Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pressing YubiKeys

bert.org

Post reply on HN
Print view View original

61–70 of 241 posts

Re: Pressing YubiKeys

#61

Post by rob-olmos »

np1810 wrote: post #48
michaelt wrote: post #46

Earlier quoted context omitted.

Yubikeys don't have an onboard battery-backed clock, so they can't give out timestamped responses.

> Yubikeys don't have an onboard battery-backed clock, so they can't give out timestamped responses. Ok got it and we can't trust the host PC clock or any web based clock via host pc...

That's what the desktop/mobile app does for generating the TOTP code that's using the TOTP secrets on the Yubikey.

I'm not sure if a Yubikey's simplest mode as a HID device can read the device's wall clock it's attached to without additional drivers?

Re: Pressing YubiKeys

#63

Post by Godel_unicode »

paxys wrote: post #44
anonova wrote: post #8

Adaprox has various "finger bots" for those who don't want to build their own: https://www.adaprox.io/

Yeesh $35 for a single button presser?

People frequently spend that on a night at the bar/movies/bowling. Why is this a worse use of money?

Re: Pressing YubiKeys

#64

Post by dheera »

3np wrote: post #54
dheera wrote: post #45

Earlier quoted context omitted.

Considering many services only allow one YubiKey or only one TOTP authenticator ... I might actually need a short term solution like this to beat the 2FA on those services. Otherwise what happens if I lose my key on the road? The 2FA services that allow >1 YubiKey are good, I can have a backup key locked up some place and use them as intended.

Looking at you, AWS.

AWS, Twilio, PayPal, Coinbase, Gusto, ...

Re: Pressing YubiKeys

#65

Post by Godel_unicode »

conk wrote: post #23

Nice build but over engineered. You could achieve the same result by taping a piece of aluminum foil, or maybe even a wire to the capacitive sensor and connecting it to ground through a relay. Use the ESP8266 to toggle the relay when you want to simulate a button press.

You're missing a very important core requirement: it has to look cool.

Re: Pressing YubiKeys

#66

Post by RegnisGnaw »

xkcd-sucks wrote: post #52
f0ff wrote: post #9

Congratulations, you've defeated the purpose of having a YubiKey

> the purpose of having a YubiKey Compliance?

Exactly. At one of my work places, we needed 2FA to log into a vendor portal. So we stuck the username, password, and TOPT in Vault which is protected by corporate AD password only.

Re: Pressing YubiKeys

#67

Post by michaelt »

np1810 wrote: post #48
michaelt wrote: post #46

Earlier quoted context omitted.

Yubikeys don't have an onboard battery-backed clock, so they can't give out timestamped responses.

> Yubikeys don't have an onboard battery-backed clock, so they can't give out timestamped responses. Ok got it and we can't trust the host PC clock or any web based clock via host pc...

Correct - just like an evildoer who had your yubikey could generate and save a bunch of yubikey key strings, they could also generate and save a bunch of time-based codes for times in the future by changing the host clock.

You can use a bidirectional challenge-response between the yubikey and a trusted server - that's what U2F does.

But honestly, if an attacker has both your password and physical possession of your 2fa token, it's already game over.

Re: Pressing YubiKeys

#68

Post by mcdee »

A slight aside, but so many of these keys seem to have the touch point / button applying force perpendicular to the direction of insertion, I wonder if there is any long-term potential to cause damage to the USB interface.

Re: Pressing YubiKeys

#69

Post by ShakataGaNai »

This reminds of back in the olden days (when SMS MFA was still an "OK" thing to do) we needed shared MFA for IT Admins of various SaaS apps. We setup a dedicated phone, duct taped to the wall, to get these codes and push them to hipchat (via Tasker & NodeJS).

One of my team members did a write up about it years ago: https://obviate.io/2015/04/16/making-of-the-mfa-phone-becaus...

Post reply on HN