Hacker News new | ask | show | jobs
by rdl 4695 days ago
There are simple APIs on iOS (and I believe on Android) which allow you to protect private keys and other data in local storage. Once the iPhone 5S with biometrics comes out (90% likely in September), this will be even more meaningful.
1 comments
markkum 4695 days ago
Well, yes and no. On iOS you can somewhat rely on keychain, but when the device is jailbroken all the local "simple API" security is gone. Generic Android doesn't really have anything that I would call secure, so there a serious solution needs some heavy lifting.

And yes, the pals at AuthenTec had some cool biometric and related stuff when I worked with them :), before they were swallowed by Apple. I'm certainly looking forward to what Apple will launch ... but a fingerprint does not magically solve all the issues.

link
rdl 4695 days ago
Android manufacturers have a few similar extensions (Samsung and HTC, at least), although I haven't started messing with them yet.
link
DuskStar 4695 days ago
Still, Android also has root. You're trying to keep a superuser from being able to access a file...
link
rdl 4695 days ago
The awesome/amazing thing is you can actually do this in properly designed systems -- the key is generated on a separate processor (or, on some ARMs, in a special processor mode), and inaccessible directly to everything else; it can only be used to do operations. If you're superbadass, you can let it put some kinds of access control logic inside the trusted envelope too, so you can rate limit requests, or do additional checks (i.e. "you can't sign a request to pay a bitcoin unless the request signature is valid AND the bitcoin address has >4x that amount, or 2 weeks pass after posting public notice...").

HSMs can do this (no one really does, though); smartcards can too. The problem is no one wants to physically plug a smartcard into a phone, so you're stuck using stuff physically built into the phone. The alternative would be a bt 4.0 le cardholder which talks to the phone, and contains either an internal smartcard or a smartcard slot.

For DOD, there's a badgeholder for the CAC which speaks bluetooth (old, 2.1 I think) to the RIM Blackberry. Updating that to 2013 to work on the iPhone would be pretty awesome, using 4.0le, particularly with a decent smartcard (not sure what the state of the art is; I remember screwing with old javacard stuff with the iButton which sucked.)

link
limmeau 4695 days ago
"no one wants to physically plug a smartcard into a phone"

SIM cards come to mind.

link