Hacker News Reader

Since it's a capacitive touch device, you really just need something conductive to touch the pad and connect it to "ground".

Maybe someone you know could take the yubikey device, attach a wire to it, then connect up a relay or something that could be controlled (using whatever interface you already have - I'm not that familiar with such medical devices) to activate the relay. When the switch contacts close, the other side of the relay could be connected to an earth-grounded point. That should activate the yubikey (I believe).

Note that the wire and relay and such will need to be shielded as well (to prevent stray capacitance - like somebody walking by or such - activating it). Coaxial cable like that used for oscilloscope leads would be great, and put the relay inside a metal box (and connect the shielding of the cable to the box).

Hmm - this is getting more complicated than I thought - but I think the basics are there. Here are some other links that might help as well:

http://playground.arduino.cc/Main/CapacitiveSensor (has a nice diagram/schematic of how these form a "circuit" for the microcontroller - this may or may not be what the yubikey uses)

A couple of PDF app notes from Texas Instruments on implementing capacitive sensing:

http://www.ti.com/lit/an/snoa952/snoa952.pdf

http://www.ti.com/lit/an/snoa926a/snoa926a.pdf

Good luck, and I hope this helps or leads somewhere for you!

Thanks for the links, they look really useful and it's only just occurred to me when you pointed it out that when a person such as the key they are completing a circuit. If I could do that in someway that could be unique to me, then that might just be possible to do. I just need to find somebody to do the soldering!. :-)

It depends on the device, but if it's a regular capacitance sensor, what's really needed is just some mildly conductive object touching the sensor - something akin to a human finger. Does not have to be personalized, since this is not a fingerprint sensor.

I have an older Yubikey stashed somewhere - if I can unearth it, I'll do some tests. But I suspect it could be something as simple as a wire: on one end touching the computer's ground circuit, while at the other coiled up to make a flat spiral the size of the sensor, and having that touch the sensor. The wire could probably be isolated, because the sensor is based on capacitance, so it does not require a full circuit.

A simple way to get a ground connection to the computer is via a fake USB connector. Pin #4 is ground.

http://www.hobbytronics.co.uk/usb-connector-pinout

Or perhaps the outer metal jacket of the USB connector would also get a ground connection.

With a Mac laptop, maybe it's enough to just touch the metallic case to get a ground connection.

TLDR: A wire, connected to computer's ground at one end, with a little metal pad (or flat coil) at the other. Bring the pad close enough to the sensor, and it should trigger.

I had a Nano. I'm like 99% sure all the GP would have to do is tie a wire to the metal tab, and then he could bump the other end of the wire with any part of his body.

You're probably right.

We use the nanos heavily at my workplace. I've seen people make a chain out of paperclips when their nearest USB port is too far away (and they can't be bothered to grab an extension cable).

Not sure exactly what you have in mind, but it's possible that there's a misconception here about how these devices work. They don't depend on the touch being "unique to you" -- as mentioned above, it's just looking for a capacitive connection. The extra security they give is linked to the fact that an unauthorized user would be less likely to have access to the device itself.

Also, most implementations of security with yubikey-type devices I've seen use it as a secondary authentication mechanism and still require a password, so it wouldn't actually solve your original issue of hands-free access. :( There may be ways to configure it to be the sole means of authentication though.

Apparently it can be set up to send a static password: see https://www.yubico.com/products/services-software/personaliz... .

Incredibly insecure vs the OTP/U2F modes, but probably better than telling people your password.

It sounds like you would be better served with a Bluetooth proximity-based device like a Gatekeeper.

http://www.gkchain.com/gatekeeper.html

I haven't looked into the OTP functionality of it, since I decided to go with a YubiKey myself, but a friend loves it for hands-free automatic locking and unlocking of his computer as he comes and goes.

That looks great, thank you for the link. I would love to try one of those devices, I don't have great memories of this kind of unlocking though.

I can't remember the exact name of the product, but I installed it with good faith and it completely locked up my Mac so badly I had to reformat the computer.

