Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pressing YubiKeys

bert.org

Post reply on HN
Print view View original

31–40 of 241 posts

Re: Pressing YubiKeys

#32

Post by punnerud »

anonova wrote: post #8

Adaprox has various "finger bots" for those who don't want to build their own: https://www.adaprox.io/

There is also MicroBot: https://microbot.is/push/

I used it for testing smart meters in Norway, so we did not need to run to the lab to trigger events. The best part is that the whole menu is interactive by just one physical button, a great job for a Bluetooth button pusher + Python.

It is also capacitive so it work on the phone screen, and YubiKeys (?)

Re: Pressing YubiKeys

#33

Post by rgoulter »

"Why have an Applescript call a shell script? I found that when I launched the shell script directly from Karabiner Elements, it opened a new instance of Terminal.app and took focus away from the window that is prompting for the YubiKey. This causes everything to run in the background."

Does anyone know why that is?

Re: Pressing YubiKeys

#34

Post by paxys »

agl wrote: post #27

You can just glue a wire to the touch plate and connect it to ground when you want to simulate a touch.

I would personally not wire any amount of current to a USB peripheral connected to my MacBook.

Re: Pressing YubiKeys

#35

Post by suprfsat »

conk wrote: post #23

Nice build but over engineered. You could achieve the same result by taping a piece of aluminum foil, or maybe even a wire to the capacitive sensor and connecting it to ground through a relay. Use the ESP8266 to toggle the relay when you want to simulate a button press.

But that wouldn't have a 3D-printed finger

Re: Pressing YubiKeys

#36

Post by np1810 »

sxp wrote: post #24

When I was at Google around 2012, the company had a custom 2FA dongle that detected motion rather than touch. An engineer who had remotely ssh'd into their workstation needed to 2FA and realized that they could send an SMS to their phone, cause the phone to vibrate, and trigger a false 2FA event on the dongle. (Or maybe they got their computer to play a loud noise. I forgot the specific details.) Similar to this fake…

More on defeating 2FA, during my internship at Amazon I created a grease monkey script that would store 'n' yubikey codes and paste them automatically whenever browser asked for a yubikey code and this worked flawlessly because afaik yubikeys code have No Expiry... they just have to be used in order of their generation... I highlighted this issue of No Expiry of yubikey codes but no one took it seriously...

Re: Pressing YubiKeys

#37

Post by unwind »

paxys wrote: post #34
agl wrote: post #27

You can just glue a wire to the touch plate and connect it to ground when you want to simulate a touch.

I would personally not wire any amount of current to a USB peripheral connected to my MacBook.

Switching a wire between mid-air and ground passes 0 current in both states which sounds like a pretty safe amount, though.

Re: Pressing YubiKeys

#38

Post by threadpiper »

paxys wrote: post #34
agl wrote: post #27

You can just glue a wire to the touch plate and connect it to ground when you want to simulate a touch.

I would personally not wire any amount of current to a USB peripheral connected to my MacBook.

Its like grounding it, same thing you do when you touch it. pretty safe no?
Post reply on HN