Hardware Section! #1713
Open
jonah
wants to merge 15 commits from
hardware into master
pull from: hardware
merge into: privacyguides:master
privacyguides:master
privacyguides:dependabot/bundler/nokogiri-1.13.6
privacyguides:dependabot/bundler/addressable-2.8.0
privacyguides:freddy-m-patch-3
privacyguides:pr-add_RemoveMyPhone_sponsor
privacyguides:pr-browser_cleanup_1257_1328_1430
privacyguides:freddy-m-patch-2
privacyguides:freddy-m-patch-1
privacyguides:pr-vpn_hated_one_video
privacyguides:cdn
privacyguides:update-nitrohorse-image
privacyguides:promote-metager-to-card
privacyguides:pr-add_azirevpn
privacyguides:pr-add_mailfence
privacyguides:shop
privacyguides:1673
privacyguides:pr/1658
privacyguides:i18n-simple
privacyguides:sponsorship-edits-nov2019
privacyguides:i18n
privacyguides:ipfs
privacyguides:blacklight447-ptio-patch-3
privacyguides:blog
privacyguides:remove-windows-icons
privacyguides:pr/1147
privacyguides:i18n-testing
privacyguides:add-beautify
Labels
Clear labels
🔍🤖 Search Engines
approved
approved, waiting for a PR
dependencies
Pull requests that update a dependency file
duplicate
feedback wanted
high priority
I2P
The Invisible Internet Project (I2P)
iOS
low priority
OS
Operating Systems
Self-contained networks
Social media
stale
A label for stalebot if it gets added
streaming
Anything related to media streaming.
todo
Tor
Anything covering the Tor network
WIP
active work in progress, do not merge or PR (yet)!
wontfix
Issues or bugs that will not be fixed and/or do not have significant impact on the project.
XMPP
Extensible Messaging and Presence Protocol
[m]
Matrix protocol
₿ cryptocurrency
ℹ️ help wanted
↔️ file sharing
⚙️ web extensions
Browser Extension related issues
✨ enhancement
❌ software removal
💬 discussion
🤖 Android
🐛 bug
💢 conflicting
📝 correction
Correction of content on the website
🆘 critical
📧 email
🔒 file encryption
📁 file storage
🦊 Firefox
Firefox & forks, about:config etc.
💻 hardware
🌐 hosting
🏠 housekeeping
Anything primarily related to site cleanup.
🔐 password managers
🧰 productivity tools
🔎 research required
🌐 Social News Aggregators
🆕 software suggestion
👥 team chat
🔒 VPN
Virtual Private Network
🌐 website issue
*Technical* issues with the website.
🚫 Windows
👁️ browsers
🖊️ digital notebooks
🗄️ DNS
Domain Name System
🗨️ instant messaging (im)
🇦🇶 translations
Anything covering a translated version of the site
Milestone
No items
No Milestone
Hardware Section
No due date set.
Dependencies
No dependencies set.
Reference: privacyguides/privacytools.io#1713
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
No description provided.
Delete Branch "hardware"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Description
https://deploy-preview-1713--privacytools-io.netlify.com/hardware/
This is a WIP draft but it's a start. TODO:
Closes: 904(Actually we should probably merge this PR and add laptops/desktops at a later date)Closes: #616 (supersedes, we will try to eventually import the useful content from that PR here)
Closes: #989 (supersedes)
Closes: #420
Closes: #1714
Closes: #1731
Related: https://github.com/privacytoolsIO/privacytools.io/issues/832#issuecomment-489236848 (Pixel+Graphene info)
Deploy preview for privacytools-io ready!
Built with commit
3576e3617ehttps://deploy-preview-1713--privacytools-io.netlify.com
Were any of my recommendations useful?
Why Nitrokeys, which are the only FLOSS option, are not listed?
Nice; glad to see a PR for a new hardware section!
@5a384507-18ce-417c-bb55-d4dfcc8883fe
link?Yes, possibly. I haven't had a chance to go through them yet.So is PTio going to be listing cryptocurrencies related information or just hardware wallets? Check this hardware wallet btw: https://shop.cobo.com/
Fantastic first draft if you ask me! Great work guys!
