ninjashogun: BingoBoingo: I hate to be the one to break it to you. I thought you heard. /. had a stroke and is in a nurinsg home :(

ninjashogun: asciilifeform, the way a tunnelled layer works, is it's OK to give a copy of every bit to an Evesdropper, they still can't make out the plain text.

ninjashogun: dignork - you misinterpret my tone if you think I'm arguing. I like the idea of the Cardano very much, I think it's a genuine, useful, good, and non-obvious innovation, and I encourage asciilifeform in building it and getting it to market.

ninjashogun: maybe 20 years is too long for a patent to be valid - then consider donating it after 3 years or 7 years. You can assign it to a protective Open Source patent fund.

ninjashogun: asciilifeform, the fact is, if you want to get this into millions of people's hands you will have to invest half a million in research and manufacturing. it could be the only secure device in their whole household (if they run windows.)

ninjashogun: asciilifeform - how could it be kept from the public? Wouldn't every electrical engineer with a scope see it?

ninjashogun: the basic thing that you came up with is an escrowed key service embodied in a physical device that does not disclose the key, but uses it and discloses the result. This is a very good invention.

ninjashogun: asciilifeform, by the way don't let the haters take anyting away. All of my suggestoin are at a single layer - and do not in ANY way impact the basic idea you've come up with with mircea_popescu --- which is a VERY good one. I don't really add anything in my suggestoins - it is the same design. You should patent it.

ninjashogun: on http://trilema.com/2013/how-to-airgap-a-practical-guide/ - I would also suggest running several copies of hte same hardware next to each other. If they're all doing something, how is someone going to know which is the one that is of interest. This can even subvert someone physically ocming in and using it in your absence.

ninjashogun: dignork - but then they could no longer treat it as a mass-storage device.

ninjashogun: dignork - yes, it would also be a good idea.

ninjashogun: Again, none of this is to take away from the design as I've already read about it here. I like it a lot.

ninjashogun: I don't think packet sniffing is a problem if you tunnel over it.

ninjashogun: Better than it can a usb subsystem, yes.

ninjashogun: on an iPad and iPhone, you can copy the text, connect to the brick's wifi, paste it, copy the result, and then reconnect to your normal wifi. These things don't have a USB stack at all.

ninjashogun: asciilifeform, if I can have up to a 3 year grace period I would accept that with the full $22.5K.

ninjashogun: dignork - hmmm.. Well, on Mac and Linux you could do an md5sum or sha1sum on the javascript before you run it. On Windows you can only use a custom certificate, signed by yourself, and know the issuer.

ninjashogun: the wifi connects either a) to your device or b) to a MITM that connects to your device

ninjashogun: it makes sense to me. You can always assume any computer will have javascript, and a wifi.

ninjashogun: dignork, it doesn't matter who firefox trusts. You can run a complete tunnel using javascript all the way to the final end-point. The whole point of PKI is that it doesn't matter who sniffs packets.

ninjashogun: However, the current version transfers files in the plain over the USB protocol. it is 100% vulnerable to a USB mitm - which could probably be made so small that it almost fits in a usb drive.

ninjashogun: asciilifeform, packet capture is not a concern because you can establish a higher secure channel from Firefox on the computer all the way to the final device. This is possible because hte device can have a known fingerprint.

ninjashogun: What changes with Wifi? Well, you can still have a man in the middle, but it would be much more prohibitive. It would need a complete access point that connects to the device masquarading as the computer, while exposing itself to the computer and hiding the true signal from the computer. It's possible, but more difficult. And in the end the computer can do a complete secure session (in javascript with the browser) compl

ninjashogun: BingoBoingo, also, in my personal opinion as a security observer, a man in the middle attack with a PC (or laptop) being opened, and a second usb host being inserted between the real USB and the device, whose purpose is to subtlely alter what is being signed, is a very real risk.

ninjashogun: But this is not to detract from what you've done, asciilifeform (and mircea_popescu ?) Overall the device is a VERY good step.

ninjashogun: I think there are a lot of unknowns over USB and it is a frequently underestimated attack vector, with very little security research being done.

ninjashogun: it could also come iwth storage, so that it could be used as a "wireless storage device" (thru the browser). rather than have to plug and unplug a usb stick.

ninjashogun: it would also save a connect and disconnect. And can be done unobtrusively at a computer, without having to insert a USB stick.

ninjashogun: this suggestion isn't for the current version, which as a piece of hardware is great.

ninjashogun: is more resilient than a USB stack against, for example, man in the middle attacks (if someone knows that you will use that usb drive they could put a fake USB controller in that MITM attacks it.

ninjashogun: asciilifeform, I have a suggestion for your next version. My suggestion is that the air gap with the computer be maintained, by running (a different brick) that is a wireless access point. You can connect to its wifi and use Firefox on localhost to upload and sign or upload and encrypt/decrypt files, which it would then serve back. This requires a computer with access to WIFI. However, I think in general a network stack

ninjashogun: anyway it's a good intro :)

ninjashogun: The ones I know that made a killing did so by immigrating to the United States :)

ninjashogun: I'm generalizing, but only a little bit.

ninjashogun: asciilifeform, can you imagine doing due dilligence on a company that isn't even registered? That means only best friends can invest. Your pool of potential investors is literally limited to 7-20 people, no matter who you are in Romania. (Because that's how many people you trust through highschool.)

ninjashogun: it's a cultural issue.

ninjashogun: You can convince yourself of this fact by being nearly 100% sure that more than $190B in wealth would be created if 10,000 qualified engineering and bioscience etc grad student founders were funded at $200K each for 100 years. It's not a lottery - it's just some unusual percentages.

ninjashogun: You can know this for a fact ,because

ninjashogun: mircea_popescu, I think your model is a very, very fair one under normal circumstances. (Such as the Efficient Market Hypothesis.) However, I have very deep theoretical proof that your model is mistaken, and that these founders were in fact leveraging the same opportunity inefficiency that I am.

ninjashogun: mircea_popescu, fine. AirBNB had to sell Cereal. Yes Cereal. To fund their idea of a C2C ebay of Rentals.

ninjashogun: asciilifeform, again, this is why I mention that Steve Jobs (a kid who stole $5000 from his best and only friend to start Apple), Mark Zuckerberg (a guy who scammed a map website guy out of $2000 to start facebook), and Larry Page (a poor grad student who had to give $50B away in equity to get an immigrant to code up his Larry Page Rank), also did not have the means to play.They couldn't play. They did anyway.

ninjashogun: But you can't show an investor a mockup, and a bundle of wires, and say, imagine if the latter looked like the former!

ninjashogun: Note that the wireless portion doesn't exist at all. I don't even have a specan (spectrum analyzer). The only eqiupment I developed is with large arduinos, as well as mockups of what it could look like.

ninjashogun: I don't mean to say anything about hte level of ambition you have in your hardware startup but usually a certified lab for developing ours costs $60K, which I am going to do on about $8K in used eBay equipment.

ninjashogun: asciilifeform, did you already discuss a $7M investment, implying a valuaiton of $15M, with a VC who has recently made a $400M exit in another consumer hardware company?

ninjashogun: asciilifeform, I know how one "traditionally" secures capital, but it is usually against assets such as a house, etc.