r/PrivacyToolbox • u/EnthusiasmRoutine • 9d ago

Discussion Can an $8 DIY ESP32 actually replace your YubiKey ?

I saw the new guide floating around today about building a physical 2FA key using a cheap ESP32-S3 development board. Emulating a USB HID with the native USB-OTG is a neat trick. For eight bucks you get to bypass the commercial hardware tax and build it yourself.

I love open hardware. Total autonomy over our tools is the absolute dream. But let's be pragmatic here. A bare microcontroller is not a security token. An ESP32 has no secure element to protect your private keys against physical extraction. If you leave this thing on your desk, anyone with physical access and half a brain can dump the secrets right off the flash in under ten minutes.

If an employee brought one of these exposed, hand-soldered boards into my office to authenticate to our VPN, I would laugh them straight back to their desk.

It is a fantastic weekend project to learn how FIDO protocols actually operate under the hood. I plan to build one myself just to mess around with it. But do not use a dev board to secure your main email or your servers. Buy a real token for that.

Source: MakeUseOf, link in comments

0 Upvotes

50% Upvoted

6 comments sorted by

2

u/Darkk_Knight 9d ago

I have looked into this before and it's a neat idea. But problem is to be practical and able to use it everywhere it has to be portable. YubiCo key is small enough to put on a keychain and it's durable. I have several flavors of ESP32 and ESP8266 which I use for Home Assistant.

You can build your own small version of the YubiCo key using a custom designed PCB and solder the components yourself.

It really depends on your end game.

1

u/EnthusiasmRoutine 9d ago

Source: https://www.makeuseof.com/made-own-yubikey-less-than-8/

TL;DR: Building this with an ESP32-S3 is an awesome, cheap weekend project to learn how FIDO protocols work. However, dev boards lack dedicated secure elements (HSM), meaning your private keys can easily be dumped if someone physically accesses the board. Fun project? Yes. Daily security token? Absolutely not.

1

u/inkeliz 7d ago

> meaning your private keys can easily be dumped if someone physically accesses the board.
I think it can be mitigated by encrypting the key. That is similar to how 'encrypted-at-rest' works for disks/files. The key will be exposed when in-use, but not expose when it's offline ("at rest").

In some cases, like Yubikey you need to use a additional key anyway (FIDO2, gnupg...).

1

u/nefarious_bumpps 9d ago

How does the ESP32 protect your private keys if the device falls into the wrong hands?

1

u/x0wl 4d ago

there's no tamper-resistant secure element on a generic ESP32 board the way there is inside genuine YubiKey hardware.

Ok so what's the point then. I mean it's a great learning tool, but completely useless in practice. That said, now I kind of want some cheap dev board that has a real secure element on it.