Is this really a good phrase to use?
Wouldn‘t it be better to say „one of the most secure“ instead of „the most secure“ ?
Also: Doesn‘t the FairPhone2 come with a modified Stock Android by default? Or does it really come with UbuntuTouch preloaded?
Apologies, I don’t really know how to participate here on github or with this repo properly..
NitroKeys is open hard- and software as far as I know?
But YubiKey‘s Hardware/firmware has never been OpenSource or audited:
Yubikey also had security issued if I remember correctly: https://www.schneier.com/blog/archives/2019/07/yubico_security.html
Good to see onlykey being mentioned as well. Don’t understand why Yubikey as closed Hardware is being privatized over onlykey.
@github-userx thats because we still have some issues with only key, mainly the points raised in #428
@blacklight447 i don’t get it, you referenced a dnscrypt issue from 2018?
@blacklight447-ptio and why no nitrokey?
@github-userx sorry that should have been issue #489 , typo on my part, sorry about that.
@5a384507-18ce-417c-bb55-d4dfcc8883fe nitrokey is going to be added.
@blacklight447 thanks ! I gotta admit I don’t like their Defensive Tone/vibe in their response to that issue.
@github-userx thats the same reason why we are a bit weary, especially as the first comment seemed to be non hostile and just a user asking well founded questions.
It could be nothing, but then again we are watching the situation from a distance. We don't want to take chances with accidentally recommending something insecure or untrustwortht.
@blacklight447 good to know that my feeling/impression of that old issue and the tone wasn’t just me being super sensitive or something lol.
It does come with Android, but it is one of the few phones supported by the Ubuntu Touch project. The point of the Worth Mentioning section there is to recommend phones for the custom ROMs we also recommend on the OS page. You still need to flash it yourself.
We did add it to the worth mentioning section if you hadn't seen:
It also clarifies the reason we recommended the Yubikey over it^
I did reorder the recommendations to list the SoloKey first, because if you only need U2F it is better than the YubiKey/NitroKey for cheaper and is also completely open-source :)
Actually I'm going to remove OnlyKey from being mentioned at all. I'm very concerned after reading #489 that the developers don't understand how hardware security works.
Specifically, I don't understand how they can make the claim that private keys can only ever exist on the device, while also allowing you to back up your keys from the device 🤔
so in this case you actually prioritize more features over fully OpenSource? I thought ptio‘s general standpoint is to always take / choose FOSS software/hardware over closed source?
apologies if I misunderstood anything, I’m not very quick brain-wise and English isn’t my native language.
It is not. It is our general standpoint to recommend the best tools for any particular task. Being open-source is a big factor, but it is not the only factor.
The biggest thing here is that the YubiKey "does it all", so to speak. It supports U2F, FIDO2, Curve25519 PGP keys, and TOTP keys. On the Nitrokey side of things...
This means that you need a minimum of two NitroKeys for similar functionality (a Pro 2 and a FIDO2 key). Three if you are dead set on Curve25519 for your private keys (a Pro 2 for TOTP codes, a Start for your PGP key, and a FIDO2 for WebAuthn), which is a reasonable assumption actually because they have a number of benefits).
You might say you don't need TOTP or OpenPGP functionality at all, so you would only need the FIDO2 key, which is fine. But in that case, we already recommend the SoloKeys, which also support FIDO2, are fully open-source, are cheaper, and come in USB-C and NFC formats.
Also, most YubiKey applications are open source. And we do not have to be concerned about malicious closed-source updates, since the firmware is read-only.
To expand on this above: most nitrokeys (except the gnuk version) and most other "open source" keys are not entirely opensource, by far the most of them still run a minimal operating system that controlls the smart card inside the usb key which is proprietary.
@blacklight447 thats good to know, thanks! I continue to rely on you guys opinions and knowledge ;)
@JonahAragon If you can let me know what issues you have with OnlyKey I will be glad to respond to and address those concerns. I think as @github-userx mentioned it would be good to see OnlyKey added to this list. You can read about OnlyKey security on our page here - https://docs.crp.to/security.html
In regards to our secure backup feature there are a few things to consider when evaluating the backup threat model.
Let me know if you would like to discuss further or have questions about this I would be happy to answer any concerns.
