Rendered at 19:22:35 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
pluc 6 hours ago [-]
Because the title and name are undescriptive af:
ToothPaste allows a user to transmit AES-256 encrypted keyboard and mouse commands to any USB-compatible device wirelessly, without the need for specialized drivers or extensive set-up using WEB-BLE, a Cryptographic IC and an ESP32-S3.
tamimio 2 hours ago [-]
Thanks. We live in an era where a lot are trying to bait-click and have the maximum dramatic effect to milk as much as engagement as possible.
Markoff 4 hours ago [-]
Thanks for saving me the click, here I was thinking it will be recipe for DIY toothpaste.
bdavbdav 34 minutes ago [-]
Ooh I recently vibe coded an M5 Atom S3u to act as a Bluetooth keyboard receiver to HID (for my dock, to avoid changing keyboard pairings, as well as an AP with web interface enabled by a button to allow for typing or pasting passwords into normally headless boxes/TVs etc. Except mine had no security considerations….
evan_a_a 4 hours ago [-]
BLE is not insecure if you configure the pairing process to use LE Secure Connections with authenticated pairing, which does exactly what you have implemented (ECDH key agreement). "Just Works" pairing is the only method vulnerable to MITM because it doesn't require out-of-band confirmation.
SV_BubbleTime 2 hours ago [-]
Further, “just works” Bluetooth encryption is not vulnerable most of the time. It’s only vulnerable at the instance of pairing.
It shares exchanges a pre-shared key one time at pairing then trusts that both sides will remember the PSK.
So long as you pair while there is definitely nobody around and sniffing Bluetooth traffic, it’s an excellent system.
But the author clearly wanted to go through the effort of implementing Duffy Hellman for this.
alhadrad 5 hours ago [-]
Here is a shameless plug for my project. It is a esp32 based programmable keyboard (HID) with a web interface and api. It can be directly flashed to the m5stack atom or m5stack cardputer.
One stand-out feature it has is an implementation of the Keepass KDBX database standard. The database can be stored on FRAM or SD card and can be unlocked via the web interface. The key is stored in volatile memory.
There is a DSL scripting language that can be used to run macros, programs, or functions. With the database unlocked you can send credentials via key-value DSL strings such as the following example:
{credstore myusername}
{TAB}
{credstore mypassword}
{ENTER}
I like the idea of a remote keyboard, but everything else is unimportant to everyone but you. Do Apple products advertise their security algorithm details? They just say “secure”, and maybe details are fine print later. I am almost exactly the target demographic for a product like this, and I haven’t really pictured how it would improve my life at all, because all I remember from reading the page is the encryption is over engineered because it seems like a fun project a guy did.
eli 2 hours ago [-]
You’re complaining about the product marketing of something that is not a product
SV_BubbleTime 2 hours ago [-]
I’m not complaining about anything. I wrote sabout keeping interest and focus. It could be a product, but even as a casual read veers into the obscure for no reason.
bennyp101 6 hours ago [-]
I love hardware projects like this, I've got a couple of things that I want to do, but then I realise I don't really know what I'm doing so I ask a LLM, but then I realise I don't know enough to know if it's actually correct or if it's just gonna fry the ESP!
Would this work with something like a TV or set-top box? Having to type in long passwords by hand is a pain, if I could just plug this in and copy/paste from the password manager on the PC that would be nice. (Admittedly its not a common issue, but its one of those "Aha I have something in the drawer for this")
amelius 8 hours ago [-]
I could use this to control an android phone I have at home, which is allowed to run a banking app, and which my on-the-go phone that runs GrapheneOS cannot thanks to Google's Play Integrity™.
Hyperlisk 7 hours ago [-]
Nice work! Hardware password managers are great! While yours does a little more, perhaps, these might also be interesting:
For those willing to buy a device with similar functionality (and KeePass2Android integration): https://www.inputstick.com/ (I am not affiliated but am a happy user)
dotancohen 7 hours ago [-]
How do you know that shady computer won't pwn your usb device?
gertlex 4 hours ago [-]
Are USB keyboard devices frequently pwnable?
I guess when we hypothetically get to devices having agents running on them that can figure out what the random attached hardware is, and craft "useful" takeover exploits for those, there will be some interesting adjustments to considerations.
ToothPaste allows a user to transmit AES-256 encrypted keyboard and mouse commands to any USB-compatible device wirelessly, without the need for specialized drivers or extensive set-up using WEB-BLE, a Cryptographic IC and an ESP32-S3.
It shares exchanges a pre-shared key one time at pairing then trusts that both sides will remember the PSK.
So long as you pair while there is definitely nobody around and sniffing Bluetooth traffic, it’s an excellent system.
But the author clearly wanted to go through the effort of implementing Duffy Hellman for this.
One stand-out feature it has is an implementation of the Keepass KDBX database standard. The database can be stored on FRAM or SD card and can be unlocked via the web interface. The key is stored in volatile memory. There is a DSL scripting language that can be used to run macros, programs, or functions. With the database unlocked you can send credentials via key-value DSL strings such as the following example: {credstore myusername} {TAB} {credstore mypassword} {ENTER}
https://github.com/akoerner/kprox
Would this work with something like a TV or set-top box? Having to type in long passwords by hand is a pain, if I could just plug this in and copy/paste from the password manager on the PC that would be nice. (Admittedly its not a common issue, but its one of those "Aha I have something in the drawer for this")
Mooltipass: https://www.themooltipass.com/
OnlyKey: https://onlykey.io/
I guess when we hypothetically get to devices having agents running on them that can figure out what the random attached hardware is, and craft "useful" takeover exploits for those, there will be some interesting adjustments to considerations.