Hacker News Reader

Comment by makepanic | Hacker News Reader

It's a USB keyboard that opens types some commands to open a hard-coded website.

You can't really prevent that.

You could require confirmation before accepting a new input device. This could be done with out of band signaling (such as a button on the computer itself that you push to say “yes, I want to use this keyboard”) or you could do it by requiring the user to type in a secret (such as their login password, or even just a PIN displayed on the screen) to enable it for other uses.

I don’t know that people would accept this inconvenience, though.

> or you could do it by requiring the user to type in a secret

how would you accomplish this given that the normal situation is that you're plugging in a keyboard?

I think the implication is you can type on the plugged in keyboard, but the OS won't pass the input through unless the first thing typed is a secret.

This is somewhat similar to how bluetooth keyboards are enabled on macOS (or were the last time I connected one).

Precisely. You get some authorization box and your input only goes to that box. If you authorize, it then acts like a normal keyboard.

This is pretty much the way a Yubikey or other 2FA token works, no? The only difference being that it doesn't send the text until the sensor is covered.

It's one way a Yubikey can work: Yubikey one time password (OTP). The more common (I think? Newer and standardized at least) way (U2F) accesses the key over some other method that doesn't have it act like a keyboard. There are other operation modes for Yubikeys, but personally I only use U2F and the CCID (aka act like a smartcard) modes.

Reply on news.ycombinator.com