Hacker News

ToothPaste(brisk4t.github.io)

95 points by speckx 4 days ago | 18 comments

Because the title and name are undescriptive af:

ToothPaste allows a user to transmit AES-256 encrypted keyboard and mouse commands to any USB-compatible device wirelessly, without the need for specialized drivers or extensive set-up using WEB-BLE, a Cryptographic IC and an ESP32-S3.

[–] andunie 10 hours ago

This explanation is also not very descriptive: is it software or hardware? What exactly are the conditions in which it works?

The website is much worse though, very annoying prose that hides more than it reveals on each paragraph. I was inclined to like the project but after minutes reading I can't stand it anymore.

[–] tamimio 13 hours ago

Thanks. We live in an era where a lot are trying to bait-click and have the maximum dramatic effect to milk as much as engagement as possible.

[–] Markoff 15 hours ago

Thanks for saving me the click, here I was thinking it will be recipe for DIY toothpaste.

[–] evan_a_a 15 hours ago

BLE is not insecure if you configure the pairing process to use LE Secure Connections with authenticated pairing, which does exactly what you have implemented (ECDH key agreement). "Just Works" pairing is the only method vulnerable to MITM because it doesn't require out-of-band confirmation.

[–] SV_BubbleTime 13 hours ago

Further, “just works” Bluetooth encryption is not vulnerable most of the time. It’s only vulnerable at the instance of pairing.

It shares exchanges a pre-shared key one time at pairing then trusts that both sides will remember the PSK.

So long as you pair while there is definitely nobody around and sniffing Bluetooth traffic, it’s an excellent system.

But the author clearly wanted to go through the effort of implementing Duffy Hellman for this.

[–] alhadrad 16 hours ago

Here is a shameless plug for my project. It is a esp32 based programmable keyboard (HID) with a web interface and api. It can be directly flashed to the m5stack atom or m5stack cardputer.

One stand-out feature it has is an implementation of the Keepass KDBX database standard. The database can be stored on FRAM or SD card and can be unlocked via the web interface. The key is stored in volatile memory. There is a DSL scripting language that can be used to run macros, programs, or functions. With the database unlocked you can send credentials via key-value DSL strings such as the following example: {credstore myusername} {TAB} {credstore mypassword} {ENTER}

https://github.com/akoerner/kprox

[–] SV_BubbleTime 13 hours ago

I like the idea of a remote keyboard, but everything else is unimportant to everyone but you. Do Apple products advertise their security algorithm details? They just say “secure”, and maybe details are fine print later. I am almost exactly the target demographic for a product like this, and I haven’t really pictured how it would improve my life at all, because all I remember from reading the page is the encryption is over engineered because it seems like a fun project a guy did.

[–] eli 12 hours ago

You’re complaining about the product marketing of something that is not a product

[–] SV_BubbleTime 12 hours ago

I’m not complaining about anything. I wrote sabout keeping interest and focus. It could be a product, but even as a casual read veers into the obscure for no reason.

[–] bennyp101 17 hours ago

I love hardware projects like this, I've got a couple of things that I want to do, but then I realise I don't really know what I'm doing so I ask a LLM, but then I realise I don't know enough to know if it's actually correct or if it's just gonna fry the ESP!

Would this work with something like a TV or set-top box? Having to type in long passwords by hand is a pain, if I could just plug this in and copy/paste from the password manager on the PC that would be nice. (Admittedly its not a common issue, but its one of those "Aha I have something in the drawer for this")

[–] bdavbdav 11 hours ago

Ooh I recently vibe coded an M5 Atom S3u to act as a Bluetooth keyboard receiver to HID (for my dock, to avoid changing keyboard pairings, as well as an AP with web interface enabled by a button to allow for typing or pasting passwords into normally headless boxes/TVs etc. Except mine had no security considerations….

[–] amelius 18 hours ago

I could use this to control an android phone I have at home, which is allowed to run a banking app, and which my on-the-go phone that runs GrapheneOS cannot thanks to Google's Play Integrity™.

[–] Hyperlisk 18 hours ago

Nice work! Hardware password managers are great! While yours does a little more, perhaps, these might also be interesting:

Mooltipass: https://www.themooltipass.com/

OnlyKey: https://onlykey.io/

[–] yuryk_art 16 hours ago

The closest is actually InputStick: https://www.inputstick.com/

[–] yuryk_art 16 hours ago

For those willing to buy a device with similar functionality (and KeePass2Android integration): https://www.inputstick.com/ (I am not affiliated but am a happy user)

[–] dotancohen 18 hours ago

How do you know that shady computer won't pwn your usb device?

[–] gertlex 14 hours ago

Are USB keyboard devices frequently pwnable?

I guess when we hypothetically get to devices having agents running on them that can figure out what the random attached hardware is, and craft "useful" takeover exploits for those, there will be some interesting adjustments to considerations.

[–] dotancohen 45 minutes ago

It's a shady computer, assumed in the article to be malicious.