Timeline for How to safely use password-protected websites on internet cafe computers
Current License: CC BY-SA 3.0
11 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Sep 20, 2016 at 16:58 | comment | added | Berwyn | @Ajedi32 The Armory doesn't have any networking or any display, so it's a case of using the resources of the internet cafe computer but performing sensitive tasks on the Armory. It even makes sense if you use it with your own laptop as the attack surface for your own computer is much larger than that of the Armory | |
| Sep 20, 2016 at 16:46 | comment | added | Ajedi32 | Assuming you're talking about running the browser on the armory device, isn't this basically equivalent to saying "don't use the internet cafe's computer, bring your own"? | |
| Sep 19, 2016 at 18:30 | comment | added | user4188 | This should be edited into the answer and the comments deleted, I will delete mine. | |
| Sep 19, 2016 at 18:24 | comment | added | Berwyn | @chx As an example, vnc into the USB armory and use a browser to access a webmail service. The browser on the USB armory can be configured to autofill the password field. The password would never leave the device except over SSL to the webmail service. Your password wouldn't be exposed. | |
| Sep 19, 2016 at 17:40 | comment | added | user4188 | Well, the problem is on the server end so to speak: the vast majority of websites stubbornly insists on using passwords. This is a problem. | |
| Sep 19, 2016 at 17:17 | comment | added | Berwyn | It isn't U2F per se. You could implement U2F using it. It supports TrustZone and you can burn your own secureboot keys into fuses. | |
| Sep 19, 2016 at 15:13 | comment | added | user4188 | Is it a U2F device then? | |
| Sep 19, 2016 at 14:19 | comment | added | Berwyn | Given the number of upvotes of @chx's comment, I'm not sure if people understand what this device is. You can think of it as an HSM performing authentication on your behalf. You wouldn't use it to type a password into as that would be pointless | |
| Sep 18, 2016 at 17:47 | comment | added | Berwyn | @chx It doesn't matter if the keyboard is bugged, because you don't enter your password on it | |
| Sep 18, 2016 at 16:29 | comment | added | user4188 | Every software based solution is not good enough -- what if the keyboard is bugged? Remember when Andy Davis crammed a RasPi inside a Dell dock and tapped Ethernet VGA and keyboard and sent the data stream out on a HSDPA modem? That was fun... | |
| Sep 18, 2016 at 15:52 | history | answered | Berwyn | CC BY-SA 3.0 |