Hacker News Reader

Yubikey is an event based token. You tap it with explicit intent. If you aren't expecting to tap it, then the fail safe is you don't. It works that way by design.

You can't use a screwdriver handle as a hammer then complain it doesn't work to your expectations.

View on HN

I just like to be notified when I need to tap something with explicit intent.

The concern is that if you don't know how many times you should be tapping the YubiKey when you clone a git repo, then an attacker could slip in its own signing requests and you would dutifully tap the YubiKey to authorize them. If you do know how many times to tap, do you still need the notification?

(It's true that if an attacker slipped in a request right before I was expecting to tap my YubiKey, I would tap it a second time to get my operation to succeed under the assumption that it didn't detect my touch the first time. But I would become suspicious if that kept happening.)

It's a bad design for that anyway. It should show me info about what I'm signing on a little display. That would also make it easier to see it needs a touch.

But yeah like someone said below, many actions like github pull would need it. I just want something that makes it easier to see it's waiting for me.

Reply on news.ycombinator.com