So colour me a little reticent to try this, although if the gatekeeper guys are reading this I'll be happy to beta test one for you. You know, purely for accessibility reasons. :-)

You could buy an Apple Watch and use that to unlock your Mac based on vicinity: https://support.apple.com/en-us/HT206995 Only works on newer MacBook though.

I can confirm this setup works quite well. Initially it was a bit hit/miss whether it would unlock, but they clearly fixed something, it's much better now.

1. enter company you don't work at and steal laptop at lunch hour

2. walk to cafeteria with laptop that looks like any other. let owner watch unlock it for you.

3. profit!

4. optional, return laptop before lunch is over for full stealth.

Worth noting that the watch alerts that it has been used to unlock the laptop. Doesn't prevent the action, but does prevent "stealth mode unlock"

only if it is reported.

Most people will just ignore it and call a fluke. Just like everyone does when their servers signatures changes. everyone just save the new key and type their passwords away ;)

There are a lot of attacks one can imagine when you have physical access to hardware inside the building. Why not just boot to a thumb drive and install malware?

Because the computer is locked?

If they don't have full disk encryption, booting a mac holding command and R will get you into recovery mode where you can change the root password, or change the boot device to something that simply doesn't care about the login permisions. Pretty much any machine without full disk encryption at rest is vulnerable when you have physical access. And if they do, you can still probably do a lot of damage, without Bumping into someone at lunch with their laptop.

Not saying it's not a real vector, but it's hardly one that would keep me up at night.

There have been successful attacks on locked macs via the thunderbolt port.

I'm thinking of one in particular which I can't find at the moment, but I remember seeing a really fantastic video where one guy described in detail how he reverse engineered the mac thunderbolt interface and was able to flash malware bootcode on to it even when locked. Once that malware was installed, it could do pretty much anything, including get encryption keys to your hard drive, intercept all keystrokes, etc.

If anyone has a link to that, please post it here.

Also, there this:

https://news.ycombinator.com/item?id=7123121

I had very little luck trying to set this up, and it required me to switch to a different second factor authentication that ended up complicating my life for everything else. Do Not Recommend.

Yubico has another decive the Nano. It is designed with a switch instead of a button. I am almost sure that you could tie a string around it and then you could maybe pull that somehow, connect it to something mechanical or something.

Mmmhh, why not test this ...

... I have just tried this out. I used the wires from an old headphone and tied it to the trigger. I can Trigger the single click by pulling on the wire. I even managed to trigger the long click, but that was not very practical. I tried pulling it with my mouth, but since you don't need that much force, maybe connect to headphones or something would be enough. My laptop was constantly shifting about, but maybe if you have setup where the computer is fixed, that might be less of a problem.

You can configure the static password on Slot 1 (single click) and you can still use U2F if you like (You can even login with U2F and use Slot 1 for something else as well).

I don't know what your setup is, but that's the idea that jumped to my head. Sorry if it is stupid.

IIRC, the main reason that accessibility software doesn't have access to login screens is because malicious software has historically used accessibility APIs to steal passwords (e.g. by eavesdropping on a login screen, or by presenting a fake one and then using the accessibility APIs to pass through the password to the real one).

I think you are absolutely correct, and it's a really good reason not to switch the accessibility APIs on until the OS is fully decrypted and loaded.

Yep, right there with you and agree and everything. Still, sucks balls to be disabled in this situation and I'm also fairly sure that Apple has the engineering talent to make this possible. One would hope, anyway!

Of course Apple can do it. IIRC, Microsoft has. And Apple does with their iPhones -- the keyboard is on screen! So of course it's possible. They're just ... busy? :)

I'm reminded of the brief experiences I had w/ Greg Priest Dorman and his physical computing setup, which had him attaching keyboards to his hands, and displays to his glasses.

This is a really hacky/bespoke idea, and I apologize if I'm being naive, but I wonder if you might be able to string a Yubikey Nano (https://www.yubico.com/product/yk4nano/) via a USB extension cable to someplace accessible to you around your head? Someplace you could trigger it with head motion?

You'd still have to figure out integrating the Nano with your login screen, your password manager, etc, but this seems like it might maybe be a viable first step.

