It would be nice if there was an option to have the device mailed in a tamper resistant bag, perhaps with some glitter nailpolish applied under the seal. The bags are pretty cheap and the process shouldn’t take too long, it could add a nice bump to profit margin.
I would also love to see a physical one-way hash added to the case itself. It just requires adding randomness to the manufacturing process, which is cheap to do.
We had this idea already but were waiting for demand. 
What exactly do you mean? How should this differ to a serial number being printed?
Yes, tamper-resistant bag would definitely be something great.
If I get a crypto key it’s great to have the peace of mind seing that quite likely no one has yet messed with it.
Upsell! : )
The tamper resistant bags are pretty cheap, but there would be some cost associated with sending the bag’s serial number. You could do it manually at the office at first and see how many takers you get.
[quote=“admin”]
What exactly do you mean? How should this differ to a serial number being printed?[/quote]
Well, it’s not hard to reprint a serial number. But let’s say you had a mix of two or more colors for the plastic case and swirled the colors around in a tie-dye pattern (cool dipping video). Or you could have translucent plastic with tiny colored beads suspended within it. It would be really expensive to and recreate the exact case. You would, of course, have to make it damn-near impossible to remove the electronics from the case without breaking the case itself.
The more I think about this, I believe the translucent case would be mandatory. Someone could just print the colors otherwise. edit: … of course the case is going to be really thin so maybe it wouldn’t help any. Still, even an external color swirl would be better than nothing.
I’ve been turning this over in my head for the past few days and I think that building randomness into the case would give the Nitrokey a unique visual identity. It would be the visual embodiment of a narrative about the Nitrokey being secure and innovative. Answering the question “Why does it have a random pattern?” would open the door to discussion of the other security features that set Nitrokey apart from the competition.
As with all things in security, the goal here is to raise the cost of an attack. Having a thick translucent shell with suspended particles would be ideal, but having a simpler unique pattern (such as just mixing different colored plastics or applying an outer coating) would still force an attacker to use a more expensive printing technique.
What is the packaging and shipping infrastructure like? You could eliminate the need for a dedicated tamper-resistant packaging process by tying the case to the a serial number and a QR code on the packaging during the manufacturing process. Then during the pick-and-pack process you would scan the QR code and have a lookup system that allows the customer to verify that the visual hash and serial number remain the same.
If I understand you right you suggest individual casings and not individual packaging (which is thrown away). The challenge would be to find a method to produce individual casings. Given the fact that our current “simple” casing has expensive setup costs, I don’t think an individual casing with an undefined manufacturing process is realistic.
Instead an individual throw-away packaging may be an option. Still its a challenge to find a practical and secure method. Practical: It should be simple enough that it can be produced and applied in a few minutes maximum. Secure: Just the fact that it is random doesn’t make it secure. It would need to be “pentested” thorough by experts - and this is not our expertise so we would need to find somebody.
My idea was to select a packaging which has just one “opening”. So not a carton but maybe a special plastic bag. The goal is to secure only a single opening. This opening is secured with a “seal”. The seal could be glittering nail varnish or the one from your video. We take a picture of the packaging and send it it to the customer. The entire method should allow the customer to verify that the packaging hasn’t been opened. If you have a practical idea for this, that would be appreciated.
I agree with indolering. The shipment is stuck in my country by more than 7 days and I really would like to know if anyody messed with the Nitro key I am going to receive…
Exactly what my Nitrokey went through when I purchased…it sat for 4 days at the United States entry point for mail before leaving that facility.
There is glittery nail polish for ladies that Nitrokey could purchase and apply to the sealed envelope for each order. After applying the nail polish, take a picture of it before sliding it in the outer packaging. This would be a moderately assured method of ensuring that the package could not be interdicted enroute because the glitter placement within the polish would be extremely difficult to replicate…
That link shows a product that has different sized pieces of glitter in it…when you apply a generous amount to paper, the glitter inside dries in very unique positions.
You could email the picture to the registered user’s email address AND AND AND post the image to the order status page. When the product is finally received after passing through the entry point to their respective country, then the customer checks the email pic, the order status page, and the package itself to make sure they all look the same.
Nitrokey, be sure to make this optional if you decide you’d like to implement it, and we the customers will choose to take advantage of the method or not. If we select the method during each order, then it would be appropriate to add any extra charges necessary to do all the above steps…for example an extra 5,10,15 dollars/euro/etc to cover costs.
