appear as not supported.

I'm not sure how exactly they did it, and/or if there are any other modifications made to the system, but digging further is beyond my skill level.

My theory, with no evidence, is that this is an ex-govt (security/defense?) PC that somehow got sold.

IIRC, there was a non-publicly-known switch to turn off IME, for government purposes, which became publicly-known. There have also been efforts to delete just part of IME from the flash. A couple links:

https://github.com/corna/me_cleaner https://doc.coreboot.org/northbridge/intel/sandybridge/me_cl...

On X200-era systems, however, you can remove IME entirely from the flash, which is what I did. I put only Coreboot and GRUB2 on the flash, but you can add SeaBIOS to that, if you want more PC BIOS facilities and options available.

(So I stockpiled a few backup units of the X200, before they disappeared from the market, or the available units got too beaten up or expensive.)

I seen to recall having some Thinkpads which had a firmware setting that would irrecoverably break the management engine. It had a lot of scary warnings about disabling it, and likewise features like SGX wouldn't work properly from what I could tell. I think they were T460S'es, but I could be misremembering.

There is an official way to completely disable and remove Computrace (which I did on my T480), but I don't remember anything that allowed removing ME.

Do you remember the name of that story?

Not OP, but I believe it was Little Brother by Cory Doctorow: If I recall correctly, they used nodded Xboxes.

https://craphound.com/littlebrother/Cory_Doctorow_-_Little_B...

I read it a while ago, so I might be wrong, but it was a good read at any rate.

Thanks for the pointer, but I think that's probably not the particular story I was thinking of.

The intro to Cory Doctorow's story says he wrote it in 2007.

The story I'm thinking of was probably a short in an anthology that I must've bought in paperback in the early-to-mid 1990s.

It's a neat idea to parallel-invent, or to reference.

(I donated all my SF books around 2000, but now I should see whether I can find the book on Amazon or somewhere.)

Edit: It might've been in "Mirrorshades: An anthology of Cyberpunk", edited by Bruce Sterling, 1998.

I have a copy of mirrorshades at home. I don't remember that being in any of the stories. Been a while since I read it, so you may be correct.

That’s good enough for me, I’ll check Mirrorshades out, thanks so much!

Thanks! I’ll check it out along with what the original commenter guessed the book was. At worst, Little Brother will have similar themes.

I like how clearly scrollability is indicated on PalmOS, even without a scrollbar.

Feels like MacOS, chrome and edge and Windows all are pushing for 5px wide auto hidden scroll bars.

I miss the chunky touch friendly ones that were easy to use, honestly.

that said to build off your comment - everything on Palm felt extremely thought about for ease and obvious use end to end and it's part of why I absolutely miss it.

Does anyone know whether the Palm UI/UX elements are protected by IP/patents? Meaning cannot use these ideas or elements in new projects without fear of a lawsuit from whoever owns the Palm IP legacy now.

It's old enough that patents are definitely not an issue, and dead enough that trademarks are probably defunct. So any imitation/inspiration that falls short of obvious copyright infringement is unlikely to run into trouble.

UI/UX patents? Outside of the US it is hard to see how a court would validate that. IIRC they are excluded from patentability in the EU.

You can absolutely register your designs with EU patent office.

https://www.euipo.europa.eu/en/designs

Palm had the best mobile UI I've ever used. The stuff out of Apple and Android seems like candy with saturated fats by comparison.

Exactly this.

I'd go back to a modern Treo 650 any day.

This is cool. I wrote a TOTP authenticator for the ArduBoy: https://developer.okta.com/blog/2018/08/30/build-one-time-pa...

Arduboy is reeaaaally something I’m trying not to buy because it looks to be so much fun but I know It’ll die in my unused gadgets drawer.

TOTP on a GameBoy cart using a cart with an RTC would be awesome.

Most flashcarts have the RTC function so that should be doable with off-the-shelf hardware.

right, I've got one of those on my shelf here but it needs a new battery

Double awesome if it’s one of those carts that can slot another cart into it, and then you pair it with a Game Boy Camera to scan TOTP setup QR codes.

https://en.wikipedia.org/wiki/Game_Boy_Camera

And then run it in Liberty, in a Palm OS emulator :)

The linked one for J2ME phones is also fascinating: https://github.com/baumschubser/hotpants

That is really cool. I basically need two features in a phone, tethering and TOTP.

Also of interest, from a few years ago: TOTP board that fits into classic Casio F-91W wrist watch: https://news.ycombinator.com/item?id=33243434

I got a Sensor Watch Lite after reading about it here on HN. LOVE IT. I don't use the TOTP complication but I did add a number of D&D dice rolling modes.