With the exception of the Nitrokey Start which is a rebranded version of the open-source GnuK, the Nitrokey Pro instead uses a smartcard chip as the secure element. There are no open Smartcards; although BASICcard and JavaCard allow for their own applets to be loaded onto the card, the functions of BASICcard that are implemented with power analysis and timing attacks in mind are non-free themselves and cannot be open sourced. For both JavaCard and BASICcard, the card's onboard operating system and interpreters or the JavaCard applet compilers and toolchain are non-free, even if the platform tools are.
While I fully recognize that using physical tokens represent an appreciable part of a defense in depth strategy against key compromise when combined with other security measures and proper handling of cryptographic keys, because the Nitrokey Pro uses the secure element of the smartcard as the most privileged portion of the token which actually handles the cryptographic materials. As the most privileged and important parts of the smartcard such as the card operating systems and interpreters are non-free, none of the lesser privileged items on the Nitrokey Pro should count toward the Nitrokey Pro being more meaningfully open source than the Yubikey.
Edit: 21:28 UTC for clarification.
I also should mention:
The Trezor Model T should be something worth looking into as not a bitcoin wallet, but an SSH Key tool, U2F tool, GPG token, and password manager. The workflow for it is very different, and in the case of using it for GPG, is in a pre-Alpha state. Unlike other tokens it has a backup and recovery system that does not require any secret cryptographic materials to be sent to or handled by the computer and can be entered directly on the touchscreen of the device itself.
Source code for the Trezor is at https://github.com/trezor .
Do you own one yourself? Do you happen to know whether the 24-word recovery seed backs up keys like PGP, U2F, etc., or only crypto wallets?
I did mention that in its listing:
But it seems like in both Trezor and Ledger's case, additional functionality is an afterthought. Especially with Ledger, which has some weird restrictions with its apps. I have both a Trezor One and a Ledger Nano X arriving tomorrow to test. Can't test the Model T.
One of the factors for the U2F key recommendation specifically is probably convenience. Neither Trezor nor Ledger products seem to be super convenient in the same way that a Yubikey might be with USB-C functionality, keychain form factor, NFC functionality for mobile devices, etc...
The Ledger Nano X has Bluetooth and supports iOS, but cannot currently be used as a Bluetooth U2F key on iOS [1] (or, reportedly Android). Trezor has no mobile functionality as far as I can tell which would be terrible for 99% of users.
Yes, I own one myself and can confirm that the recovery memnonic and password will back up and restore things besides the crypto wallet. At this moment, subkey functionality with GPG is not usable with keys generated from the Trezor, only with regular keys, and you would need to find a way to set the U2F counter correctly for restoring U2F so that adds another element to using it as a U2F token. Regenerating your GPG private keys also requires either a copy of the public keys, or knowing the exact timestamp at which they were created on. Customizing keying options such as cert digest algorithm for self signatures on your PGP public key certificate is also not available. However, the core functionality for GPG certifying, signing, and encryption works at this moment, experimentally. It is at this point in time likely to change and in the future could change in ways that are not going to be backwards compatible, but it does work and could be expanded upon in the future. Some ssh functions like
rsyncandscparen't working as of yet;scpis currently working but it requires a bit of an odd way and I haven't figured out how to get it to sync directories yet.I agree, it's definitely not nearly as convenient. There's no NFC, it's larger and much clunkier than the other key tokens and it's not nearly as durable. The touchscreen is definitely going to be a fragile part of it, so I wouldn't ever try to do something like put it in my pocket alongside anything like a coin or a key. I'm glad to see it is still there though!
@JonahAragon I wanted to follow up here as I didn't get a response to my previous message. I need to be able to understand the threat model you are referring to in regards to "developers don't understand how hardware security works" in order to be able to respond to your concerns.
In terms of OnlyKey hardware security we have a similar approach to that of Trezor, SoloKeys, and NitroKey. Of course its never an apple to apples comparison with hardware and these are all great products but I do want to point our a couple of key differences.
Those devices all use STM32 MCUs with flash security. A flaw has been identified in STM32 MCUs that permits bypassing the flash security and dumping the contents of flash as shown in the kraken post here
OnlyKey is the only one out of the 4 devices not using an STM32 MCU as OnlyKey utilizes a Freescale mk20dx256vlh7 MCU.
