Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

YubiKey 4C

yubico.com

Post reply on HN
Print view View original

191–200 of 266 posts

Re: YubiKey 4C

#191

Post by lstamour »

escapologybb wrote: post #160
cbhl wrote: post #146

Earlier quoted context omitted.

IIRC, the main reason that accessibility software doesn't have access to login screens is because malicious software has historically used accessibility APIs to steal passwords (e.g. by eavesdropping on a login screen, or by presenting a fake one and then using the accessibility APIs to pass through the password to the real one).

I think you are absolutely correct, and it's a really good reason not to switch the accessibility APIs on until the OS is fully decrypted and loaded. Yep, right there with you and agree and everything. Still, sucks balls to be disabled in this situation and I'm also fairly sure that Apple has the engineering talent to make this possible. One would hope, anyway!

Of course Apple can do it. IIRC, Microsoft has. And Apple does with their iPhones -- the keyboard is on screen! So of course it's possible. They're just ... busy? :)

Re: YubiKey 4C

#192

Post by lstamour »

escapologybb wrote: post #164
cbhl wrote: post #147

Earlier quoted context omitted.

Does Windows 10 let you use accessibility software on the login screen?

Nope. And in my not so humble opinion and speaking from long and frustrating experience, using Windows accessibility software blows really really hard. Really. Hard.

What's this then? https://support.microsoft.com/en-us/help/17180/windows-10-ma...

Narrator can run at the login screen too. https://support.microsoft.com/en-ca/help/17173/windows-10-he...

Re: YubiKey 4C

#193

Post by Nullabillity »

kcorbitt wrote: post #188
escapologybb wrote: post #158

Earlier quoted context omitted.

Thanks for the links, they look really useful and it's only just occurred to me when you pointed it out that when a person such as the key they are completing a circuit. If I could do that in someway that could be unique to me, then that might just be possible to do. I just need to find somebody to do the soldering!. :-)

Not sure exactly what you have in mind, but it's possible that there's a misconception here about how these devices work. They don't depend on the touch being "unique to you" -- as mentioned above, it's just looking for a capacitive connection. The extra security they give is linked to the fact that an unauthorized user would be less likely to have access to the device itself. Also, most implementations of security w…

Apparently it can be set up to send a static password: see https://www.yubico.com/products/services-software/personaliz... .

Incredibly insecure vs the OTP/U2F modes, but probably better than telling people your password.

Re: YubiKey 4C

#194

Post by Cenk »

escapologybb wrote: post #120

I REALLY wish it were possible to use one of these devices without using your hands. I'm quadriplegic and would love to use one of these to unlock my computer, bank passwords etc etc. But you have to touch a finger to almost all of them to trigger the OTP, or whichever authentication and they happen to be using. I would absolutely love to be able to lock and unlock my Mac without an able-bodied person helping me, bec…

You could buy an Apple Watch and use that to unlock your Mac based on vicinity: https://support.apple.com/en-us/HT206995 Only works on newer MacBook though.

Re: YubiKey 4C

#195

Post by IgorPartola »

ci5er wrote: post #157
IgorPartola wrote: post #96

Until these things work well with phones, I can't buy into them. I have a U2F key that I use as a shortcut for accessing things like Google's services. But I am sticking to always using either Google Authenticator or SMS, if it's available, as a primary option. When I am looking at a website in bed on my phone, and my YubiKey is in my laptop downstairs, I can't say I am happy that I can't access my account. I think t…

I think I'm not understanding the problem. I have cloned keys (for backup + two locations), with Yubico Authenticator. Is the problem NFC on iOS or that you don't want to clone your keys?

My problem is that while I can reasonably guarantee that my YubiKey will be near my laptop when I use it, I generally can't guarantee that my YubiKey will be near my phone or tablets when I use them. I also don't really want to keep plugging in a physical key into my phone every time I want to log into, say, American Airlines to check the status of my flight, or into PapaJohns.com every time I want to order a pizza.

