Firefly – An open-source $5 DIY hardware wallet

by enricotal • 9 years ago

130 36 9 years ago

bognition• 9 years ago

The firefly certainly can transmit it has a display. I imagine an attacker could get the firefly to display enough information to extract the ether from the wallet.

tracker1• 9 years ago

It's a proof of concept, and at least passively interesting. Of course, I didn't see a "decline" button, and without a power button it could be an issue.. btle could be sufficient with a screen sleep.

Also no idea how to add currency to the wallet... that could be another issue.

DiThi3• 9 years ago

Also no idea how to add currency to the wallet... that could be another issue.

Isn't that just sending coins to an address given as QR? In the demo it shows two kinds of QR:

- Address (to deposit) - Signed transaction (to send)

And the unsigned transaction is sent via BLE (I'm guessing only one way, so while not completely air gapped, it sounds fairly secure).

yebyen4• 9 years ago

I saw another diagram of the device where it has two buttons -- one to accept (pay) and the other appears to be a power cutoff switch. I'm thinking that power cutoff will be the payment rejection button.

Also no idea how to add currency to the wallet

If you get past the crowdfunding page, you are assigned a *.firefly.eth "ENS" name. This corresponds to a wallet address. So, the same way you add currency to any other wallet. (How does it know that it has an available balance, though...)

ohazi• 9 years ago

Can you really call it an air-gap if you're using a BLE radio? I mean, yes, technically the information is transferred over the air rather than through a wire, but you wouldn't call a cell-phone an air-gapped device because it has half a zillion radios inside, many of which you can't even reliably turn off.

Looking at the recent Broadcom wifi vulnerability -- just having a phone sitting there with the radio on is enough to let an attacker gain root on some devices.

I've generally seen the term "air-gap" used to mean "as isolated as possible" -- i.e. take apart a laptop and remove all networking hardware, microphones, speakers, fill all the ports with epoxy, and connect it to an isolated battery / power supply.

If an attacker can poke at your device by sending it custom BLE packets without your knowledge, I'd argue that it doesn't qualify.

From the video:

The firefly is receive only, so it cannot be remotely hacked.

Bullshit.

shannongreen• 9 years ago

The nRF24L01 is not really a BLE radio, though the modulation is effectively the same. It supports only a very simple protocol that is proprietary to Nordic Semi. In this case it looks like they're abusing it to sniff BLE advertising packets, but it wouldn't be able to do much else.

I still agree that we shouldn't call it air-gapped, though.

avian• 9 years ago

You can send BLE advertisement packets with nRF24:

http://dmitry.gr/index.php?r=05.Projects&proj=15&proj=11.+Bl...

azurelogic2• 9 years ago

A more "air gap"-ish concept would have been a camera on the Firefly. Take a pic of a QR code on the phone, sign on the device, use the phone to take a pic of the output QR.

grizzles• 9 years ago

Another option would be to use a microphone and do an audiocap.

icebraining• 9 years ago

I'm sure an image could be generated that would crash the QR code recognizer.

hackcasual• 9 years ago

Agreed. Call it "minimal threat surface," not airgapped. Air gapped means you as the user have total control over providing it data.

dang• 9 years ago

OK, we took 'air-gapped' out of the title above.

ge96• 9 years ago

faraday cage?

brianpgordon• 9 years ago

I had the same thought. The presenter takes pains to emphasize that it cannot transmit. Is that a software limitation or a hardware limitation? If it's just software that doesn't transmit during its normal operation, the wallet could still be vulnerable to a malicious payload that turns on the radio and sends data.

yebyen4• 9 years ago

Another question about the "air-gap"

I maybe am not understanding some part of the Ethereum protocol that is important to knowing how this can work...

If the wallet is stored on the device, and the device can only receive payment requests over BLE and nothing else, and the device does not store the block chain, and the device does not have Wi-Fi to go out and ask for information about the block chain state, how can the device know its own balance, or know whether it has sufficient funds to sign a transaction?

(Can it sign transactions that it can not immediately fulfill from the stored balances? Can they be used as IOUs?)

Jayakumark• 9 years ago

Can you list the BOM with links to buy.

_b8r0• 9 years ago

Also where's the source?

escherize• 9 years ago

Could someone explain how this costs $5? Does that mean if you already have most of the parts laying around? I'm actually curious.

sowbug• 9 years ago

radio + application processor $3.18 https://m.aliexpress.com/item/1387904044.html

OLED $2.59 https://m.aliexpress.com/s/item/32233342471.html

The rest is passive junk that's probably about 25¢.

That's more than $5, but this is what 120 seconds of searching on AliExpress turned up.