While the attack mentioned by Kraken has only been demonstrated on the Trezor's STM32, it most likely affects the Nitrokey and Solokey to some extent as they use similar STM32 MCUs. We specifically decided not to go with STM32 in our products because of these vulnerabilities. In contrast there are no known vulnerabilities in OnlyKey's Freescale flash security.
So I am trying to understand why OnlyKey, the only one of the 4 devices listed that does not use the vulnerable STM32 architecture is not being included in the list here. Additionally, OnlyKey is the only device of the 4 that requires a PIN code, Trezor supports a passphrase but it is not required by default. Giving OnlyKey another layer of security for data at rest.
I read through #489 and don't see there being any mention of claiming that private keys can only ever exist on the OnlyKey. We mentioned that private keys are stored offline, in separate hardware, but no, there are plenty of cases where your private key would exist somewhere else temporarily. I.e. You could export your private key from Protonmail and import to OnlyKey, you could export from Keybase and import to OnlyKey. We do provide specific instructions for user's that when loading keys to only do so from a trusted computer.
No technology is perfect but we do take user's privacy and security seriously, and if you find a vulnerability in OnlyKey we have a bug bounty program that will pay. The bounty is $1000 USD for things like extracting secrets from flash.
I'd suggest changing this:
Samsung Galaxy S3
(ReplicantOS)- This is the best hardware available if you wish to run ReplicantOS, however using older hardware like this inherently forces you to make significant security and usability compromises.to something like this:
Samsung Galaxy S3 or Galaxy Note II
(ReplicantOS) (postmarketOS)- This is the best hardware available if you wish to run ReplicantOS or if you want to run a GNU/Linux mobile OS such as postmarketOS, however using older hardware like this inherently forces you to make significant security and usability compromises.IDK if Samsung Galaxy S3 and Galaxy Note II are any worse than the Pinephone or the Librem 5, they both have modem isolation and are capable of running mainline Linux.
other links:
https://wiki.postmarketos.org/wiki/Samsung_Galaxy_SIII_LTE_(samsung-i9305)
https://wiki.postmarketos.org/wiki/Galaxy_Note_II_(samsung-n7100)
The worth mentioning devices were specifically chosen because of our recommendations here: https://www.privacytools.io/operating-systems/#mobile_os
If you want PostmarketOS recommended, that is worth opening as a separate software issue.
I think "Browser" should be moved within the "Software" section since there isn't more space on the nav bar when you are using Tor, or using Firefox with "privacy.resistFingerprint" activated. And I guess that PTio cares about Tor users.
Image of how it looks.
https://upload.vaa.red/2cogLr#35ceab28cc612e7397ff3ea35a67cb92
Thanks, done (issue # 1742).
We can still change this:
Samsung Galaxy S3
(ReplicantOS)- This is the best hardware available if you wish to run ReplicantOS, however using older hardware like this inherently forces you to make significant security and usability compromises.to something like this:
Samsung Galaxy S3 and Galaxy Note II
(ReplicantOS)- This is the best hardware available if you wish to run ReplicantOS, however using older hardware like this inherently forces you to make significant security and usability compromises.Works for me with privacy.resistFingerprint enabled. Might just be your screen resolution, lower than most? We can maybe still switch it though.
Mmm, yeah, my monitor is quite small. Still, I think it would fit better but that's just m opinion.
I would argue that it would be better to create a seperate issue for it, as its a bit offtopic for this pull request.
@JonahAragon Why no desktops, laptops hardware recommendations (in deploy preview)?
@kaushalyap it's difficult to find laptops and desktops that are actually good. @privacytoolsIO/editorial I think we should probably merge this PR now to have something on the site, and add PCs at a later date. More research required for those recommendations (we might even shy away from products and recommend certain components, like "look for a Ryzen laptop" for example, idk)
Aren't those pictures supposed to be svg rather than png?
I have read the page through and commented what I noticed. I am not sure whether to request changes to this, but I would like some of my feedback addressed before I would approve.
