totp/nfc/crypto

[adammorley]

I currently use a random fido/u2f token and predominately use totp since many sites don't support fido2 (some [eg kraken] do support the proprietary yubikey protocol which is uber annoying). I've found that other than creaky old US banks from horse drawn carriage days, totp is fairly standard.

Having a way to store some data would be nice --- not a lot, few KiB or 1-2 MiB.

I liked that you used epoxy and made the devices durable, others are ok but not quite as good. doing totp over nfc is pretty important imho, since apple has their walled garden lifestyle.

Also, if you expanded to support a hw wallet store for crypto you could have a very successful product esp. with the buzz around unstoppabledomains.com and username based crypto addressing on the eth name service. But that's probably more of a team adventure.

[My1]

Also, if you expanded to support a hw wallet store for crypto you could have a very successful product

not really. a cryptocoin wallet without a screen is a problem.

[My1]

why that? if you dont have a screen on a cryptocoin wallet you cannot confirm where to send from an actually secure location as the base assumption when using a hw wallet is that the computer phone etc is compromised. why do you think that all the relevant hw wallets nowdays have a screen

[bleem313]

I think the idea would be to use it the same way the TOTP app is used. The phone doesn't store anything, the secrets are stored on the hw key. You would open the app and tap the key to get the info on the phone's display like TOTP. This may not be a use case you would want, but seems to be a use case @adammorley would like.

[My1]

problem tho is that if one would use the solo as a hw wallet and gets their coins stolen due to the design obviously not being suited for the purpose as someone could just replace the target address for the wallet to sign they would blame solo.

TOTP has very different implications than a hardware wallet.

[bleem313]

They are differently different, but the key is already capable of storing secrets like a piv card. The key can be made to only allow a change via USB and with a pin for example. You can limit the NFC interface to only the public key or only releasing the key after a pin (more complicated and may not be possible on this HW). Even if it only allows the wallet over USB after pin it would be a better option than storing directly on the phone or computer.

[My1]

well it's different but a hardware wallet without visual confirmation of intent is almost no better than just using a software wallet, at least on those you generally know to be careful.

[bleem313]

A maintainer mentioned in a different post here that TOTP is planned as an example app for the framework down the road. I think the stretch goal is there to move it from down the road to sooner.

#18 (reply in thread)

[nickray]

Short update on this: Trussed is open sourced, some more details here:

#10 (comment)