I thought of this when the Yubikey first came out, but apparently it needs to be your finger that makes the connection. I'm not sure if that's still the case, because like you I just assumed I could extend the key somewhere around my chin controller and then use the tip of my nose to activate the key. I believe the tip of your nose is actually fairly unique FYI.

But yes, that would be one solution and great minds think alike. :-)

The Nano at least is not fingerprint-based; it's simply a capacitance thing - any conductive thing touching it, connected to you, will be treated as a touch. I have at least one coworker who strung paperclips from their Nano to someplace convenient, and they just touch the paperclip.

As well, I just performed a test by rubbing my nose on my Nano, and it worked as intended :)

I'm pretty sure the nano just needs a poke and then it'll spit out whatever you've configured it to do. I got one and used it for a little while to unlock my computer, by just having it spit out a static password on touch. The issue with this of course is that your password is now visible in clear text just by placing the key in a USB port, opening up a text input, and then touching the key. It was convenient, but very insecure obviously. Maybe it would be useful to you though.

In fact how about this, you can have mine – for free. I never use it anymore, and if there's a chance it'll help you I'm happy to just send it your way. It's just collecting dust at this point anyway.

Technically, this could/should have been already solved with voice authentication. Nuance and other companies have been claiming/pushing it for a few years now: http://www.nuance.com/for-business/customer-service-solution.... I'd actually expect Apple to be the first big player to incorporate that, as they've been a leader in accessibility. Maybe somebody should sue them for discrimination to accelerate the process.

Yeah, I've been using voice dictation software since I became quadriplegic over a decade ago and they were talking about it then but it's not materialised yet. I would imagine that it's going to be Apple there's going to be first in this area, but I'm not convinced they're going to do it for accessibility reasons, I think they're going to do it for payment/password reasons. Which if I get the trickle-down benefits from then, go Apple!

Apple actually did do voice authentication back on Mac OS 9. See http://www.gcsf.com/extras/mwj/mos9special/ (figure ten).

I assume they dropped it because it wasn't actually secure, I remember my brother getting past mine once with only a couple of tries.

Presumably we could do better today, but as far as biometrics go, I'd put my money on Windows Hello's facial recognition over voice showing up again. Apparently they've done a better job of it than the Android handsets a couple years ago managed.

Windows hello might help you. There are laptops that use depth mapping infra red cameras with the native face recognition in windows. Probably the best hands free unlock method.

Why not run an operating system that does let you use accessibility software at the login screen?

Does Windows 10 let you use accessibility software on the login screen?

Nope. And in my not so humble opinion and speaking from long and frustrating experience, using Windows accessibility software blows really really hard.

Really. Hard.

What's this then? https://support.microsoft.com/en-us/help/17180/windows-10-ma...

Narrator can run at the login screen too. https://support.microsoft.com/en-ca/help/17173/windows-10-he...

Yes. Most new Windows 10 devices such as a Surface Book or Surface Pro have facial recognition built-in. I haven't typed in a password in over a year.

My friend, if you could find me an operating system that can do that, and then once inside the OS enable me to use every single function of the operating system like an able-bodied person in the way the Apple's does I'll give you a small prize.

I would absolutely love to use free and open source software for both my operating system and everything else, but only Apple provides an experience for people with profound disabilities that even comes close to the experience normal people have with their computers.

This reply might come across as snarky, but it isn't and I really have tried to find other operating systems that would allow me to do this. Not found any yet in a decade.

Sounds like you might have tried this already, but GNOME has had a history of working on accessibility, and I think they're quite open to bugs in case something is broken. How well it works in practice, I don't know, though:

https://wiki.gnome.org/Accessibility

Fedora or Debian is probably the easiest way to get a GNOME desktop these days.

Thanks, I tried persevering with gnome for quite a while because I wanted to use Linux day-to-day. But all of the accessibility stuff at the time was a subset of all of the things that ordinary user could do, that just wasn't enough when I started working and I needed something as full featured as Apple's offering.

I mean I'm obviously going to try and change the state of accessibility and Linux by submitting bug reports and getting involved, but it's a long slow process and in the meantime I need a computer that works.