I am not certain my approval would be good here as I am not much of a hardware person, but if my approval is required and no one disagrees, I will grant it.
CC: @privacytoolsIO/editorial
@ -0,0 +3,4 @@{% include cardv2.htmltitle="Trezor One"image="/assets/img/png/3rd-party/trezor-one.png"description='A fully open-source cryptocurrency wallet with support for over 1,000 coins/tokens. Trezor also has password manager functionality, supports GPG and SSH key storage functionality, and can act as a U2F key, making it a great backup for your U2F key (or vice versa).'GPG or OpenPGP?
@ -0,0 +51,4 @@<h5><span class="badge badge-success">No Known Exploits</span></h5><p>There are no known, major <em>hardware</em> exploits for the iPhone 11 series, making them a safer choice over older iPhone models. All iPhone models up to and including the iPhone X are affected by <strong>checkm8</strong>, a permanent unpatchable bootrom exploit that <em>may</em> compromise your device's security.</p><p>This does not mean an exploit is impossible: <strong>unc0ver</strong> is an iOS 13 software exploit that affects even the iPhone 11, however it has been patched in iOS 13.3.1. Always keeping your device up-to-date is the most important step to take to keep your devices secure.</p>What are checkm8 and unc0ver? Could they be links somewhere?
@ -0,0 +61,4 @@<ul><li><a href="https://devices.ubuntu-touch.io/device/FP2">Fairphone 2</a> <span class="badge badge-info">Ubuntu Touch</span> - The Fairphone 2 is an interesting look into modular, ethical, and sustainable mobile devices with an emphasis on open source. This our preferred hardware if you wish to run Ubuntu Touch, however using older and less tested hardware like this inherently forces you to make significant security compromises.</li><li><a href="https://redmine.replicant.us/projects/replicant/wiki/GalaxyS3I9300">Samsung Galaxy S3</a> and <a href="https://redmine.replicant.us/projects/replicant/wiki/GalaxyNote2N7100">Samsung Galaxy Note II</a> <span class="badge badge-info">ReplicantOS</span> - This is the best hardware available if you wish to run ReplicantOS, however using older hardware like this inherently forces you to make significant security and usability compromises.</li>Maybe specify the model number? I happen have a Samsung Galaxy S III which apparently is incompatible with Replicant as it's i9305, not i9300 and the difference seems to be i9305 having 1GB more of RAM and maybe 4G.
This seems like something that should be in its own PR, but ok.
@ -0,0 +15,4 @@<div class="col"><h2>Turris Omnia</h2><p><strong>Turris Omnia</strong> is a secure, high performance, and open-source home router. It has specifications that would allow it to easily handle Gigabit-level networking, as well as additional functionality (NAS, printserver, or other server type use-cases).</p><p>Turris Omnia was created by <strong>NIC.CZ</strong>, the non-profit .CZ domain registry behind many massive internet open-source projects including Knot (DNS Server), BIRD (Internet routing daemon), and FRED (Domain registry platform). As such, we believe they have the experience required to make a secure routing platform.</p>I am not sure that is entirely correct about NIC.CZ, https://www.nic.cz/page/351/ as it seems to be focusing what they are into a single task?
@ -0,0 +3,4 @@{% include cardv2.htmltitle="SoloKeys"image="/assets/img/png/3rd-party/solokey.png"description='The SoloKey is the "first open-source FIDO2 security key", available in both USB-A and USB-C variants with optional NFC capability for mobile devices. It is less feature-rich compared to the YubiKey 5 lineup, but at $20 it is a great starting point for securing your accounts, or backup U2F authenticator.'I wonder if the site is using $ and € and mixing them up at times?
@ -0,0 +12,4 @@title="YubiKey 5"badges="info:Upgrade Pick"image="/assets/img/png/3rd-party/yubikey-5c.png"description='The YubiKey 5 is a multi-protocol security key, providing strong two-factor, multi-factor and passwordless authentication, and seamless touch-to-sign. It supports FIDO2, FIDO U2F, one-time password (OTP), and OpenPGP smart card functionality. It is available in a variety of form factors for desktop or laptop.'Form factors?