Software is where a lot of the value comes from. I assume it's using a clever hack like http://dmitry.gr/index.php?r=05.Projects&proj=11.%20Bluetoot...

painted• 9 years ago

well: arduino [1]: 1.38$ nrf [2]: 0.55$ oled [3]: 2.33$ ------------------ total: 4.26$

like you said the passive components are pretty cheap, and you stay under 5$.

[1] https://www.aliexpress.com/item/EYEWINK-1pcs-lot-ATMEGA328P-... [2] https://www.aliexpress.com/item/LCD-Board-T420XW01-V2-06A39-... [3] https://www.aliexpress.com/item/Free-Shipping-Blue-0-96-inch...

yebyen4• 9 years ago

Thank you so much for showing me what I am supposed to do with my ETH credits! (Edit: Apparently I came off as astroturfing or something, I don't know why, I wanted to draw attention to the amazing ethers.io thing that is two links deep inside of this post...) This was honestly the first time I saw a great demo of what Ether can do and how it should be used, all within a browser, and also thanks to Coinbase supporting Ethereum, without even reaching for my wallet.

Edit: And the Devcon2 video behind the ethers link! This is the link that keeps on giving!

That was the easiest anyone on the internet ever took my $20. And I feel like you just showed me So Much in so few steps.

I have no idea what I just bought, or if I need to do something so that I can receive a kit? Hope your crowdfunding is successful? It says teaser, so I'm assuming that what I bought was just the ENS name, and the incredible exchange that was absolutely frictionless. I see that I have my own vanity address in there now, and I'm thinking that this is all somehow built on Ethereum ecosystem. In about 60 seconds you just completely restored my confidence that the whole Ethereum thing is absolutely incredible, and gonna take over the world.

(Not to mention I like the looks of your product/DIY thing!)

Man I feel like I'm really far behind the curve on this Ethereum thing, I learned all about Bitcoin but I never took any time to learn about Ethereum, and I feel like that was such a huge mistake. I know that it's contracts, and smart contracts, and by default accounts can't even tell you about transactions at all, until you write more something or other in a contract; and contracts are somehow JavaScript, and that's about as far as my knowledge extends about it.

I really just figured out that I needed to get some when it was worth about $90. But only just now, seeing how slick this Javascript wallet thing is that you just showed me, that you made me figure out how to keep, only now do I feel like I Really Get how much power there is in Ethereum that you don't just get "Batteries Included" like this on Bitcoin.

wheelerwj• 9 years ago

you had me until you said, "fiat ruled until ethereum came along..."

hmhrex• 9 years ago

Yeah, I think the project is really cool, and I wouldn't mind building one for fun, but that little Teaser page really turned me off.

tadam• 9 years ago

blocked by cisco umbrella

roryisok• 9 years ago

$5 is impressive - my current leather wallet cost more than that and it doesn't have any of your fancy pants air-gaps or blueteeth

yAnonymous• 9 years ago

Not interested in the wallet, but that's a nice website.

yebyen4• 9 years ago

If you didn't click around the payment gateway behind the Crowdfund link, you should check out ethers.io too.

pgl2• 9 years ago

Forgive my ignorance, but could someone explain what a "hardware wallet" is?

DiThi3• 9 years ago

A hardware wallet is a device to store cryptocurrency. When you have bitcoins or ether or whatever, you're 100% responsible of its safety, lose the keys, lose the coins. Just like cash or gold, and unlike PayPal or banks (where they owe you the quantity of your balance).

The problem is that holding keys in a PC or a phone is very risky: malware, security holes, etc. A hardware wallet allows very little communication between the key holder and the wallet usage, so the attack surface is several orders of magnitude smaller. You can even use it in a virus-ridden Windows XP machine.

edit: Another problem with crypto coin keys is that they can steal them and you won't notice until they spend the coins. Just like what happened with MtGox: they assumed there was no theft because the thiefs didn't transfer the coins immediately. With a hardware wallet you can be sure nobody else is holding your keys (but it doesn't hurt to transfer them from time to time to a new wallet, which means the coins get new keys).

pgl2• 9 years ago

Thanks for the detailed explanation.

canada_dry• 9 years ago

You can even use it in a virus-ridden Windows machine.

FTFY.

krupan• 9 years ago

Is this ethererum-only?

lowracle• 9 years ago

I wonder why use a screen/QR code to send back the signed transaction. What could an attacker do with a signed transaction you wouldn't want him to do ? It would be more user friendly to send back the transaction to the phone using the customs BLE packets

Firefly – An open-source $5 DIY hardware wallet

Related Stories