search

girst / hardpass-passwordmanager-mirror-of-git.gir.st

https://git.gir.st/hardpass.git - Seldomly Updated Mirror: Hardpass is a Raspberry Pi Zero based hardware password manager, using passwordstore.org.
https://git.gir.st/hardpass.git
GNU General Public License v3.0
97 stars 16 forks source link

Mass storage images should not be mounted on the Pi #1

Closed RoganDawes closed 8 years ago

RoganDawes commented 8 years ago

Hi,

I just wanted to point out that the init_usb.sh script incorrectly mounts the hardpass image file prior to exporting it as a mass storage device.

Any changes made to the file by the USB host may not be seen by the Pi, and any changes made by the Pi may not be seen by the host, due to caching effects. Both devices are under the impression that they are in full control of the file system, and simultaneous changes are very likely to result in a corrupted filesystem.

girst commented 8 years ago

I have not considered that. As indicated at the top of the file, I am not the author, but I can look into this if it is a concern. (I personally haven't even thought about accessing the image from the Pi's side, so this wasn't on my radar.)

Tobias

On Sat, Sep 03, 2016 at 09:33:08PM -0700, RoganDawes wrote:

Hi,

I just wanted to point out that the init_usb.sh script incorrectly mounts the hardpass image file prior to exporting it as a mass storage device.

Any changes made to the file by the USB host may not be seen by the Pi, and any changes made by the Pi may not be seen by the host, due to caching effects. Both devices are under the impression that they are in full control of the file system, and simultaneous changes are very likely to result in a corrupted filesystem.

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub, or mute the thread.

Link: https://github.com/girst/hardpass-passwordmanager/issues/1

RoganDawes commented 8 years ago

Sure, no problem. I'm just using this as a way of playing with the HID emulation on the Zero, but noticed that the file was mounted from both sides. It's worth fixing in your app, though, to ensure that the Pi does not mess up the passwords! ;-)