Hacker News Reader

Comment by megous | Hacker News Reader

I think my dream password manager currently is a Pinephone with a special custom UI that allows for managing and securing a list of accounts/passwords that can type them out via USB HID keyboard gadget when prompted.

No way to prompt it for data, or compromise it remotely.

No other features, no OS userspace, no wifi, no adb, no nothing. Just a Linux kernel + a tiny single userspace static binary based on lvgl for UI and libsodium for encryption/storage. Normally powered off, boots in 2 seconds. :)

View on HN

I made one of these a while ago in school, it was fun! I think it's a great idea. Mine really had nothing: an overly complicated MCU, since it was provided by the class, but otherwise no need for an OS or anything: https://benkettle.xyz/projects/password-keeper/

Nice. My wishlist also includes something similar looking with Luckfox Pico Mini + small OLED for displaying info about requests (via USB), to authorize various crypto operations with secret material stored on the device. :)

Check out Precursor (FPGA device with softcore CPU running on it for trustability).

Xous (microkernel OS for Precursor) has an application called Vault that does FIDO2/U2F as well as password management and USB HID emulation.

https://www.crowdsupply.com/sutajio-kosagi/precursor/updates...

Much more on the dev board side and probably overkill for just this purpose but a really cool device.

Yeah, very cool!

Interestingly, Pinephone is in the almost good intersection of hackable and portable: :)

https://www.crowdsupply.com/sutajio-kosagi/precursor

Tons of ways to compromise it between your computer's USB port and the server's database, though. If you already have dedicated hardware, FIDO authenticators make much more sense.

> Just a Linux kernel [...]

That's several orders of magnitude more lines of code than any FIDO authenticator implementation.

> Normally powered off, boots in 2 seconds. :)

Yubikeys boot even faster!

Yeah and also it's huge for just a password manager.

None of this is a problem.

FIDO2 works only with websites that support it.

> Tons of ways to compromise it between your computer's USB port and the server's database, though. If you already have dedicated hardware, FIDO authenticators make much more sense.

I mean, if you have the amount of access needed to compromise a USB connection, you have way more than enough access than needed to just yoink the authentication token or encryption key from browser storage.

Why a phone, though? The device doesn’t need any connectivity other than to act as a USB “keyboard,” right? Maybe a raspberry pi zero could do it.

Cheaper, with integrated display, battery, touchscreen, working software, and nice form factor for the use case, sane fully open bootloader and firmware, full documentation for everything, much more power efficient.

I do think though that just using a pinephone as just a password manager might make sense for some people (I think) but at the price of pinephone and the features you can get with it, this is really underselling it (I think)

Maybe I don't have enough money to buy a pinephone just for this purpose but even if I would have, I would personally look more into soldering (esp32?) or some single board chip (SOC?) with a touch screen sounds nice too.

Now I am not kidding, there was this dumb phone which I was using and its cost was like 12.5$ and it had the features of camera, mic , text , messaging, audio, file manager and so much more... Basically it just didn't had a browser or ability to add apps ofc since it wasn't android. But yeah I do believe that something niche could be developed for people like you at maybe 1/10th the price

Reply on news.ycombinator.com