I love mine as well, but a TOTP one would be awesome.. I'll have to look that up

Cool. I also wrote one in nuklear that works on Win9x and up, MacOS8/9/X-up, *nix and even BeOS/Haiku.

I would love to see that, especially if the project builds cleanly on all those platforms.

it does, single Makefile

Likewise.

Nice! I wrote one running in text-mode, which I ran for years on an old, non-networked, Raspberry Pi 2 (no WiFi capability on that one). I'd need to unlock my app with a password. I just reused some Java TOTP API and wrote a tiny app around it.

StyleTap https://styletap.com/ runs PalmOS apps on Android.

The juxtaposition of a TOTP with a rosary app suggests, at least to me, that you’ll need to authenticate at the pearly gates. Make sure to keep your recovery codes.

I remember when PalmOS devices were common, many "apps" available for them were of a religious nature. Various versions of The Bible were popular.

Morning Standup at a state-sponsored hacking organization

Bob: Happy Monday everybody! Before we start, just want to give a shoutout to Fred and Jane for that Ether address poisoning attack last week! I know you two really worked hard on that one!

Polite applause echos through real and virtual space.

Bob: Igor, can you get us started this morning?

Igor: Bah, I finally managed to exfiltrate metadata from my target's home TI-99/4 with combined TI BASIC and TMS9900 machine language exploit using security hole in speech synthesizer peripheral...

Bob: Igor, can you get to the point?

Igor: OK OK, bottom line, my target is hosting their TOTP authenticator on Palm OS instead of Android or iOS! I mean actual Palm Pilot, not some retro hipster pink iPhone running an emulator! Maybe if I can write and induce target to install trojaned PRC file into their Palm Pilot...

Bob: Fortunately we're a state sponsored hacking organization with considerable resources. Jeff, do you think you can help Igor?

Jeff: Yo, whatcha need?

A Palm Pilot probably wouldn't have wifi and it's a good chance it would be reasonably airgapped.

Other Palm OS devices for sure though :)

Some of us had Enfora Wifi sleds.

Haha, fair.

The literal palm pilots seemed to pre-date these wifi cards.

A Palm Pilot Pro only took a triple a battery and a 1 MB memory card. Sleds came later iirc

This feels like a normal valley office setting. With l33t stuff, I imagine rave parties like in the matrix, and hackers banging away at their keyboards doing funky things.

This is cool. You probably have to extract and transport in (SD card?) the TOTP secret, since I imagine a a QR code reader built isn't built-in.

Oh, stop it, will you? I so miss my Handspring Visor (which, already considered obsolete, I bought from WeirdStuff for a whopping $5 in mint condition some ten years ago). Lost it during one of the moves ...

There remains a niche for not connected digital assistants, methinks.

How does one use a Palm OS phone with no 4g/3g support? Can you even get 2g service anymore?

The short answer is that you can't.

Well, you can use it as a Palm device, but the phone capabilities will be forever broken :'(

By phone it meant making phone calls and not surfing, so the phone capabilities and sms capabilities were fine.

I know someone who put a private GSM cellular base station in their attic just so that their collection of retro phones would work.

I suppose that's an option. I think the FCC lets you do it without a license below a certain wattage.

That's pretty sweet. What kind of hardware is necessary for this?

I have no idea. I wonder if you could do it with some kind of SDR radio, these days.

for 2G GSM you could

Look up Osmocom, that project is the software side but their site has a lot of details on hardware too.

I think that's technically illegal but more of a "if you transmit on licensed spectrum but no one can hear it but you, does it still count?" situation.

Here in Europe the DECT guard band is often used for this and i think it's not illegal. About the US no idea but they have the 915 band right?

Not sure if you're aware, but most of the Palm OS devices weren't phones. I owned 3, none of which were (but my wife had a Centro). Only one of those 3 had wifi; everything else was via syncing with the PC over a cable (or BT in later models).

Total brain fart: For some reason I thought OP said Blackberry! I had a few Palm Pilots back in the day.. no idea what I did with them. They're pretty damn cheap on eBay.

On that note, what's the last good Blackberry with physical keyboard that could even be used today? 4g voLTE support is probably a no go.

Wifi existed. Bluetooth data existed too (Bluetooth Dial up Networking).

FINALLY

Top of The Pops?

This is what I immediately think of too.

Unfortunately, unless you're of a specific age and from the UK, the painful mental juggling act you have to go through every time you see TOTP won't be relatable.

Or you listen to a lot of 80s music :)

Time-based One-Time Password (RFC 6238).

Reply on news.ycombinator.com