This could be handy for automating a real world end-to-end test of a yubikey auth flow.
I got into robotics and have been able to do it professionally for several years precisely because it's a useful way to automate real world end-to-end testing.
Pressing YubiKeys
41–50 of 241 posts
Re: Pressing YubiKeys
#42Adaprox has various "finger bots" for those who don't want to build their own: https://www.adaprox.io/
Ooh I've been looking for something like this!
Re: Pressing YubiKeys
#43Re: Pressing YubiKeys
#44Adaprox has various "finger bots" for those who don't want to build their own: https://www.adaprox.io/
Yeesh $35 for a single button presser?
Re: Pressing YubiKeys
#45The obvious next step is to plug this into a server and control it through USB over IP. Call it "remote, centrally controlled 2FA" and your manager will love it!
Considering many services only allow one YubiKey or only one TOTP authenticator ... I might actually need a short term solution like this to beat the 2FA on those services. Otherwise what happens if I lose my key on the road?
The 2FA services that allow >1 YubiKey are good, I can have a backup key locked up some place and use them as intended.
Re: Pressing YubiKeys
#46When I was at Google around 2012, the company had a custom 2FA dongle that detected motion rather than touch. An engineer who had remotely ssh'd into their workstation needed to 2FA and realized that they could send an SMS to their phone, cause the phone to vibrate, and trigger a false 2FA event on the dongle. (Or maybe they got their computer to play a loud noise. I forgot the specific details.) Similar to this fake…
More on defeating 2FA, during my internship at Amazon I created a grease monkey script that would store 'n' yubikey codes and paste them automatically whenever browser asked for a yubikey code and this worked flawlessly because afaik yubikeys code have No Expiry ... they just have to be used in order of their generation... I highlighted this issue of No Expiry of yubikey codes but no one took it seriously...
Yubikeys don't have an onboard battery-backed clock, so they can't give out timestamped responses.
Re: Pressing YubiKeys
#47Couldn't you just skip the motor, and have a wire always touching the contact, and use a relay to connect the other end of the wire to ground?
Re: Pressing YubiKeys
#48Earlier quoted context omitted.
More on defeating 2FA, during my internship at Amazon I created a grease monkey script that would store 'n' yubikey codes and paste them automatically whenever browser asked for a yubikey code and this worked flawlessly because afaik yubikeys code have No Expiry ... they just have to be used in order of their generation... I highlighted this issue of No Expiry of yubikey codes but no one took it seriously...
Yubikeys don't have an onboard battery-backed clock, so they can't give out timestamped responses.
> Yubikeys don't have an onboard battery-backed clock, so they can't give out timestamped responses.
Ok got it and we can't trust the host PC clock or any web based clock via host pc...
Re: Pressing YubiKeys
#49This is as impressive as it is pointless. You are treating the symptom and not the problem.
Re: Pressing YubiKeys
#50Earlier quoted context omitted.
I would personally not wire any amount of current to a USB peripheral connected to my MacBook.
Its like grounding it, same thing you do when you touch it. pretty safe no?
I guess a ~10kohm resistor in series couldn't hurt, should something go wrong. After all your finger is not exactly super conductive in the first place...