Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

A private key for curve p256 is 32-bytes. Let's say we have associated metadata (hostname, whatever) and round that up to 1KiB per key.

A typical user has around 200 accounts but let's give room for 1000 since powerusers love hardware keys.

That's 1000 x 1KiB = 1MiB. This is totally within our technical capabilities. It's not uncommon for small radio coprocessors to have more storage on die. Even old school SIM cards have 256KiB worth.



You aren't buying a USB mass storage device when buying a security key. Completely different product, different requirements.


No I'm buying a USB minimum storage device with a micro controller embedded and potted under some very hard plastics. Very much the same thing. Function different yes, manufacturing when it comes down to it. Exactly the same. I could print wafer for your security key, I could print wafer for your flash memory. IC's arent manufactured differently in security keys to normal IC's. The product is the same silicon just doped differently to make a different ic/circuit. its a small computer in a USB. it does a limited function. Stop making them out like they are some wizard stick fancy stuff. You can setup a ESP32 as a security key if you want.


> Stop making them out like they are some wizard stick fancy stuff

But they are. Tamper resistance is a thing, and it's different from the engineering perspective. That's why Yubikey and FST-01 are entirely different beasts.

Most folks probably don't need tamper resistant hardware, though. I mean, they've been doing fine with sticky notes on a monitor...


Most folks are better off with notebook in the table next to their bed/desk for passwords than anything else. Whens the last time you got broken into at home and someone stole your diary? Whens the last time you read about someone getting breached because they had their passwords written down in a book next to their desk? Pretty much never.

Whens the last time someone got breached storing their PW somewhere digital? well shit probably a dozen happening every second and a few dozen breaches somewhere in the world before your done reading this.


The caveat is that you have to carry this notebook with you, or you're locked out and won't be able to access anything if you're not home.

And, well, bags get stolen on a daily basis, probably even more frequently than digital password stores.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: