Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pressing YubiKeys

bert.org

Post reply on HN
Print view View original

71–80 of 241 posts

Re: Pressing YubiKeys

#71

Post by WrtCdEvrydy »

punnerud wrote: post #32
anonova wrote: post #8

Adaprox has various "finger bots" for those who don't want to build their own: https://www.adaprox.io/

There is also MicroBot: https://microbot.is/push/ I used it for testing smart meters in Norway, so we did not need to run to the lab to trigger events. The best part is that the whole menu is interactive by just one physical button, a great job for a Bluetooth button pusher + Python. It is also capacitive so it work on the phone screen, and YubiKeys (?)

Can you get to the 'buy now' shop on that site?

Re: Pressing YubiKeys

#73

Post by etaioinshrdlu »

"If you work in tech, you probably have a YubiKey"

The author must live in some kind of bubble. This may only be true at Big Tech companies or other companies with a atypically strong security focus.

Re: Pressing YubiKeys

#74

Post by gketuma »

Raphmedia wrote: post #18

The final thoughts at the end of the article are amazing: "Why not just press the button?" ... "Don’t you get it? This button BAD, but this button GOOD. Me want to press GOOD button."

So that GOOD button presses BAD button.

Re: Pressing YubiKeys

#75

Post by detaro »

jeroenhd wrote: post #19

The obvious next step is to plug this into a server and control it through USB over IP. Call it "remote, centrally controlled 2FA" and your manager will love it!

There are these RSA-brand tokens that show a new TOTP number every few minutes. Occasionally people find an unsecured webcam pointed at one of those somewhere on the internet...

Re: Pressing YubiKeys

#76

Post by CyberRage »

It seems like you don't understand the main advantage of these types of security tokens.

Rogue trigger of a security token isn't really an issue when using the recommended U2F standard.

U2F uses the domain as part of the challenge-response in U2F so that phishing\spoofing attacks can be defeated.

Re: Pressing YubiKeys

#78

Post by justfortechnews »

etaioinshrdlu wrote: post #73

"If you work in tech, you probably have a YubiKey" The author must live in some kind of bubble. This may only be true at Big Tech companies or other companies with a atypically strong security focus.

Agreed - feel like I rarely see any YubiKeys outside of my coworkers' laptops.

Re: Pressing YubiKeys

#79

Post by gabeio »

mcdee wrote: post #68

A slight aside, but so many of these keys seem to have the touch point / button applying force perpendicular to the direction of insertion, I wonder if there is any long-term potential to cause damage to the USB interface.

I have one of those you don't need to _press_ it seems the conduction of the finger is "key" (haha, sorry). But yeah I agree if you are pressing it _hard_ it will likely damage the usb port especially considering it doesn't have the housing around the contacts which I would say might protect the port a bit better, probably translating the force not to the contacts.
Post reply on HN