Pressing YubiKeys

#1

Post by bertrandom » Fri, Oct 02, 2020, 4:03 PM UTC

Re: Pressing YubiKeys

#2

Post by natvert » Fri, Oct 02, 2020, 4:42 PM UTC

haha, this is great! i was thinking about making something similar to skip youtube ads on my ipad!

#3

Post by drewbug » Fri, Oct 02, 2020, 4:45 PM UTC

This lets malware trigger one time code emission...

#4

Post by walrus01 » Fri, Oct 02, 2020, 4:47 PM UTC

#5

Post by 0xCMP » Fri, Oct 02, 2020, 4:50 PM UTC

A proper hack

#6

Post by Firerouge » Fri, Oct 02, 2020, 4:50 PM UTC

drewbug wrote: post #3

This lets malware trigger one time code emission...

Not in practice.

The odds any malware would both locate this api, and actionably utilize a generated otp, is slim to zero.

#7

Post by jdlyga » Fri, Oct 02, 2020, 4:52 PM UTC

natvert wrote: post #2

haha, this is great! i was thinking about making something similar to skip youtube ads on my ipad!

I thought about this, but I ended up just paying the $6 per month for YouTube Premium (student discount)

#8

Post by anonova » Fri, Oct 02, 2020, 4:55 PM UTC

Adaprox has various "finger bots" for those who don't want to build their own: https://www.adaprox.io/

#9

Post by f0ff » Fri, Oct 02, 2020, 5:04 PM UTC

Congratulations, you've defeated the purpose of having a YubiKey

#10

Post by gcommer » Fri, Oct 02, 2020, 5:05 PM UTC

This could be handy for automating a real world end-to-end test of a yubikey auth flow.