Opinion on the Mooltipass? - Page 1
Forum section: electronics / general

author: con-f-use
author_rank: Unknown
timestamp: January 12, 2014, 09:29:19 pm
content: Since it is sort of a "big thing" on Hackaday:TheMooltipass on git......and onHackadayI'm pretty much indifferent. I don't get it. Care to get me excited?btw.Moo is in.

author: Maxlor
author_rank: Frequent Contributor
timestamp: January 13, 2014, 12:12:35 am
content: Hm there's not too much information available. It all depends on the smart card implementation though, but I can't see details about that. With a secure smart card, this might actually work, if they don't fall through one of the many crypto traps.Personally, I use LastPass with Yubikey-authentification. While I'm not happy with storing my passwords on a 3rd party server (LastPass claims they're stored in encrypted form, but I really have no way to check that,) I decided that the advantage of having secure and unique passwords for every service I use is bigger than the disadvantage of storing the passwords with them. The Yubikey acts as a security token for two factor authentication on computers I don't totally trust, like my work computer. The whole thing works pretty well for me. If I could actually run the server side on one of my own systems, it'd be perfect. Oh well.

author: gxti
author_rank: Frequent Contributor
timestamp: January 13, 2014, 05:27:44 am
content: It's a great idea, but I'm biased because I thought of it too. The downside is that it's an extra device to carry around and unlike the YubiKey it's a little too big to just clip onto your keychain. Most people are never going to care enough to pay that inconvenience, but I would.The crypto needs to be audited. I don't see any source code yet but from the README it sounds like they might not have put much thought into the cipher block mode. I'm more than happy to contribute in this area.I'm not thrilled with the choice of AVR, I would rather have seen something more powerful like a STM32. I really really hate fussing with 8 bit micros so I probably won't be contributing much, if any, code.

author: nowlan
author_rank: Frequent Contributor
timestamp: January 13, 2014, 05:53:37 am
content: Would be nice if my phone's NFC could act as token.

author: nctnico
author_rank: Super Contributor
timestamp: January 30, 2014, 11:19:20 am
content: Something like this?Extra bonus point for the one who knows which movie this screenshot is from...

author: FrankBuss
author_rank: Unknown
timestamp: January 30, 2014, 11:34:50 am
content: Quote from: nctnico on January 30, 2014, 11:19:20 amWho doesn't know The Fifth Element?

author: con-f-use
author_rank: Unknown
timestamp: January 30, 2014, 12:20:59 pm
content: Quote from: FrankBuss on January 30, 2014, 11:34:50 amI wish I didn't!

author: DomesticHacks
author_rank: Regular Contributor
timestamp: February 06, 2014, 12:09:54 pm
content: Storing the final password on a device isn't that usefull.Even when the encryption is strong enough the password still can be stolen for example by maleware, hacked websites (Adobe), keyloggers......When you are already carry a device with you I think it should at least do some kind of Two-factor authentication.At the moment I work on a open source Two-factor authentication device and already have a working prototype but it still needs some work.I will publish it on my YouTube channel when I have someting to show. Especially the software for implementing this in a webapplication needs some tweaks.

author: Marco
author_rank: Super Contributor
timestamp: February 06, 2014, 09:32:40 pm
content: Ideally my credentials shouldn't ever be on my PC at all, I just want to be able to authenticate directly to a website through something like Yubikey ... the ideal form factor for such a device would be a microsd card with a swipe sensor along it's external edge.

author: free_electron
author_rank: Super Contributor
timestamp: February 06, 2014, 09:55:47 pm
content: Quote from: FrankBuss on January 30, 2014, 11:34:50 amwhat's this 'movie' thing i keep hearing about ? some new lab tool ?

author: Marco
author_rank: Super Contributor
timestamp: February 06, 2014, 10:19:19 pm
content: Can someone explain to me why TOTP exists? It seems to offer no real advantages over a challenge/response protocol with PKI.Is it just intentional subversive distraction to keep the correct approach from going mainstream?

author: DomesticHacks
author_rank: Regular Contributor
timestamp: February 08, 2014, 06:53:13 pm
content: The advantage is that the device doesn't need a connection to the pc, smartphone, freezer, toaser....Especially for smartphones it's interesting.

author: Marco
author_rank: Super Contributor
timestamp: February 08, 2014, 07:30:05 pm
content: Hmm, yeah I didn't think that through.