Hacker News Reader

Comment by escapologybb | Hacker News Reader

Thanks for the links, they look really useful and it's only just occurred to me when you pointed it out that when a person such as the key they are completing a circuit. If I could do that in someway that could be unique to me, then that might just be possible to do. I just need to find somebody to do the soldering!. :-)

View on HN

It depends on the device, but if it's a regular capacitance sensor, what's really needed is just some mildly conductive object touching the sensor - something akin to a human finger. Does not have to be personalized, since this is not a fingerprint sensor.

I have an older Yubikey stashed somewhere - if I can unearth it, I'll do some tests. But I suspect it could be something as simple as a wire: on one end touching the computer's ground circuit, while at the other coiled up to make a flat spiral the size of the sensor, and having that touch the sensor. The wire could probably be isolated, because the sensor is based on capacitance, so it does not require a full circuit.

A simple way to get a ground connection to the computer is via a fake USB connector. Pin #4 is ground.

http://www.hobbytronics.co.uk/usb-connector-pinout

Or perhaps the outer metal jacket of the USB connector would also get a ground connection.

With a Mac laptop, maybe it's enough to just touch the metallic case to get a ground connection.

TLDR: A wire, connected to computer's ground at one end, with a little metal pad (or flat coil) at the other. Bring the pad close enough to the sensor, and it should trigger.

I had a Nano. I'm like 99% sure all the GP would have to do is tie a wire to the metal tab, and then he could bump the other end of the wire with any part of his body.

You're probably right.

We use the nanos heavily at my workplace. I've seen people make a chain out of paperclips when their nearest USB port is too far away (and they can't be bothered to grab an extension cable).

Not sure exactly what you have in mind, but it's possible that there's a misconception here about how these devices work. They don't depend on the touch being "unique to you" -- as mentioned above, it's just looking for a capacitive connection. The extra security they give is linked to the fact that an unauthorized user would be less likely to have access to the device itself.

Also, most implementations of security with yubikey-type devices I've seen use it as a secondary authentication mechanism and still require a password, so it wouldn't actually solve your original issue of hands-free access. :( There may be ways to configure it to be the sole means of authentication though.

Apparently it can be set up to send a static password: see https://www.yubico.com/products/services-software/personaliz... .

Incredibly insecure vs the OTP/U2F modes, but probably better than telling people your password.

Reply on news.ycombinator.com