I wonder if the recommendations should also have a date on when were they recommended as I imagine hardware recommendations evolve a lot more than software recommendations as the physical device won't get improved while software does?
https://github.com/joeycastillo/The-Open-Book
@ -0,0 +51,4 @@<h5><span class="badge badge-success">No Known Exploits</span></h5><p>There are no known, major <em>hardware</em> exploits for the iPhone 11 series, making them a safer choice over older iPhone models. All iPhone models up to and including the iPhone X are affected by <strong>checkm8</strong>, a permanent unpatchable bootrom exploit that <em>may</em> compromise your device's security.</p><p>This does not mean an exploit is impossible: <strong>unc0ver</strong> is an iOS 13 software exploit that affects even the iPhone 11, however it has been patched in iOS 13.3.1. Always keeping your device up-to-date is the most important step to take to keep your devices secure.</p>@ -0,0 +3,4 @@{% include cardv2.htmltitle="SoloKeys"image="/assets/img/png/3rd-party/solokey.png"description='The SoloKey is the "first open-source FIDO2 security key", available in both USB-A and USB-C variants with optional NFC capability for mobile devices. It is less feature-rich compared to the YubiKey 5 lineup, but at $20 it is a great starting point for securing your accounts, or backup U2F authenticator.'I don't see Euro
@ -0,0 +15,4 @@<div class="col"><h2>Turris Omnia</h2><p><strong>Turris Omnia</strong> is a secure, high performance, and open-source home router. It has specifications that would allow it to easily handle Gigabit-level networking, as well as additional functionality (NAS, printserver, or other server type use-cases).</p><p>Turris Omnia was created by <strong>NIC.CZ</strong>, the non-profit .CZ domain registry behind many massive internet open-source projects including Knot (DNS Server), BIRD (Internet routing daemon), and FRED (Domain registry platform). As such, we believe they have the experience required to make a secure routing platform.</p>Not clear to me what you are claiming is incorrect?
@ -0,0 +3,4 @@{% include cardv2.htmltitle="Trezor One"image="/assets/img/png/3rd-party/trezor-one.png"description='A fully open-source cryptocurrency wallet with support for over 1,000 coins/tokens. Trezor also has password manager functionality, supports GPG and SSH key storage functionality, and can act as a U2F key, making it a great backup for your U2F key (or vice versa).'@dngray I forget what we prefer to use. OpenPGP?
Well it cannot be because the change was made to fit the new hardware card in the existing layout, so this is a part of this PR.
If we come up with some criteria for desktops and laptops, I can begin talking to manufacturers about their products that meet those criteria to see if we want to list them.
We have Pine64, System 76, etc. They are only Linux systems, but you get my drift. Though I can't see us listing Macbooks (though we will iOS) or Windows systems.
I like this, but I think we need to decide where the hardware line is. Not saying it's here, but we need to figure that out.
Yes, I know it doesn't quite fit with the rest of the recommendations, but it's a really good project and it's the only alternative so far to e-readers with privacy in mind. I say you shouldn't add it for now or only as worth mentioning, y'all should talk through those details.
Shouldn't it be reversed?
https://solokeys.com/
Connects to facebook.com without consent of user. I don't think we should recommend websites of products that do this.
@ -0,0 +51,4 @@<h5><span class="badge badge-success">No Known Exploits</span></h5><p>There are no known, major <em>hardware</em> exploits for the iPhone 11 series, making them a safer choice over older iPhone models. All iPhone models up to and including the iPhone X are affected by <strong>checkm8</strong>, a permanent unpatchable bootrom exploit that <em>may</em> compromise your device's security.</p><p>This does not mean an exploit is impossible: <strong>unc0ver</strong> is an iOS 13 software exploit that affects even the iPhone 11, however it has been patched in iOS 13.3.1. Always keeping your device up-to-date is the most important step to take to keep your devices secure.</p>Unc0ver has been re-updated to support all version between 11.0 and 13.5, it has been patched in the 13.5.1 and 12.4.7 update. This line need some updates.
Ok
Just curious, what's holding up this pull request?
@bionfinc several things, though mainly the fact that none of our PRs our building right now.
Instead of tresorit, I would rather choose Disroot with Lufi
https://github.com/privacytools/privacytools.io/issues/2406