Pressing YubiKeys • Hacker News Board

Re: Pressing YubiKeys

#11

Post by bertrandom » Fri, Oct 02, 2020, 5:06 PM UTC

walrus01 wrote: post #4

see also: https://smallhacks.files.wordpress.com/2012/11/camera.jpg

I've made one of those, too! https://www.flickr.com/photos/bertrandom/4975638961/

Re: Pressing YubiKeys

#12

Post by vnxli » Fri, Oct 02, 2020, 5:07 PM UTC

This is some cowboy engineering and i love it. totally shooting from the hip, but still finishing up with a nice long-form post. like other comments mentioned this is super impractical but that's not the point. building a robot finger to push a button at the push of a button is a hilarious saturday afternoon project

good job bert!

Re: Pressing YubiKeys

#13

Post by gruez » Fri, Oct 02, 2020, 5:11 PM UTC

Firerouge wrote: post #6

drewbug wrote: post #3

This lets malware trigger one time code emission...

Not in practice. The odds any malware would both locate this api, and actionably utilize a generated otp, is slim to zero.

sounds like security through obscurity.

Re: Pressing YubiKeys

#14

Post by GekkePrutser » Fri, Oct 02, 2020, 5:14 PM UTC

The whole point of this touch to sign is that it can't be hacked remotely :) and you can just turn it off for most modes.

Re: Pressing YubiKeys

#15

Post by Jnr » Fri, Oct 02, 2020, 5:14 PM UTC

Or you could just disable the requirement of using the touch.

Re: Pressing YubiKeys

#16

Post by shrubble » Fri, Oct 02, 2020, 5:14 PM UTC

Why did he not call it The Finglonger?

Re: Pressing YubiKeys

#17

Post by gorkish » Fri, Oct 02, 2020, 5:15 PM UTC

anonova wrote: post #8

Adaprox has various "finger bots" for those who don't want to build their own: https://www.adaprox.io/

This is pure brilliance.

Re: Pressing YubiKeys

#18

Post by Raphmedia » Fri, Oct 02, 2020, 5:15 PM UTC

The final thoughts at the end of the article are amazing:

"Why not just press the button?" ... "Don’t you get it? This button BAD, but this button GOOD. Me want to press GOOD button."

Re: Pressing YubiKeys

#19

Post by jeroenhd » Fri, Oct 02, 2020, 5:16 PM UTC

The obvious next step is to plug this into a server and control it through USB over IP. Call it "remote, centrally controlled 2FA" and your manager will love it!

Re: Pressing YubiKeys

#20

Post by vernie » Fri, Oct 02, 2020, 5:18 PM UTC

gruez wrote: post #13

Firerouge wrote: post #6

Earlier quoted context omitted.

Not in practice. The odds any malware would both locate this api, and actionably utilize a generated otp, is slim to zero.

sounds like security through obscurity.

Right. And that isn't a problem for some threat models.