NFC makes this a little easier, but I still usually don't keep my keychain (that is my physical keychain with my house and car key) on my nightstand, while I do keep my phone there.

tl;dr: Laptop + 2nd Factor = YubiKey. That's OK and it works.

Phone/tablet + 2nd Factor = ???

Re: YubiKey 4C

#196

Post by algesten »

Cenk wrote: post #194
escapologybb wrote: post #120

I REALLY wish it were possible to use one of these devices without using your hands. I'm quadriplegic and would love to use one of these to unlock my computer, bank passwords etc etc. But you have to touch a finger to almost all of them to trigger the OTP, or whichever authentication and they happen to be using. I would absolutely love to be able to lock and unlock my Mac without an able-bodied person helping me, bec…

You could buy an Apple Watch and use that to unlock your Mac based on vicinity: https://support.apple.com/en-us/HT206995 Only works on newer MacBook though.

I can confirm this setup works quite well. Initially it was a bit hit/miss whether it would unlock, but they clearly fixed something, it's much better now.

Re: YubiKey 4C

#198

Post by ci5er »

IgorPartola wrote: post #195
ci5er wrote: post #157

Earlier quoted context omitted.

I think I'm not understanding the problem. I have cloned keys (for backup + two locations), with Yubico Authenticator. Is the problem NFC on iOS or that you don't want to clone your keys?

My problem is that while I can reasonably guarantee that my YubiKey will be near my laptop when I use it, I generally can't guarantee that my YubiKey will be near my phone or tablets when I use them. I also don't really want to keep plugging in a physical key into my phone every time I want to log into, say, American Airlines to check the status of my flight, or into PapaJohns.com every time I want to order a pizza.…

Makes sense. Thanks. It seems as if what I would consider "natural usage" is a bit different than yours. I don't use my phone to access anything critical -- the attack surface is too big and changes too rapidly (sometimes outside of my control) for me to keep track of -- and I wouldn't worry about safety when checking a flight.

Re: YubiKey 4C

#199

Post by danjoc »

pfg wrote: post #142
danjoc wrote: post #131

Earlier quoted context omitted.

Can you disable SMS on google? I've tried and have been unsuccessful. Phone is required to enable 2FA. Once that is enabled, I can add yubikeys. After adding yubikeys, I am unable to remove phone as a 2FA alternative.

It's possible to disable SMS-based 2FA. Perhaps you need another backup option before you're allowed to remove the SMS option. In my case, I was able to do it with two U2F keys, TOTP and backup codes enabled. You might need to remove it as an account recovery number as well. Those can effectively downgrade your login to one factor.

>you need another backup option before you're allowed to remove the SMS option.

This was the answer. Google prompt isn't allowed with hardware tokens. Backup codes evidently don't count. So the only way is to set up Google Authenticator on a phone. Authenticator from f-droid works. After I set up Authenticator, I no longer got the "Something went wrong. Try again" toast when trying to delete the sms number.

Edit: Just realized what Yubico Authenticator is for :)

Re: YubiKey 4C

#200

Post by gcb0 »

Cenk wrote: post #194
escapologybb wrote: post #120

I REALLY wish it were possible to use one of these devices without using your hands. I'm quadriplegic and would love to use one of these to unlock my computer, bank passwords etc etc. But you have to touch a finger to almost all of them to trigger the OTP, or whichever authentication and they happen to be using. I would absolutely love to be able to lock and unlock my Mac without an able-bodied person helping me, bec…

You could buy an Apple Watch and use that to unlock your Mac based on vicinity: https://support.apple.com/en-us/HT206995 Only works on newer MacBook though.

1. enter company you don't work at and steal laptop at lunch hour

2. walk to cafeteria with laptop that looks like any other. let owner watch unlock it for you.

3. profit!

4. optional, return laptop before lunch is over for full stealth.

Post reply on HN