ToothPaste allows a user to transmit AES-256 encrypted keyboard and mouse commands to any USB-compatible device wirelessly, without the need for specialized drivers or extensive set-up using WEB-BLE, a Cryptographic IC and an ESP32-S3.
This explanation is also not very descriptive: is it software or hardware? What exactly are the conditions in which it works?
The website is much worse though, very annoying prose that hides more than it reveals on each paragraph. I was inclined to like the project but after minutes reading I can't stand it anymore.
BLE is not insecure if you configure the pairing process to use LE Secure Connections with authenticated pairing, which does exactly what you have implemented (ECDH key agreement). "Just Works" pairing is the only method vulnerable to MITM because it doesn't require out-of-band confirmation.
Here is a shameless plug for my project. It is a esp32 based programmable keyboard (HID) with a web interface and api. It can be directly flashed to the m5stack atom or m5stack cardputer.
One stand-out feature it has is an implementation of the Keepass KDBX database standard. The database can be stored on FRAM or SD card and can be unlocked via the web interface. The key is stored in volatile memory.
There is a DSL scripting language that can be used to run macros, programs, or functions. With the database unlocked you can send credentials via key-value DSL strings such as the following example:
{credstore myusername}
{TAB}
{credstore mypassword}
{ENTER}
I like the idea of a remote keyboard, but everything else is unimportant to everyone but you. Do Apple products advertise their security algorithm details? They just say “secure”, and maybe details are fine print later. I am almost exactly the target demographic for a product like this, and I haven’t really pictured how it would improve my life at all, because all I remember from reading the page is the encryption is over engineered because it seems like a fun project a guy did.
I’m not complaining about anything. I wrote sabout keeping interest and focus. It could be a product, but even as a casual read veers into the obscure for no reason.
I love hardware projects like this, I've got a couple of things that I want to do, but then I realise I don't really know what I'm doing so I ask a LLM, but then I realise I don't know enough to know if it's actually correct or if it's just gonna fry the ESP!
Would this work with something like a TV or set-top box? Having to type in long passwords by hand is a pain, if I could just plug this in and copy/paste from the password manager on the PC that would be nice. (Admittedly its not a common issue, but its one of those "Aha I have something in the drawer for this")
I could use this to control an android phone I have at home, which is allowed to run a banking app, and which my on-the-go phone that runs GrapheneOS cannot thanks to Google's Play Integrity™.
Ooh I recently vibe coded an M5 Atom S3u to act as a Bluetooth keyboard receiver to HID (for my dock, to avoid changing keyboard pairings, as well as an AP with web interface enabled by a button to allow for typing or pasting passwords into normally headless boxes/TVs etc. Except mine had no security considerations….
For those willing to buy a device with similar functionality (and KeePass2Android integration): https://www.inputstick.com/ (I am not affiliated but am a happy user)
I guess when we hypothetically get to devices having agents running on them that can figure out what the random attached hardware is, and craft "useful" takeover exploits for those, there will be some interesting adjustments to considerations.
Because the title and name are undescriptive af:
ToothPaste allows a user to transmit AES-256 encrypted keyboard and mouse commands to any USB-compatible device wirelessly, without the need for specialized drivers or extensive set-up using WEB-BLE, a Cryptographic IC and an ESP32-S3.
This explanation is also not very descriptive: is it software or hardware? What exactly are the conditions in which it works?
The website is much worse though, very annoying prose that hides more than it reveals on each paragraph. I was inclined to like the project but after minutes reading I can't stand it anymore.
Thanks. We live in an era where a lot are trying to bait-click and have the maximum dramatic effect to milk as much as engagement as possible.
Thanks for saving me the click, here I was thinking it will be recipe for DIY toothpaste.
BLE is not insecure if you configure the pairing process to use LE Secure Connections with authenticated pairing, which does exactly what you have implemented (ECDH key agreement). "Just Works" pairing is the only method vulnerable to MITM because it doesn't require out-of-band confirmation.
Further, “just works” Bluetooth encryption is not vulnerable most of the time. It’s only vulnerable at the instance of pairing.
It shares exchanges a pre-shared key one time at pairing then trusts that both sides will remember the PSK.
So long as you pair while there is definitely nobody around and sniffing Bluetooth traffic, it’s an excellent system.
But the author clearly wanted to go through the effort of implementing Duffy Hellman for this.
Here is a shameless plug for my project. It is a esp32 based programmable keyboard (HID) with a web interface and api. It can be directly flashed to the m5stack atom or m5stack cardputer.
One stand-out feature it has is an implementation of the Keepass KDBX database standard. The database can be stored on FRAM or SD card and can be unlocked via the web interface. The key is stored in volatile memory. There is a DSL scripting language that can be used to run macros, programs, or functions. With the database unlocked you can send credentials via key-value DSL strings such as the following example: {credstore myusername} {TAB} {credstore mypassword} {ENTER}
https://github.com/akoerner/kprox
I like the idea of a remote keyboard, but everything else is unimportant to everyone but you. Do Apple products advertise their security algorithm details? They just say “secure”, and maybe details are fine print later. I am almost exactly the target demographic for a product like this, and I haven’t really pictured how it would improve my life at all, because all I remember from reading the page is the encryption is over engineered because it seems like a fun project a guy did.
You’re complaining about the product marketing of something that is not a product
I’m not complaining about anything. I wrote sabout keeping interest and focus. It could be a product, but even as a casual read veers into the obscure for no reason.
I love hardware projects like this, I've got a couple of things that I want to do, but then I realise I don't really know what I'm doing so I ask a LLM, but then I realise I don't know enough to know if it's actually correct or if it's just gonna fry the ESP!
Would this work with something like a TV or set-top box? Having to type in long passwords by hand is a pain, if I could just plug this in and copy/paste from the password manager on the PC that would be nice. (Admittedly its not a common issue, but its one of those "Aha I have something in the drawer for this")
I could use this to control an android phone I have at home, which is allowed to run a banking app, and which my on-the-go phone that runs GrapheneOS cannot thanks to Google's Play Integrity™.
Ooh I recently vibe coded an M5 Atom S3u to act as a Bluetooth keyboard receiver to HID (for my dock, to avoid changing keyboard pairings, as well as an AP with web interface enabled by a button to allow for typing or pasting passwords into normally headless boxes/TVs etc. Except mine had no security considerations….
Nice work! Hardware password managers are great! While yours does a little more, perhaps, these might also be interesting:
Mooltipass: https://www.themooltipass.com/
OnlyKey: https://onlykey.io/
The closest is actually InputStick: https://www.inputstick.com/
For those willing to buy a device with similar functionality (and KeePass2Android integration): https://www.inputstick.com/ (I am not affiliated but am a happy user)
How do you know that shady computer won't pwn your usb device?
Are USB keyboard devices frequently pwnable?
I guess when we hypothetically get to devices having agents running on them that can figure out what the random attached hardware is, and craft "useful" takeover exploits for those, there will be some interesting adjustments to considerations.
It's a shady computer, assumed in the article to be malicious.