Now we need a yubikey captcha.
Pressing YubiKeys
21–30 of 241 posts
Re: Pressing YubiKeys
#22Reminds me of this, "The Tinda Finger Swipes Right On Tinder So You Don't Have To"
Re: Pressing YubiKeys
#23Nice build but over engineered. You could achieve the same result by taping a piece of aluminum foil, or maybe even a wire to the capacitive sensor and connecting it to ground through a relay. Use the ESP8266 to toggle the relay when you want to simulate a button press.
Re: Pressing YubiKeys
#24When I was at Google around 2012, the company had a custom 2FA dongle that detected motion rather than touch. An engineer who had remotely ssh'd into their workstation needed to 2FA and realized that they could send an SMS to their phone, cause the phone to vibrate, and trigger a false 2FA event on the dongle. (Or maybe they got their computer to play a loud noise. I forgot the specific details.)
Similar to this fake finger, it was a cool hack at the time but defeated the purpose of 2FA.
Re: Pressing YubiKeys
#25A little off topic: Does anyone know of a way to get the results of a yubikey press into a remote desktop session? I frequently remote desktop into laptops that are in arms reach. If I need to use the yubikey, I have to remove it and plug it into my desktop and press it, since it acts as a local keyboard.
Re: Pressing YubiKeys
#26Earlier quoted context omitted.
Not in practice. The odds any malware would both locate this api, and actionably utilize a generated otp, is slim to zero.
sounds like security through obscurity.
To a robot, the act of moving meat into physical proximity with a switch might be considered to be an equally obscure action. As a component of a 2-factor system to prove token possession, either seems quite adequate.
The use of U2F tokens as single factor auth seems to have promulgated thanks to this implicit 3rd factor keeping the situation moderately at bay. I posit that this is largely the same reason that keys and locks remain relatively secure despite that almost all of them are trivial to bypass or duplicate. The physical access bit is just so damn inconvenient for the typical modern white-collar criminal.
Re: Pressing YubiKeys
#27You can just glue a wire to the touch plate and connect it to ground when you want to simulate a touch.
Re: Pressing YubiKeys
#28Why not just keep the wire attached to the Yubi-key, but leave it electrically floating (high-impedance state) and have the board ground it whenever it needs to be pressed? No need for mechanical triggers...
Re: Pressing YubiKeys
#29Really liking the SA 1976 key set! What is the board?
Re: Pressing YubiKeys
#30Is there a SOAP interface for this? We're interested in rolling this out where I work.