Inspiration
The October 2026 Binance theft: compromised laptops drove the signing system, and no human approved. Hardware keys prove who. Nothing protects a person forced to approve.
What it does
An ordinary-looking mouse that hides a security device. Learns your normal grip, sweat, tremor, warmth and presence. Judges only at the moment of a transaction. Gaming and stress never trigger it. Under duress: the screen says “Sent”, funds freeze, and the team is silently alerted. Fully local: nothing leaves the mouse.
How we built it
Arduino UNO Q, Modulinos (Thermo, Movement, Buttons), touch and moisture sensors, a USB camera, a YubiKey 5. Edge Impulse anomaly model running on-device (“is this your normal?”). On-device face detection (YuNet) for “someone over your shoulder”. YubiKey + microcontroller tag + post-quantum ML-DSA signature on every approval. User data encrypted on the board with a key only the YubiKey can unlock.
Challenges we ran into
One 3V3 pin for two sensors: powered each from its own pin instead. A newer Thermo needed a newer library. Avoiding false alarms from coworkers, runs, no sleep and gaming. No time to record real data, so we trained on synthetic data anchored to real readings.
Accomplishments that we’re proud of
58 cryptography tests pass, with the real microcontroller code verified byte for byte. Remote requests with no hand on the mouse are refused. Duress approvals look identical from outside. Zero cloud dependency at decision time.
What we learned
Duress is a sudden change from your own normal, not “stress”. Fail closed, never lock out: decoys beat hard blocks. Secrecy is a bonus; the cryptography must stand alone.
What’s next for YuDuino
Retrain on real user data instead of synthetic. Mouse-click firmware in a donor shell. Read-out protection on the microcontroller. Team approvals (maker–checker) and a real wallet integration.
Back to the build. Edge Impulse’s Linux runner insists on an audio library at import, even though we don’t use audio, so I’ll get past that next.
